⟵ heavenlydemon.consulting / plan — living document

The Plan

What is running, what comes next, and what the machine needs to grow. One server, one tunnel, one reverse proxy — and every application a self-contained module that can be added or removed in minutes.

i.Architecture (live)

No inbound ports are open. Cloudflare terminates TLS and reaches the server over an outbound-only tunnel.

Internet ─▶ Cloudflare edge  (TLS · DNS · DDoS shield · cache)
                │
                │  outbound-only tunnel (cloudflared)
                ▼
        ┌───────────────────── server: /srv/hdc ─────────────────────┐
        │  cloudflared ─▶ traefik :80 ── Host-header routing          │
        │                        ├── heavenlydemon.consulting  → web │
        │                        ├── test.…/rat                → test│
        │                        └── *.heavenlydemon.consulting → any │
        │                             future app, via 2 labels        │
        └──────────────────────────────────────────────────────────────┘

  add an app:   hdc new <name> <subdomain>  →  edit compose  →  hdc dns …  →  hdc up …

ii.Service roadmap

Candidate installs, in rough order. Each is one compose file under /srv/hdc/apps/.

Host	Service	Status	Notes / prereqs
@ / www	web Landing + this plan	LIVE	Static nginx. The Daylight Court — final.
test.*	test grounds Experiments (/rat)	LIVE	Scratch space; break things here first.
search.*	SearXNG Private meta-search	LIVE	HDC-skinned via the /theme/hdc.css token sheet + injection sidecar; JSON API enabled for agents.
example.*	template library Court design system	LIVE	court.css + nine page templates (case study, essay, docs, console, …) for every future page and tool. Design finalized: the Daylight Court; labs (o1–o3) retired.
drive.*	Nextcloud Files, sync, calendar	NEXT	Wants ≥1 GB RAM + Postgres + Redis. Lighter alt: Filebrowser (~30 MB) until RAM upgrade.
img.*	Immich Photo library, ML search	NEEDS RAM	Realistically 4 GB+ with ML jobs; current box has 2 GB. Deploy after hardware step, or run with ML disabled.
git.*	Forgejo Git hosting, CI later	NEXT	Tiny footprint (~200 MB). Also becomes the remote for /srv/hdc itself.
vault.*	Vaultwarden Password manager	LATER	Feather-light. Put Cloudflare Access in front; backups are non-negotiable.
status.*	Uptime Kuma Monitoring + status page	NEXT	Trivial install; gives eyes on everything else.
home.*	Homepage Dashboard of all services	LATER	Static config; add once 3+ services exist.
media.*	Jellyfin Media streaming	LATER	Transcoding is CPU-hungry; direct-play is fine today. Pair with the 1 TB library drive.
notes.*	Memos / Outline Notes & docs	LATER	Memos is single-binary light; Outline wants Postgres.
auto.*	n8n Workflow automation	LATER	The consulting demo machine: client integrations, webhooks, schedulers.
ai.*	Open WebUI LLM front-end	NEEDS RAM	UI itself is light if inference stays on the desktop GPU or an API; local models need a bigger box.

iii.Hardware & platform

Base OS — Arch Linux, LTS kernel, Docker, 4 GB swap. done 2026-07
Ingress — Cloudflare Tunnel + Traefik v3, zero open ports.
RAM upgrade — 2 GB → 16 GB is the single highest-impact change; unlocks Immich, Nextcloud, and AI experiments simultaneously.
Storage — add a data drive for /srv/hdc/data (photos + files will dwarf the 91 GB root).
DHCP reservation — pin 192.168.0.114 in the router so a reboot can never strand the SSH port-forward.
UPS — cheap insurance once real data lives here.

iv.Security & operations

SSH keys — key auth active for admin.
Harden SSH — disable password auth + root login once keys are confirmed on all admin machines.
Cloudflare Access — free Zero-Trust login wall in front of admin UIs (vault, status, traefik) before they exist.
Backups — restic → Backblaze B2 (or the 1 TB library HDD) nightly; test restores quarterly. Data without backups is a rumor.
Updates — monthly window: pacman -Syu + hdc pull <app> per app; never auto-update databases.
Secrets — per-app .env files, gitignored; rotate anything ever pasted into a chat or ticket.

Rule of thumb: the spine (proxy + tunnel) changes rarely and carefully; apps change freely and often. Anything that can be expressed as a compose file in apps/ is cheap to try and cheap to delete — so try things.