Development portal hosting

Current decision

The database-backed development portal runs at https://developer.sitraachra.com in an unprivileged Debian 13 LXC on the existing Proxmox server. Cloudflare Tunnel is the only web ingress; the home network does not expose the application, PostgreSQL, or an SSH port to the public internet. The former docs.sitraachra.com site is deprecated and redirects to the corresponding portal route.

The initial host uses Debian-supported system packages and systemd services rather than Docker inside LXC:

• Next.js application and background worker on Node.js 20.
• PostgreSQL 17 over a local Unix socket.
• nginx bound only to 127.0.0.1:8080 for Cloudflare Tunnel.
• Local upload and export storage under /srv/sitra-portal/shared/.
• Daily PostgreSQL and upload archives under /srv/sitra-portal/backups/.
• Unattended Debian security upgrades.
• A hardened sitra-portal.service running the active Next.js standalone release.
• A hardened sitra-portal-tunnel.service running the named Cloudflare Tunnel.
• An immutable release layout with atomic activation and health-check rollback.

The tracked host configuration lives in tools/portal-host/. The bootstrap installs missing Debian packages, is safe to rerun, and is the canonical record of host-level configuration. The deployment account accepts public-key authentication only. The application, tunnel, database, reverse proxy, and backup timer are active and enabled.

Cloudflare Access protects the portal with the existing GitHub identity policy. Anonymous portal access is disabled. nginx rejects requests without an Access assertion, and the application independently validates the assertion’s signature, issuer, audience, lifetime, and editor email before trusting it.

Host allocation

The LXC currently has eight CPU cores, 8 GB RAM, 4 GB swap, and a 100 GB ZFS-backed root filesystem. Its reserved LAN address is 192.168.68.132. The address is operational metadata, not a public endpoint.

Persistence and recovery

PostgreSQL is the working source of truth for portal content. Markdown exports to GitHub provide portability but do not replace database backups. The local timer retains fourteen days of database dumps and upload archives. Backup files are written through a private staging directory and published only after both archives and their checksums are complete. A separate Proxmox or NAS backup target is still required because backups on the LXC root filesystem do not protect against failure of the underlying storage pool.

The initial local backup and checksum verification completed successfully, and its PostgreSQL archive was restored into a temporary database and queried as the application role. Before launch, confirm that the LXC root volume is included in scheduled Proxmox backups and copy the portal backup directory to physically separate storage.

The deployed application health endpoint performs a PostgreSQL query through the same local socket used by page requests. nginx forwards /healthz to that check instead of reporting only that the proxy process is running.

Unresolved setup

• Register the GitHub App and its isolated webhook hostname.
• Select the physically separate backup destination and verify automated copies.