The machine behind the page

One config, one binary.

The whole deployment is described in a single TOML file, and everything else is derived from it. This page is the static_root of one [[sites]] entry.

The path a request takes

browser ──TLS──▶ proxy (rustls, our routing)
                    ├─ static?   read file, honour Range & validators
                    ├─ app path? balance across healthy instances
                    └─ neither?  404 — never a guess

Cleartext HTTP answers only two ways: an ACME challenge, or a 308 redirect to HTTPS that preserves your path and query. Application instances are only ever reached over loopback or a private mesh — an app port is never exposed to the internet.

What is running beside it

A supervisor keeps services alive with restart backoff, captures their output into a ring, and kills whole process groups so nothing is orphaned.
A control API binds loopback only and authenticates with a bearer token checked in constant time. Remote control happens through an SSH tunnel the desktop console opens and repairs itself.
A Git watch polls a branch; when it moves the service is stopped, the working copy reset, the build step run, and the service started on the new commit. A failed build leaves it stopped rather than half-deployed.

The dependency policy

Everything on the wire is written in this repository. The exceptions are named and deliberate: rustls for cryptography, tokio for async I/O, serde + toml for the config, rcgen for self-signed certificates. No web server, no Docker, no database engine hiding in a container.