Case study
Production environment
~50 services across the machines. This portfolio is one of them.
Designed and operate it · 2024 – present · In production
Before
One box on the internet. The site and the private stuff sat too close together.
Now
A front door on the internet. The rest stays private. This site comes through that door. I decide who else gets in.
Context
I needed a place my products could live without putting databases, source, secrets, and backups on the public internet. Three roles: an edge the world can touch, a private path between machines, and a hub for everything that should never face the world. Source, identity, search, copies, and this site all sit in that split.
Constraints
- A published site cannot sit on the same open box as the keys and the book of data.
- Health and “how did they get here” have to be visible to me and invisible to the public.
- A copy I have never restored is not a copy.
- Someone I invite in should not have to install extra software unless I require it. Everyone else stays out.
What I built
- 1.Internet — Only what I mean to publish.
- 2.Edge — The one way in. Sends a visitor to one service, not the building.
- 3.Private path — Machines talk to each other here.
- 4.Hub — Source, secrets, copies, health.
- 5.Apps — Sites and databases — reached through the edge, or not at all.
Traffic for this site hits the edge and is handed to one container. The machine that holds the rest is not hanging on the internet.
Hard problems
A door, not a building on the street
If the box that holds the data is also the box on the internet, anyone who finds the box is too close to the data. The edge sends the public to this site — and only this site. Source, secrets, and copies stay on the private side.
Who gets through
I can put a client’s name on the edge without handing them the building. People I invite in get through on my terms. Extra software is optional. That is the difference between “here is your site” and “here are my keys.”
See it before customers do
I watch whether something is getting sick and where visitors came from. That picture stays on my side. I have not turned “this should not have changed” into a pager yet. Silence is not a guarantee.
A copy I have actually used
I deleted a volume on purpose, let the machine come back, and got the data. Not every service is on that path yet. The ones that matter enough to test, I have tested.
Outcome
- On it
- This site
- Services
- ~50 across the machines
- Access
- Invite only — extra software optional
- Restore
- Tested, not assumed
Close
- What this proves
- A place products can live without putting the private side on the street. You are looking at one of them.
- What I would keep
- One way in. Restore is something I have done. An invite is not a set of keys.
- What is still open
- Not every service is on automated copies. Unexpected-change alerts are still a watch. Other products move here when they are ready — they are not all here today.