Skip to content

Networking

The VPS exposes only four ports publicly. Everything else is internal.

UFW firewall (OS level)

UFW is the source of truth for firewalling. The Hostinger hPanel firewall is not used (it shows 0 rules — intentionally).

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere                  
80/tcp                     ALLOW IN    Anywhere                  
443/tcp                    ALLOW IN    Anywhere                  
2222/tcp                   ALLOW IN    Anywhere                   # Forgejo SSH
25/tcp                     ALLOW IN    Anywhere                   # SMTP for brain mail-intake
11434/tcp                  ALLOW IN    172.18.0.0/16              # mac-ollama reverse tunnel
22/tcp (v6)                ALLOW IN    Anywhere (v6)             
80/tcp (v6)                ALLOW IN    Anywhere (v6)             
443/tcp (v6)               ALLOW IN    Anywhere (v6)             
2222/tcp (v6)              ALLOW IN    Anywhere (v6)              # Forgejo SSH
25/tcp (v6)                ALLOW IN    Anywhere (v6)              # SMTP for brain mail-intake

Any new public port requires: 1. ufw allow <port>/tcp comment "reason" 2. Documentation in this file (no exceptions) 3. An ADR if the reason is non-obvious

Domains and routing

Nginx at /opt/infrastructure/nginx/ is the only entrypoint on 80/443. All apps are reverse-proxied via nginx.

Domain Purpose Backend
joaoluisbrazao.com Tuga Car Nuts static site nginx serves /opt/downrabbithole/html/
joaoluisbrazao.cloud Admin Control Center admin-dashboard:80 (via nginx proxy)
admin.joaoluisbrazao.cloud Legacy admin (redirects to .cloud) redirect
brain.joaoluisbrazao.com JB Brain hub + Q&A + graph jb2b-api:8120
gamine.org Gamine public site gamine-web:8090
vault.joaoluisbrazao.cloud Vaultwarden vaultwarden:80
docs.joaoluisbrazao.cloud (planned) Documentation portal static MkDocs build

TLS

  • TLS 1.3 enforced — no fallback to 1.2 except where legacy clients demand it (none currently)
  • Certificates via Let's Encrypt + certbot running in infra-certbot container
  • Renewal cron runs daily inside the container
  • All certs expire 2026-06-28 (renewal will happen ~60 days before)

VPN / private overlay

  • Headscale runs on the VPS (port 3478 UDP + internal API)
  • Tailscale clients (Mac, iPhone) connect to it
  • Intel Mac home server is on the Tailscale net (10.74.1.47) — used for podcast Whisper transcription and Ollama-replacement workloads

DNS

  • DNS records are managed at the registrar (not Hostinger) — see Vaultwarden for credentials
  • All A records point to 76.13.44.83 for the JB-controlled domains
  • No CDN in front — for two reasons: sovereignty, and the audience is small enough that direct hits work fine