We have started using Drupal as a PHP programming framework (and not just as a CMS). In result, now we have lots of projects running on Drupal (6 or 7).
Typically after 2-3 years a project gets over and then there is no further development is done on that project. Then we put that project into a maintenance or dormant mode. The problem is that at the end of a project, there is hardly any money left for actively maintaining (e.g updating modules/core for security fixes) that project for over a period of say 10 years. And, there is no way that we can ask for maintenance money for a project (this is a sad fact). So, we were brainstorming what would be best ways to maintain Drupal sites securely for say a period of at least 10 years.
Some ideas were:
- Convert entire Drupal site into bunch of static pages using some tool ( I suspect this might break lot of interactive functionality in Drupal)
- Lock down write access to MySQL database
- Run dormant Drupal based sites in a Virtual Machine
- Block all input fields on a Drupal site including login functionality (i.e make all content publicly accessible)
I also expect that in a period of 10 years following things might happen:
- a server's hardware might be upgraded
- a new PHP version might be installed
- a new MySQL database might be installed
- a server's OS might not be supported by a vendor for security updates
- certain Drupal modules may not be supported or may get deprecated by an other module
- in worst case required PHP or MySQL versions itself may not be supported by the community
So, my question is what are the best ways/strategies to securely maintain (i.e keep them running) dormant Drupal sites for a very long period ?