// Infrastructure
The patterns we use. Not the specifics.
Every service runs on architecture we designed and maintain — Cloudflare-fronted, self-hosted, container-isolated. Here's how the pieces fit together, without disclosing the specifics that would put customer workloads at risk.
// Architecture principles
Three rules that govern every deployment.
01
Zero inbound exposure
All public traffic enters via Cloudflare — Tunnel for HTTPS services, edge proxy for everything else. No origin services bound to the public internet. Outbound-only connections from our network to Cloudflare's edge.
02
Container-isolated workloads
Each service runs in its own container, on its own internal network where appropriate, and services reach each other by Docker hostname rather than exposed host ports. Isolation limits how far a problem in one service can reach.
03
Default-deny everything
Nothing on the host accepts connections from the public internet: no port forwards, no inbound ports. Management interfaces are local-only or behind Cloudflare Access.
// Network architecture
How a request reaches a service.
All public traffic enters via Cloudflare — its edge handles TLS termination, caching, WAF, and DDoS mitigation before anything reaches our infrastructure. From there, Cloudflare Tunnel delivers the request to the appropriate container. No service publishes a routable interface to the public internet.
// Container stack
What runs on the box.
| Container | Role |
|---|---|
| AMP | Game server management |
| Immich | Photo and video backup |
| Uptime Kuma | Service monitoring |
| Cloudflared | Outbound-only tunnel connector |
| Restic / Backrest | Encrypted off-site backup |
Network bindings, internal addressing, and access policies are not disclosed. What's on the box is not what protects the box.
// A pattern we like
Hostnames over addresses.
The most common multi-container failure pattern is wiring services to each other through the host machine's address. It breaks when containers restart in a different order, when the host's address changes, or when a network gateway is introduced between the stack and the public internet.
The fix is mechanical: configure inter-container traffic by Docker container hostname instead. Docker's internal DNS resolves the hostname regardless of restart order, network namespace changes, or address reassignment.
Containers in our stack that talk to each other do it by hostname. It's a ten-second config change that eliminates an entire class of failures and removes a dimension of fragility from the deployment.
◆ Next step
Questions about the setup?
It's the same architecture we build for clients. If you want it in your environment, that's Infrastructure Consulting.