Public edge
Cloudflare handles DNS, TLS, proxying, WAF rules, and object delivery.
Operational architecture · public-safe view
Infrastructure that connects public products to owned compute.
I use Cloudflare as the public edge, Railway where managed production helps, and owned VPS/VMI compute where control, privacy, durable state, or private development matters.
Hermes coordinates the work across the stack while Tailscale carries private traffic between devices and workers.
Gateway architecture
The system, end to end.
The image is a dated architecture snapshot. Secrets and IP addresses are omitted. Open it full-size to inspect the labels.
How the layers divide responsibility
Managed where useful. Owned where it matters.
This is operational architecture, not a claim that every service belongs in the same trust zone. Public access, private development, durable state, and human approval stay deliberately separated.
Managed runtime
Railway provides production application runtime and managed Postgres when that tradeoff is useful.
Owned control plane
A NixOS VPS holds the gateway, reverse proxy, durable application state, backups, and Hermes context.
Private build factory
The VMI runs source-owned services, internal QA surfaces, communication systems, and selective public routes.
Private mesh
Tailscale connects workstations, review devices, and specialized workers without exposing their private paths publicly.
Human-reviewed automation
Hermes keeps context and routes work, while consequential actions return to a human approval point.
Selected technologies and services
CloudflareRailwayCaddyTailscaleNixOSUbuntuHermes AgentPostgresR2GitHub CI/CDDocker / containersTelegramMailcowSyncthingTwilioPrivate browser workers
What this demonstrates