Architecture

Four layers on one host: edge, observability, secrets, and the infrastructure automation underneath them.

Edge — Traefik reverse proxy with automatic HTTPS, Portainer, and the DNS-01 challenge webhook
Observability — the LGTM stack (Loki, Grafana, Tempo, Prometheus) with collectors
Secrets — OpenBao, with SOPS/age as bootstrap and disaster-recovery backup
Infrastructure — Docker Compose orchestration, Tailscale VPN for admin access, Ansible playbooks for host provisioning

Network topology

Internet                         Tailscale Network (100.64.0.0/10)
   ↓                                     ↓
Traefik (edge network)           ┌──────────────────────────┐
   ↓                             │ Admin Services           │
┌─────────────────────────────┐  │ - Traefik Dashboard      │
│ Public entrypoints          │  │ - Portainer UI           │
│ - :80  (HTTP-01 validation, │  │ - Grafana                │
│         redirect to :443)   │  │ - OpenBao UI             │
│ - :443 (TLS termination)    │  └──────────────────────────┘
└─────────────────────────────┘           ↓ (DNS-01 certs)
                                 ┌──────────────────────────┐
   ↓                             │ DNS Manager              │
┌─────────────────────────────┐  │ (Webhook for ACME)       │
│ Internal (hill90_internal)  │  └──────────────────────────┘
│ - Loki (logs)               │           ↓
│ - Tempo (traces)            │  Hostinger DNS API
│ - Promtail (log collector)  │  (TXT record management)
│ - Node Exporter (host)      │
│ - cAdvisor (containers)     │
└─────────────────────────────┘
   ↓
┌─────────────────────────────┐
│ Edge + internal             │
│ - Prometheus (metrics)      │
│ - Grafana (dashboards)      │
│ - OpenBao (secrets)         │
└─────────────────────────────┘

Network isolation

Network	Property	Purpose
`hill90_edge`	ingress-facing	Traefik and the services it routes
`hill90_internal`	`internal: true`	Private service-to-service traffic, unreachable from outside the host
`hill90_agent_internal`	`internal: true`	Retained from the shelved application, currently unused by any running container

docker-compose.infra.yml is the sole owner of all three networks. The observability and vault stacks declare them external: true, which is why the edge stack must deploy first on a fresh host. Admin surfaces are additionally restricted to the Tailscale CGNAT range (100.64.0.0/10) by a Traefik IP-allowlist middleware, and SSH is restricted to the same range at the firewall.

Service responsibilities

Service	Responsibility
Traefik	Reverse proxy and TLS termination. HTTP-01 for public hostnames, DNS-01 for Tailscale-only ones. Dashboard at `traefik.hill90.com`, behind basic auth plus the Tailscale allowlist.
dns-manager	HTTP webhook for Let’s Encrypt DNS-01 challenges. Translates the Lego `httpreq` format to the Hostinger DNS API, creating and deleting TXT records.
Portainer	Docker container management UI at `portainer.hill90.com`.
OpenBao	Secrets management at `vault.hill90.com`, token-authenticated. There is no SSO — see Secrets.
Prometheus, Grafana, Loki, Tempo	Metrics, dashboards, logs and traces.
Promtail, node-exporter, cAdvisor	Log and metric collectors.

Security posture

Public internet access is limited to ports 80 and 443, handled by Traefik. Every administrative surface is reachable only through Tailscale.
SSH uses key-based authentication only; password auth and root login are disabled, and fail2ban is enabled.
The Traefik dashboard password hash is generated at deploy time from encrypted secrets into a gitignored .htpasswd.
ACME state is persisted in mounted Traefik storage so renewals survive restarts.
CI blocks destructive Docker commands (down -v, volume rm, system prune, --remove-orphans) from entering scripts or workflows.
No service in the current stack sends email. Keycloak was the only sender and went with the application.

The verification checklist for the posture above — make health, public-versus-Tailscale SSH, make dns-verify, ACME issuance in the Traefik logs, ten containers in docker ps — lives in the security architecture doc linked below.

Source documents

These are maintained beside the code and are the authority. This page summarises them.

docs/architecture/overview.md — the full architecture record
docs/architecture/security.md — access boundaries, hardening, verification checklist
docs/architecture/certificates.md — certificate management in depth
docs/reference/deployment.md — compose files, project names, deploy safety policy

Hill90

Running it

Record

Architecture

Architecture

Network topology

Network isolation

Service responsibilities

Security posture

Source documents

​Architecture

​Network topology

​Network isolation

​Service responsibilities

​Security posture

​Source documents

Architecture

Network topology

Network isolation

Service responsibilities

Security posture

Source documents