As of now, the server and the database have to exist on a single VPS, so DDoS protection is based mostly on whatever Cloudflare-like packet dropping proxies are placed in front of that VPS. There’s no database sharding or anything like that. And honestly I don’t think their infrastructure’s been nearly as stress tested as Hexbear. A single person spamming the websocket took Lemmygrad down for a troubling portion of last week