Visitors
Any visit to a site or a demo. It comes in over HTTPS and resolves through DNS to the server's single proxy.
HTTPS · 11 sites behind one proxy
DNS
A wildcard A record points all of *.taller.works at the VPS. Adding a site doesn't touch DNS.
wildcard A · *.taller.works
Caddy
The server's single reverse proxy. It issues and renews certificates on its own, routes each subdomain to its container and is the only door into the internal network.
automatic TLS · wildcard *.taller.works · 11 virtual hosts · n8n behind the proxy
Telegram
The Telegram bots call in by webhook. The proxy only accepts those requests when they come from Telegram's IP ranges.
3 bots · IP range filter
WordPress × profiles
Each site is a Compose service enabled by profile: it starts when someone asks for it. Two fit at a time.
Compose profiles · 384 MB per site · max. 2 running
MariaDB
A single database shared by every WordPress site: less memory than one per site.
one instance · backups with wp db export
wp-cli
Tools container for migrations, exports and search-replace without installing anything on the host.
migrations · search-replace
Backups
Database export and an uploads tarball per site; restore rewrites URLs with search-replace.
wp db export · uploads tarball · n8n workflows
appsMonitor
My control panel: it starts and stops demos by reading Compose labels. Before starting one it checks memory and load, a rule that came from a 12-minute outage.
MAX_RUNNING=2 · ≥ 400 MB free · load < 2
n8n · 6 flows
Six flows in production: sign-ups, bookings, bots, reminders and the weekly status. Human approval with Wait + webhook and rate limiting.
6 flows · Wait + webhook · rate limiting
AI agent runner
Express service that runs Claude Code headless inside Docker. Only n8n calls it, from the internal network, with header auth.
idle watchdog · Chromium for screenshots · model fallback on OOM
Weekly cron
Every Monday at 9:00 the live URLs are checked for a 200 and the status reaches Telegram through n8n.
Mondays 9:00 · URLs → 200 · Telegram alert
Host hardening
What the provisioning script leaves on the host before a single container runs.
ufw · fail2ban · key-only SSH · non-root user · unattended-upgrades · 2 GB swap
GitHub Actions
The appsMonitor panel deploys from GitHub Actions: SSH, rsync and a service restart.
SSH + rsync · service restart
Vercel · 13 projects
The Next.js products live on Vercel, with Neon from the Marketplace, crons and variables marked Sensitive.
13 projects · Neon · crons
AWS
At NTT DATA I work on Kubernetes on AWS; for 3Destiny, the client's EC2 with SSM access and DNS on Route53.
EKS · RDS Oracle · EC2 via SSM · Route53
Cloudflare
Cloudflare tunnels to show a demo running on my machine without opening ports.
cloudflared