mnemonist.tech cultivating intelligence

Colophon

How this page
reached you.

Nothing below is rented from a platform or assembled from screenshots. It is a complete, production-grade infrastructure stack: owned, declared in code, and operated by one person to the standard you would demand of a team. The tools are current. The discipline is older than all of them.

your browser TLS 1.3 / HTTP3 traefik edge Let’s Encrypt EVPN fabric BGP / VXLAN / BFD proxmox VM OpenTofu / Salt container hardened, static

Each layer below starts with what it costs when this goes wrong, then the control that prevents it. The engineering sits underneath, for anyone who wants to check the work.

01

Name & edge

A site that goes offline costs reputation, discoverability, and usually revenue, and a lapsed certificate is among the most common causes.

The certificates on this domain renew themselves, with nothing exposed to the internet to obtain them and no one required to remember.

Route 53 · Traefik · Let’s Encrypt · TLS 1.3 · HTTP/3

The specifics

Route 53 spreads the zone’s authoritative nameservers across four separate top-level domains, so the loss of an entire TLD cannot take the domain with it. It is a resilience property almost nobody looks for and few registrars give you by default. TLS is modern-only, which removes the downgrade and legacy-cipher classes of attack rather than mitigating them, and HTTP/3 carries the session over QUIC, so packet loss stalls a single stream instead of the whole connection. Traefik takes its routing from dynamic configuration rather than a file it must be restarted to read, so new workloads arrive and retire without a platform-level change at the edge.

02

Fabric

A failed link is not merely an interruption. It is orders delayed or lost, transactions unprocessed, and data left half written.

The fabric behind this page reroutes around one in under a second, using the design large data centres use, at a scale one person can operate.

OSPF · BGP EVPN · VXLAN · BFD

The specifics

OSPF distributes loopback identity through the underlay, so every device keeps a stable address to be reached at no matter which physical path survives, and BGP EVPN builds the overlay on top of that. Layer 3 forwarding runs in switch hardware rather than in software, so routing between segments happens at line rate and segmentation costs nothing in throughput. Access control is enforced on the switches themselves as well as at the host firewalls, so a compromised host is contained by the network it sits on rather than by its own good behaviour.

03

Compute

Infrastructure built by hand keeps its design decisions in one person’s head, and documentation rarely captures why a thing was done rather than what was done.

Every server here is defined in code, so the decision and the deployment are the same artefact, and any machine can be rebuilt on demand rather than nursed.

Proxmox VE · OpenTofu · cloud-init

The specifics

Machines are declared in OpenTofu against Proxmox, with cloud-init supplying first-boot identity and networking, and state held in a shared remote backend rather than on somebody’s laptop. Workloads are placed so that no single hypervisor failure can take both halves of anything that matters: the two DNS resolvers sit on different hosts, and the secrets store replicates continuously to its peer and restarts there automatically if its own node dies. The provider credential is scoped to one resource pool and the module refuses any machine identifier outside a reserved range, so the blast radius of an error is bounded by design rather than by care.

04

Configuration

Bespoke configuration drifts, and troubleshooting then runs against a system whose state everyone has assumed wrongly. Avoidable faults become long outages, and an unpatched host is an open door nobody has walked through yet.

These hosts are hardened continuously against an established benchmark and patched on an orchestrated schedule, so their configuration is a matter of record rather than recollection.

SaltStack · CIS-derived hardening · orchestrated patching

The specifics

Hosts declare a role and converge to it, so there is no per-machine configuration to drift from in the first place. The hardening baseline is layered with selectable levels derived from CIS guidance, and every exception is written down where a control would break a container workload, because an undocumented exception is indistinguishable from an oversight. Patching is orchestrated rather than incidental: security updates apply automatically and reboots are staggered inside a maintenance window, so no host waits on a person to notice a vulnerability. Full state re-applies on a schedule as well as on demand, so drift is corrected before anyone notices it happened.

05

Runtime

Every unused component lowers the difficulty for a hostile actor, and a breach is expensive whether or not anything goes down.

The software serving this page runs with minimal privilege and with everything it does not need stripped out.

Hardened containers · unprivileged · minimal

The specifics

The site is served from a minimal image with no shell and no package manager, running as an unprivileged user on a read-only root filesystem, with all Linux capabilities dropped and privilege escalation disabled. The container daemon itself runs rootless, so an escape lands in an unprivileged account rather than on the host. Hardened base images are the fleet default rather than a decision taken per service.

06

Pipeline

Deployment by checklist is only ever as reliable as the person working through it, and mistakes in complex releases buy outages, overtime, and the costs that follow both.

Every change to this site publishes itself end to end, and every page records the version that produced it, so what is running is always attributable.

GitLab CI · reproducible builds · deploy verification

The specifics

A commit is the only manual step. From there the change is built, packaged, deployed, and then checked, with nobody shepherding it between stages. The verification is the part that earns its place: it fetches the deployed page through the public edge and asserts that the commit it was built from is the commit now being served, so a green pipeline means the change is live rather than merely shipped. Assets are content-hashed, so a cached stylesheet cannot outlive the markup that expects it.

07

Trust

Leaked credentials lead reliably to compromise, or to disclosure nobody intended, and shared secrets are seldom rotated once the people who knew them have moved on.

Nothing here holds a lasting one. Credentials are short lived and issued machine to machine, so there is nothing for a person to remember, forget, or disclose, and nothing sitting in plaintext to steal; devices carry their own, revocable the moment one goes missing.

OpenBao · two-tier private PKI · OIDC federation · EAP-TLS

The specifics

A two-tier private certificate authority sits behind a secrets engine: a root kept out of daily use signs one intermediate, and only the intermediate issues. Pipelines authenticate by presenting a signed identity token from the CI system and exchanging it for a short-lived token scoped to precisely what that job may read, which is why there is no stored credential to rotate. Configuration management authenticates through its own role rather than borrowing the pipeline’s. Issued certificates renew themselves well ahead of expiry, so the forgotten-renewal outage has no way to occur. Wireless authentication is certificate-based, and the revocation list is published publicly, because a revocation list nobody can reach protects nobody.

08

Observability & recovery

Restoring an untested backup is a gamble, not a recovery plan, and mid incident is the wrong moment to learn what it did not contain. Person-years of work can disappear while everyone assumes it is retrievable.

This estate is monitored throughout, everything that matters is copied off site nightly, and the restore itself is rehearsed and documented. Nothing here is assumed.

VictoriaMetrics · Grafana · LibreNMS · rehearsed DR

The specifics

Metrics are scraped into a time-series database and surfaced in dashboards, with network devices polled over SNMPv3. Backups are encrypted before they leave the building and replicated off site nightly. The recovery path has been executed end to end from those backups onto clean hardware, timed, and written up as a runbook, which is the only evidence that separates a backup strategy from a hope.

Don't take my word for it

Every claim on this page is externally checkable, right now, against the live site:

This copy of the page: commit 66ffe37c, pipeline 883. Zero third-party requests, zero trackers, one small first-party script (the theme toggle). View source. It is meant to be read.

None of this is about the tool names. Scale is not what makes infrastructure serious. Governance is. Small systems deserve institutional discipline, because the discipline is what transfers.