As the "Administration" tag for my blog will attest, the sysadmin side does take a lot of work. Every now and then something is down, something needs defending (like the current HN users all clicking on the site which is running without any caches…), and on and on. In my experience, it's not so much cybercriminals that keep me busy but bad programmers that write spiders that treat every website in the world like corporate infrastructure. Stuff like git, cgit, radicale, a bunch of web apps, a netnews server, an IRC server, those things aren't tricky. But of course I also decided not to host mail, matrix, Next Cloud and so on. You need to pick your battles, too.