SYSTEMS
Everything on this map is real and running. One always-on Linux server is the hub; Cloudflare fronts the public edge; a private mesh carries everything else. The site you are reading is served from the infrastructure it documents.
The topology
edge
Cloudflare edge
DNS, CDN cache, and DDoS front for every public domain — plus two Zero-Trust tunnels and Access policies gating the private apps behind identity.
hub
serrano
The always-on Ubuntu home server — nginx, systemd services, Docker. Every domain on this map terminates here; deploys land here over SSH with health-gated, one-command-rollback scripts.
site
danielju.com
This site — Next.js SSR as a systemd service behind nginx, Cloudflare in front. Deployed by a health-gated script that auto-rolls-back on failure. It documents the machine it runs on.
site
term.danielju.com
DELAMAIN’s live instance — FastAPI + Next.js behind a Cloudflare Tunnel, gated by Cloudflare Access to a single identity. The personal AI operating system, in production.
site
jobs.danielju.com
Outreach Desk — the Dockerized outreach control plane behind its own Cloudflare Tunnel and Access policy. Invite-only; live sending enabled under hard caps.
site
thriftcycle.tech
ThriftCycle’s production deployment — static frontend plus FastAPI backend under nginx + systemd. Still live after the hackathon win.
site
lafrontera.page
La Frontera — fully static editorial magazine, rsync-deployed to nginx. Zero-server production.
service
Utility services
The operational shelf: Netdata monitoring behind basic auth, a Go file-drop service, and a Pterodactyl game panel — each an isolated nginx site.
net
Tailscale mesh
The private network layer — workstation, MacBook, server, and phone reach each other over WireGuard-based mesh, no ports exposed. SSH and admin traffic never touch the public edge.
net
Syncthing
Continuous file sync across the fleet — the Obsidian knowledge vault and a shared agent workspace replicate between Windows, macOS, and the server with conflict-quarantine hygiene.
device
GPU workstation
Windows desktop with an RTX 5070 — model training (CUDA 12.8), development, and the heavy end of the ML pipelines. The Convergence Mirage’s 40 frozen runs trained here.
device
MacBook
The portable control machine — same repos, same vault, same mesh. Any device can drive the fleet.
Why it exists
This map documents how the deployed projects are operated. One always-on Linux server carries the public surface: this site as a Node service behind nginx, DELAMAIN and Outreach Desk behind Cloudflare zero-trust tunnels, ThriftCycle and La Frontera as production sites that outlived their deadlines. Deploys are scripted, health-gated, and one command from rollback.
Below the public edge sits the private layer: a WireGuard-based mesh connecting the GPU workstation, the MacBook, and the server with no exposed ports, and continuous file sync replicating a knowledge vault and a shared agent workspace across all three. The ML pipelines train on the workstation; the results ship from the hub.
Uptime, service health, and last-deploy timestamps are planned for a later pass, backed by a small read-only status endpoint.