Visualizing the defense-in-depth request lifecycle: from public edge Anycast and Cloudflare WAF, through Traefik ingress and Authelia forward-authentication, to containerized workloads and Loki telemetry.
[ 01 / Request Path & Defense-in-Depth ]
Dual-layer perimeter routing, zero-trust forward authentication, and structured logging.
Every inbound HTTP request terminates TLS at the Cloudflare edge before reaching the production Hetzner host over an encrypted origin tunnel. Traefik validates host headers, interrogates the CrowdSec security engine for known malicious threat intelligence, and delegates private route authentication to Authelia via ForwardAuth middleware. Container logs flow through Vector directly into Loki without exposing cluster internals or metrics endpoints to the public internet.
Rendered at build from src/diagrams/request-path.architecture.json
[ 02 / Continuous Delivery & GitOps Mesh ]
Hub-and-spoke automated reconciliation over private WireGuard overlay tunnels.
Application source code and declarative K8s manifests live in GitHub monorepos as the single source of truth. Continuous integration builds multi-architecture container images and publishes immutable sha digests to Docker Hub and GHCR. Argo CD operates as an isolated control plane hub on GCP, rendering environment-specific Kustomize overlays and reconciling spoke clusters across cloud VPS and on-prem homelab through private Tailscale WireGuard tunnels without exposing Kubernetes API port 6443 to the public internet.
Rendered at build from src/diagrams/gitops.architecture.json
Age envelope encryption, in-memory derivation, and ephemeral Kubernetes projections.
No plaintext credentials ever touch version control or developer disks. Sensitive configurations are encrypted at rest using Age asymmetric keys through Mozilla SOPS. When deployed, toolkit secrets streams and decrypts the envelopes entirely in volatile memory, executes one-way cryptographic key derivation (Argon2id for Authelia user databases and bcrypt for Argo CD administrative access), and creates namespace-scoped Kubernetes Secret resources. Workload containers mount credentials exclusively via memory-backed tmpfs projections to guarantee zero disk persistence and prevent inadvertent secret exposure.
Rendered at build from src/diagrams/secret-flow.architecture.json