Autographs system overview
GitHub validates changes and deploys released Rust publisher images. Cloudflare handles authoritative DNS, HTTPS proxying, and caching of public media. OCI runs Caddy, the static public site, Rust publisher, Autonomous Database, private Object Storage media, and Vault secrets.
System diagram
16 numbered flows
Workflow step definitions
| Step | Workflow | Definition |
|---|---|---|
| Runtime and private OCI services | ||
| 1 | Run the free-tier VM | The runtime is one OCI Always Free VM.Standard.E2.1.Micro instance with 1 OCPU and 1 GB of memory. Podman quadlets define the containers, network, and volumes that systemd manages. |
| 2 | Manage the collection | The Rust publisher is the private admin service. It saves autograph metadata to Autonomous Database, uploads original item images to private Object Storage, applies image adjustments, and publishes static releases. |
| 3 | Use catalog metadata | The Rust publisher reads and writes autograph catalog metadata in Autonomous Database. |
| 4 | Store original images | The Rust publisher uses the VM instance principal to upload and read original images of autographed items in private OCI Object Storage. |
| 5 | Load runtime secrets | Using the VM instance principal, the Rust publisher reads three Vault secrets: the Autonomous Database password, the database wallet password, and the admin password hash. OCI automatically generates and regularly rotates the ADB password in coordination with the database. |
| 6 | Build and serve static releases | The Rust publisher generates and validates public-safe releases in the Podman volume. Caddy serves the active HTML, JSON, and image derivatives: web-ready copies of the original images, such as thumbnails and detail images. |
| 7 | Secure origin HTTPS | Caddy obtains and renews its origin certificate with Let's Encrypt. Cloudflare validates the origin with Full (strict) TLS. |
| Delivery and infrastructure | ||
| 8 | Validate changes | The admin updates the repository. Pull requests run static code analysis, tests, infrastructure validation, and workflow checks; Terraform plans share the state lock. |
| 9 | Gate the release | Ordinary merges collect in a release-please PR. Merging that PR starts the production CD pipeline. |
| 10 | Publish the runtime image | The CD pipeline builds and publishes the released Rust publisher image to GHCR; the runtime VM pulls that image. |
| 11 | Trigger deploy jobs | The CD pipeline starts deploy jobs after the release is accepted and the Rust publisher image is available. |
| 12 | Apply OCI infrastructure | Terraform applies the OCI resources required by the runtime and its private services. |
| 13 | Configure the runtime VM | Ansible configures the VM, installs the quadlets, and deploys the Caddy and Rust publisher runtime files. |
| 14 | Manage DNS and edge configuration | Terraform manages Cloudflare DNS records and edge rules. Porkbun delegates jetsaredim.net to Cloudflare nameservers. |
| Admin workflow | ||
| 15 | Manage content through the admin route | Admin HTTPS requests cross Cloudflare without caching. Caddy routes them to the Rust publisher, where the admin saves item edits, uploads or adjusts images, reviews pending changes, and publishes them. |
| Public browsing | ||
| 16 | Deliver the public site | Visitors reach Cloudflare over HTTPS, and its public route forwards requests to Caddy. Cloudflare caches versioned web-ready image copies while public HTML and JSON stay fresh. |