We have started using Drupal as a PHP programming framework (and not just as a CMS). As result, we have many projects running on Drupal (6 or 7).

Typically, after 2-3 years a project gets over and no further development is done on that project. Then, we put that project into a maintenance or dormant mode.

The problem is that at the end of a project, there is hardly any money left for actively maintaining (e.g updating modules/core for security fixes) that project for over a period of say 10 years. And, there is no way that we can ask for maintenance money for a project (this is a sad fact).

So, we were brainstorming what would be the way to maintain Drupal sites **securely** for say a period of at least 10 years.

Some ideas were:

 1. Convert entire Drupal site into bunch of static pages using some tool (I suspect this might break lot of interactive functionality in Drupal)
 2. Lock down write access to MySQL database
 3. Run dormant Drupal based sites in a Virtual Machine
 4. Block all input fields on a Drupal site including login functionality (i.e make all content publicly accessible)

I also expect that in a period of 10 years following things might happen:

 - A server's hardware might be upgraded 
 - A new PHP version might be installed
 - A new MySQL database might be installed
 - A server's OS might not be supported by a vendor for security updates 
 - Certain Drupal modules may not be supported or may get deprecated by an other module
 - In the worst case, the required PHP or MySQL versions itself may not be supported by the community

What are the ways/strategies to securely maintain (i.e. keep them running) dormant Drupal sites for a very long period?