Every service below runs behind a single hardened TLS edge with strict loopback isolation, cgroup resource guardrails, and per-IP rate limiting. This page maps how public traffic is routed and how internal workloads stay isolated.
Generated at build time through a fail-closed allowlist filter from the internal architecture catalog—preserving topological accuracy while keeping host addresses, ports, file paths, and schemas private.
Public apps
3
Internal services
5
Public HTTPS hosts
2
Databases
3
Request path
Public HTTPS host, then Caddy, then the app on 127.0.0.1, then its data.
Each box links to its app below. On a narrow screen the diagram scrolls sideways.
How it is set up
Hardened TLS & rate-limited ingress
Caddy terminates HTTPS (TLS 1.2 and 1.3) on ports 80 and 443, enforces HSTS, X-Frame-Options, and nosniff headers, and fronts read-only public endpoints with single-flight in-memory caching and per-IP rate limiting.
Strict loopback & cgroup isolation
Every backend service binds exclusively to 127.0.0.1 inside isolated systemd cgroup slices. No internal application port is ever exposed directly to the public network.
Zero public database sockets
All 3 data stores communicate strictly over local loopback or filesystem sockets and are unreachable from outside the host.
Fail-closed build-time projection
Apps, routes, and stores are projected at build time through an explicit allowlist sanitizer—stripping all internal hostnames, ports, paths, and table schemas before static HTML is emitted.
Public apps (3)
Public Web & Knowledge Publishing
thio.dev
Personal Engineering Console, Blog & 3D Agent Showcase
Serves Herdi Agusthio's technical engineering blog, Architectural Decision Records (ADRs), interactive 3D autonomous AI agent office showcase, and public system architecture documentation.
Git-backed Markdown collections for Blog Articles, ADRs, and sanitized Public Infrastructure Projections.
Production Backend API
nikahyuk-api
NikahYuk Wedding Planning & Vendor Marketplace API
Go REST API behind the NikahYuk wedding-planning app: budget calculator, vendor and service marketplace, wedding plans and checklists, with per-IP rate limiting, JWT, and Google sign-in.
Stack
Go, PostgreSQL, golang-migrate, JWT + Google OAuth2, OpenAPI
Single Source of Truth (SSOT) Git repository housing all ADRs, PRDs, engineering plans, blog posts, infrastructure inventory, and the GBrain hybrid semantic/keyword MCP server.