What are the ways/strategies to maintain Drupal sites a over period of 10-15 years? We have started using Drupal as a PHP programming framework (and not just as a CMS). As result, we have many projects running on Drupal (6 or 7).

Typically, after 2-3 years a project gets over and no further development is done on that project. Then, we put that project into a maintenance or dormant mode.

The problem is that at the end of a project, there is hardly any money left for actively maintaining (e.g updating modules/core for security fixes) that project for over a period of say 10 years. And, there is no way that we can ask for maintenance money for a project (this is a sad fact).

So, we were brainstorming what would be the way to maintain Drupal sites securely for say a period of at least 10 years.

Some ideas were:


Convert entire Drupal site into bunch of static pages using some tool (I suspect this might break lot of interactive functionality in Drupal)
Lock down write access to MySQL database
Run dormant Drupal based sites in a Virtual Machine
Block all input fields on a Drupal site including login functionality (i.e make all content publicly accessible)


I also expect that in a period of 10 years following things might happen:


A server's hardware might be upgraded 
A new PHP version might be installed
A new MySQL database might be installed
A server's OS might not be supported by a vendor for security updates 
Certain Drupal modules may not be supported or may get deprecated by an other module
In the worst case, the required PHP or MySQL versions itself may not be supported by the community


What are the ways/strategies to securely maintain (i.e. keep them running) dormant Drupal sites for a very long period?
Like you mentioned there are many moving parts about Drupal that can require maintenance, so your strategy should be to remove as many dependencies as you can within your requirements.

If it is not a requirement that your Drupal sites continue as dynamic systems where content can be created, updated, or deleted then you should remove MySQL and PHP by generating static files. There is good documentation for creating static archives of a Drupal site at http://drupal.org/node/27882.

Since you mentioned putting the site into a "maintenance or dormant mode" it sounds like a static solution would be the best for you.

If you require the continual functional use of the site you could consider moving the site to a managed solution. Managed hosting providers can take care of the web and database server, but for further management of the Drupal code you could consider a service like http://drupalgardens.com.