My personal infrastructure
A VPS that works at night, a personal hub that opens no port, and sites that publish themselves.
- Linux
- systemd
- cron
- Bash
- Node.js
- Cloudflare Tunnel
- Vercel Edge
- Cloudflare Pages
- wrangler
Context
I run several projects at once: GaijinToSensei, two Overwolf apps and their sites. I need work to move forward when I am not at the screen.
Problem
Run agents and jobs unattended, without giving them full rights, without exposing my machine and without paying to host the sites.
What I did
A VPS that works at night
- The night agents run as a systemd service, under a dedicated user without root rights.
- A lock makes sure only one runner works at a time. It resumes on its own after a usage limit, and sets the work aside if it gets stuck.
- The few actions that need root go through a closed-list executor: it only runs commands defined in advance.
- The runner has its own tests.
Scheduled jobs
- 25 scheduled jobs, 14 of them without any AI: the GaijinToSensei production guard every 10 minutes, publishing the MetaDBD site every 15 minutes, watching a Discord bot every 2 minutes, sending new pages to search engines (IndexNow) and alerts.
A personal hub with no open port
- The hub runs on my PC. It goes out through a Cloudflare tunnel: no inbound port is open.
- In front of it, an edge proxy on Vercel handles authentication: hashed password (PBKDF2), constant-time comparison, signed cookie (HMAC), brute-force delay, HSTS and anti-framing headers, noindex.
- The tunnel address is read from an edge configuration store. When the tunnel changes, nothing needs to be redeployed. If it is down, the proxy returns a clean 503.
Sites that publish themselves
- 5 static sites on Cloudflare Pages. metaaoe.app publishes on every push through the Git integration. The others are published from the VPS with wrangler, by a scheduled job or a script.
Result
- Work moves forward every night. The sites update without me.
- No port of my PC is exposed to the Internet. Hosting the sites costs nothing.
What I learned
- Give each program the least rights it needs: a dedicated user and a closed list beat a general sudo.
- One lock per job prevents most bugs from overlapping scheduled jobs.
- A scheduled job should stay quiet when all is well and send a single alert when it breaks.