← all notes

This site is served by an HTTP server I wrote

What actually happens between your address bar and this paragraph, and why I own every step of it.

17 aug 2026 2 min rust · http · selfhost

When you requested this page, no nginx answered. No Cloudflare terminated your TLS session, no certbot renewed the certificate it ran over, and the DNS answer that got you here didn’t come from a registrar’s console — it came from a nameserver process I wrote, running on the same machine that is talking to you now.

That machine runs selfhost: 24 Rust crates that implement, rather than import, the protocols a small platform needs. The rule that shaped it is simple and a little unfashionable: if the protocol is the product, write the protocol.

The path of one request

Your resolver asked for rockywearsahat.com and the authority that answered is the dns crate speaking the wire format from RFC 1035 — name compression, the lot. The TCP connection landed on the proxy crate, which owns the sockets and does the routing that a reverse proxy usually does. TLS came next:

// the certificate this page arrived over was issued by this call —
// an ACME (RFC 8555) order placed by the machine, for the machine
let order = acme::Order::new(&account, &["rockywearsahat.com"])?;
let cert  = order.finalize(http01_responder).await?;
proxy.install(cert);   // no certbot, no cron, no vendor

Then an HTTP/1.1 200 from the http crate, carrying a page that was built statically and copied into place by the same platform. Five hops, five pieces of code, one owner.

Why bother

  • The layers stop being magic. Debugging a delivery problem when you wrote the SMTP implementation is reading your own logs, not guessing at someone else’s.
  • The dependency bill is visible. The whole workspace pulls 64 transitive packages. The policy admits an async runtime, a TLS implementation, and config serialisation — nothing else.
  • It is the résumé. Anyone can claim systems experience; this page is an existence proof that loads in under a second.

A claim that cannot be checked against a repository, a live URL, or a measurement does not ship. That rule built this site, and it wrote this post’s numbers too.

What it costs

Owning the stack means owning its outages. When the box loses power, the site is down and the fault is mine — there is no status page to point at. That trade is the point: the failure modes are all within reach of a debugger I can attach. The platform rebuilds itself from every push to main, and this article reached you through that exact path — drafted by an agent over MCP, validated against a schema, pushed, rebuilt, served.

← all notes rss