The engineering
behind the experience.
Leading datacenter operations taught me to connect architecture to the people who maintain it. Here, I own that whole lifecycle: application delivery, access control, change management and recovery—with open-source technology chosen against real requirements.
Explore the architectureFollow what moves.
See what stays local.
Trace a request, inspect an access boundary, or explore a planned failure scenario. Each component reveals the decision behind it.
Public delivery. Local processing.
Follow a request from the browser to the application. Select a component to look inside.
The visitor requests the website or editor. Once the editor’s assets load, Go WASM processes checklist contents on the visitor’s device; CKL / CKLB exports download locally.
Site TLS terminates here, then traffic reaches the website over the container network. GitLab uses a separate TLS passthrough route. Public delivery and private administration have different access paths.
The platform delivers the website and browser editor assets. Desktop tools run on the user’s machine. Browser autosave is best-effort; downloaded checklist backups remain important.
Where is the trust boundary?
Checklist contents stay in the visitor’s browser. Administration follows a separate path: authorized device → Tailscale private network → SSH / Git administration and OpenBao access. Network access and service authorization are separate controls.
Identity first. Credentials at runtime.
A scoped application identity retrieves the credential without putting it in the image.
A host synchronization service authenticates to OpenBao using the application’s AppRole. The bootstrap credential has its own lifecycle; a short-lived token does not automatically rotate it.
A scoped token reads the application’s permitted secret. Bao GUI provides a separate human interface to OpenBao; application identity and administrator access remain distinct.
The host service writes a restricted runtime file under /run. Its environment is injected when the container is created. Rotate by syncing and recreating; privileged host administrators can inspect that environment.
A deliberate change. A way back.
Review, validate and verify. Select a stage to see its operating responsibility.
Keep the change small and inspect its scope. Repository access uses per-agent, per-project deploy keys. This release procedure does not imply an enforced CI pipeline in every repository.
Run automated tests and the build, then check HTTP routes on the candidate image. Preserve a known rollback image before a targeted deployment.
Recreate the intended service and check its behavior. Restore the previous image if needed. Image rollback does not restore stateful data; that requires a separate recovery procedure.
Design for the next request.
Load balancing and redundancy are the next phase. Switch scenarios to see how the intended traffic path changes.
Illustrated target: both application replicas are eligible for new requests.
Load balancing must account for ingress continuity as well as application health. Proxy products, redundant ingress design and failure-domain placement are still design decisions.
Health-aware routing distributes new requests across eligible application instances. The drawing shows the intended behavior, not a live health reading.
A second logical application instance provides another eligible destination. Two symbols explain the design; they do not commit to a replica count or physical placement.
Replicas must share spending and concurrency controls. Duplicating the website’s local budget store would weaken those limits. Data, secrets and source hosting each need their own replication and recovery strategy.
Illustrated target: stop sending new requests to A while existing work finishes.
Load balancing must account for ingress continuity as well as application health. Proxy products, redundant ingress design and failure-domain placement are still design decisions.
Withdraw A from new traffic, allow in-flight work to finish, then maintain it. Drain timeouts, available capacity and re-entry health checks still need validation.
The remaining instance would receive new requests. It needs enough capacity to serve the workload during maintenance or failure; that headroom must be demonstrated.
Replicas must share spending and concurrency controls. Duplicating the website’s local budget store would weaken those limits. Data, secrets and source hosting each need their own replication and recovery strategy.
Illustrated target: remove A from new traffic after health checks detect a failure.
Load balancing must account for ingress continuity as well as application health. Proxy products, redundant ingress design and failure-domain placement are still design decisions.
After detection, route new requests to the remaining healthy instance. In-flight requests may fail; retry safety, detection time and spare capacity must be tested.
The remaining instance would receive new requests. It needs enough capacity to serve the workload during maintenance or failure; that headroom must be demonstrated.
Replicas must share spending and concurrency controls. Duplicating the website’s local budget store would weaken those limits. Data, secrets and source hosting each need their own replication and recovery strategy.
What makes this resilient beyond the diagram?
Test health detection, draining, retries, capacity and redundant ingress. A failed Docker health check alone does not remove nginx traffic.
Choose consistency and replication per service. Coordinate usage limits across replicas; keep backups separate from replication.
Exercise failover and restoration. Measure recovery time and data loss before making availability commitments.
Bao GUI connects directly to OpenBao. The checklist editor runs in the browser after its assets load. netstig produces compliance artifacts; Spotter focuses on the operator’s terminal experience. Together they connect assessment, human judgment and controlled operation. The platform supplies the supporting services; each application keeps its own responsibilities.
Confidentiality.
Integrity. Availability.
Each principle should be visible in a configuration, a workflow or a recovery behavior. Here are concrete examples from this environment.
Give a process
the access it needs.
The site’s optional chat feature gets its provider credential through a dedicated OpenBao AppRole. A scoped token reads the required secret; a host service writes the runtime environment file used when the container is created.
The human interface: Bao GUI ↗path "secret/data/apps/example" {
capabilities = ["read"]
}- Credential delivery
- The key is supplied at runtime, rather than committed to source or baked into an image.
- Separate lifetimes
- A short-lived OpenBao token does not automatically rotate the bootstrap credential or provider key.
