BYTEGEIST / CONTROL PLANE
LAB CONFIGURATION / VERIFIED OCT 2026
--:--:-- AMERICA / DETROIT
INFRASTRUCTURE OVERVIEW CONNECTING TO TELEMETRY

SELF-HOSTED INFRASTRUCTURE ENVIRONMENT

Personal cloud.
Operational by design.

A working infrastructure lab for identity, observability, delivery, security, and recovery. Built and maintained as an evolving system—not a static demo.

CPU LOAD --%

PROMETHEUS / NODE EXPORTER

MEMORY --%

PROMETHEUS / NODE EXPORTER

HOST UPTIME --

NODE EXPORTER

RUNNING CONTAINERS --

CADVISOR VIA PROMETHEUS

SCRAPE TARGETS --

PROMETHEUS TARGET HEALTH

TELEMETRY CONNECTING

PROMETHEUS / CADVISOR

GRAFANA / BYTEGEIST OPERATIONS FULL RES ↗
Grafana operations dashboard screenshot from the ByteGeist monitoring stack
SYS.01

Infrastructure topology

Traffic, identity, workloads, telemetry, and recovery paths documented for the Hetzner host.

DOCUMENTED
EDGE Nginx Proxy Manager TLS termination / routing
IDENTITY Authentik OIDC / SSO / 2FA
COMPUTE Docker Compose Containerized workloads
TELEMETRY Prometheus + Loki Metrics / logs / alerts
ByteGeist infrastructure architecture diagram
BYTEGEIST-CLOUD / REV 04 SELECT DIAGRAM TO INSPECT
OBS.02

Monitoring stack

Host metrics, container telemetry, centralized logs, and independent uptime checks.

STACK DOCUMENTED
LOG PIPELINE Loki / Grafana Alloy Container output searchable by service and host
Centralized logs in Grafana
MONITORING COVERAGECONFIGURED
  • Host metricsCONFIGURED
  • Container metricsCONFIGURED
  • Application logsCONFIGURED
  • Endpoint uptimeCONFIGURED
  • Resource alertsCONFIGURED
  • Security eventsCONFIGURED
GrafanaPrometheusLoki AlloyNode ExportercAdvisor
APP.03

Service inventory

Core applications represented in the internal service portal configuration.

LAST VERIFIED OCT 2026
ServiceRoleAccessState
GiteaSource controlSSOCONFIGURED
Wiki.jsDocumentationSSOCONFIGURED
DashyService portalSSOCONFIGURED
VaultwardenSecretsDIRECTCONFIGURED
Stirling PDFDocument toolsSSOCONFIGURED
IT ToolsUtilitiesSSOCONFIGURED
Uptime KumaAvailabilitySSOCONFIGURED
SERVICE PORTAL Dashy / internal access layer
ByteGeist Dashy service portal
DEV.04

Delivery pipeline

Git-based workflows from repository change to automated deployment.

PIPELINE EVIDENCE
01COMMITGitea repository
→
02BUILDWoodpecker runner
→
03VERIFYStatic checks
→
04DEPLOYDocker host
GITEA / REPOSITORIES
Gitea repositories dashboard
WOODPECKER / PIPELINE
Successful Woodpecker CI pipeline
SEC.05

Identity & perimeter

Central authentication, protected services, and documented hostile-traffic detection controls.

CONTROLS DOCUMENTED
AUTHENTIK Protected applications / OIDC / 2FA policy
Applications protected by Authentik
ACCESS POSTURE HARDENED KEY-ONLY SSH / SSO / TLS
  • OIDC providersCONFIGURED
  • Forward-auth appsCONFIGURED
  • 2FA policyENFORCED
  • Public SSH passwordDISABLED
CROWDSEC / SECURITY EVIDENCE Threat detection and firewall-decision history
CrowdSec firewall decision evidence
DR.06

Recovery state

Configuration in Git, persistent data backups, and an explicit rebuild sequence.

RUNBOOK DOCUMENTED
01Provision hostUbuntu / firewall / SSH
02Restore configGit / Compose / secrets
03Restore dataVolumes / databases
04Validate edgeDNS / TLS / identity
ByteGeist disaster recovery runbook