Infrastructure Lab

A single Debian host, rebuilt from scratch and described entirely in a public Git repository. This page is served by that description.

Host

How it is built

• Reproducible, not remembered. Hardening is a single idempotent script with a report mode that changes nothing and an apply mode that does. Running it twice is a no-op, so it doubles as a drift check.
• Reversible before it is permanent. The firewall arms a dead man's switch when it activates: without an explicit confirmation from a session that still works, the ruleset removes itself after ten minutes. Locking yourself out is not a possible outcome.
• Scoped, not global. The ruleset replaces only its own nftables table. Tailscale and Docker install tables of their own at runtime, and a global flush would quietly delete them — a failure that only surfaces at the next reboot.
• Services declare themselves. Routing, TLS and security headers live in each service's Docker labels. Adding a site does not mean editing the proxy.
• No secrets in the repository. Hostnames, contact addresses and credentials come from an environment file that is never committed. The repository describes the shape of the system, not this particular instance of it.

Deliberate limits

• Automatic updates install security patches but never reboot on their own. An unattended reboot is how a healthy stack becomes an outage at 4am.
• Ports for services are opened when a service exists to answer on them — not in advance.
• Container images are pinned to a minor version, so a rebuild picks up patches without silently changing major versions.