- Administrative boundary
- Privileged host administrators can inspect container environments. The runtime file is not protection from a compromised host administrator.
Constrain runtime.
Make changes inspectable.
The site and edge proxy run with restricted privileges. Deployment configuration lives alongside the code; the release procedure includes tests, candidate checks and an image to roll back to.
For compliance tooling, integrity also means preserving rule IDs, findings and target metadata through parsing and export. Tests support those behaviors; they do not certify the underlying finding.
user: "10001:10001"
read_only: true
cap_drop:
- ALL
security_opt:
- no-new-privileges:true- Writable by exception
- Temporary caches and the persistent chat-budget store have explicit writable locations.
- Scoped source access
- Per-agent, per-project deploy keys limit repository access. Reviews and checks remain explicit release responsibilities.
- Evidence fidelity
- netstig has CKL fidelity tests. The editor has documented synthetic round trips through DISA STIG Viewer; its editable review history is not an immutable audit log.
Keep the service useful.
Design the path back.
Service continuity starts with predictable behavior: process restarts, health visibility, certificate renewal, backups and a release procedure with a way back. The next phase is load balancing and redundancy, so maintenance and component failures can be handled with less disruption.
Load balancing and redundant service capacity are planned, not yet deployed. Explore healthy traffic, maintenance and an unavailable replica in the architecture walkthrough.
Explore the resilience design ↑The restart policy can restart the container. A failed health check alone does not trigger a restart or remove nginx traffic.
Validate before a graceful reload. Application recreation is a separate operation and can interrupt service.
A clean site start can proceed without chat credentials; chat reports unavailability. An existing process may still hold its injected key.
Budget and concurrency checks stop further provider calls while the rest of the portfolio remains usable.
Use the service-specific backup and restore procedure. Restore exercises establish recoverability and measured recovery objectives.
Why these technologies?
Start with the requirement, then consider capability, cost and the responsibility that comes with the choice. Expand a decision to see the tradeoff.
01Rocky LinuxThe operating-system foundation+
I chose Rocky Linux in place of Windows Server or a Red Hat Enterprise Linux subscription for this deployment. It supports the Linux workloads I need without adding that commercial OS cost.
The choice fits these workloads; it does not imply identical application compatibility or vendor support. Administration and maintenance remain my responsibility.
02OpenBaoCentral secrets, explicit application access+
The same cost-conscious approach applies to secrets management. OpenBao provides the service used by Bao GUI and the AppRole-based delivery used by this website.
I own bootstrap access, credential rotation and recovery. A managed service becomes worth reconsidering when its availability or support meets a requirement I cannot economically operate myself.
03GitLab CEPrivate source and development workflows+
GitLab CE brings private repositories, history and runner infrastructure into an environment I control. The community edition supplies the capabilities I use without a paid development-platform subscription.
Upgrades, capacity and backups are part of the operating cost. Pipeline enforcement must be checked per repository; hosting a runner alone does not make every change gated.
04Docker ComposeRepeatable service definitions+
Compose makes service dependencies, runtime permissions, networks and storage inspectable in source control. Targeted deployments keep unrelated services outside the change scope.
Load balancing and redundancy are planned. Their implementation will need explicit traffic-health rules, state handling and failover validation alongside these service definitions.
05nginx + TLSA clear public entry point+
nginx handles ingress and TLS routing. Configuration validation and graceful reloads make proxy changes inspectable; certificate renewal is scheduled.
The current GitLab TLS passthrough arrangement does not preserve the original client address at that backend. Proxy configuration and certificates still need maintenance.
06Browser-local Go WASMKeep checklist processing with the user+
The editor reuses Go parsing and validation in the browser. Static hosting delivers the application without requiring a server-side checklist database.
Browser storage can be evicted, and file APIs vary. Downloaded backups matter. Shared review or collaboration would introduce different storage and identity requirements.
Spend deliberately.
Keep the capabilities.
I use Rocky Linux in place of Windows Server or a RHEL subscription for this platform. The same logic guides OpenBao and GitLab CE: meet the requirements while avoiding unnecessary recurring licensing and subscription costs. It is the same discipline I brought to microsegmentation savings and AWS Outpost cost reduction in my professional work.
Source. Secrets. Delivery.
Private repository history, scoped application access, versioned secrets, TLS serving and repeatable deployment configuration. Quality is demonstrated through the controls and their validation.
Patch. Monitor. Recover.
Hosting, backup storage and maintenance still cost time and money. The tradeoff is ownership of the operating work, assessed against the capabilities this environment needs.
The platform savings are qualitative; the quantified career results are documented in my resume. RHEL is also open source—the OS cost comparison concerns its commercial subscription. Support, feature requirements and maintenance effort remain part of the decision.
Sources & scope of the case study
Based on deployment configuration, runbooks and read-only infrastructure checks on 18 October 2026. OpenBao snapshot and GitLab backup jobs reported success at that check. Restore testing and measured recovery objectives are separate verification steps. The resilience view illustrates planned work, not deployed high availability.
GitLab CE licensing ↗ · OpenBao project ↗ · nginx license ↗
Tailscale documents both open-source components and a closed-source coordination service. It is part of the access architecture, not evidence that the whole stack is open source.