The platform behind this site.
I run my own infrastructure the way I build it for clients: simple layers, encrypted by default, and observable end to end.
Principles
The same rules apply to everything I deploy.
Encrypted by default
Every public service sits behind TLS with certificates issued and renewed automatically. Remote access goes through VPN or key-based SSH only.
Isolation
Workloads live in separate virtual machines on a private network. Only the reverse proxy is reachable from the internet.
Observability
Metrics and logs feed Grafana dashboards, with alerts for disk, CPU, certificates and service health.
Backups
Regular off-host backups with restore tests — a backup you have never restored is only a hope.
Reproducible
Configuration lives in version control. Changes are reviewed, scripted and easy to roll back.
Maintained
Regular patching and housekeeping, with clear documentation so nothing depends on one person's memory.
Toolbox
Boring, proven tools — chosen for reliability over novelty.