GOAL
A personal site run like a production service. The page itself is static; everything around it is the work I do: infrastructure in Git, tested and scanned builds, GitOps deploys with approval and one-commit rollback, and monitoring that anyone can look at.
Everything runs on one VPS, in a single-node k3s cluster: the site, its edge, GitOps, monitoring and alerting. Every component has a memory budget and a reason to be there.
- Everything in Git: Helm charts, Argo CD apps, dashboards, alert rules, encrypted secrets
- Non-root, read-only containers with measured memory limits; default-deny network policies
- CI has no access to the server: it pushes an image and a commit, the cluster pulls
- Rollback = git revert of the release commit; a lost server is rebuilt from Git
STACK
Hover or tap a technology to see its job here.
ARCHITECTURE
DELIVERY
- git push
- GitHub Actions: build, e2e, Lighthouse, Helm checks
- Trivy scan → image in GHCR
- manual approval
GITOPS
- release commit (image tag)
- Argo CD sync to k3s
- rolling update, no downtime
- live version check
RUNTIME
- visitor
- fail2ban: banned scanners dropped
- Traefik: TLS, HSTS, rate limits
- nginx pod: static files, /api/status
OBSERVABILITY
- blackbox probes, node & pod metrics
- Prometheus
- pod logs → Alloy → Loki
- Grafana (public, read-only)
ALERTING
- alert rules
- Alertmanager
- Discord
- server down: healthchecks.io