It's just Nginx + Phoenix on a rented Linode server. It's in beta, so I don't care much about security beyond the basics...

EDIT: I could drop Nginx and use "raw" cowboy (the webserver behind phoenix), but Nginx makes it easier to setup TLS certificates and I'm lazy enough to keep it around just because of that...