Hosts websites, DNS, mail, files and a machine’s own screen from owned hardware. One config file, one binary, no vendor.
- Implemented the protocols rather than depending on them: HTTP/1.1, the reverse proxy and load balancer, the DNS wire format, SMTP, IMAP, DKIM, RFC 6455 WebSockets, ACME (RFC 8555), WebDAV, and a bespoke remote-desktop protocol.
- 24 crates in five enforced dependency layers — a crate may never depend upward, checked mechanically on every change.
- 64 transitive third-party packages for the entire workspace; the dependency policy admits only an async runtime, a TLS implementation, and config serialisation.
- Capability-based permission model: a closed capability enum, a pure total policy function table-tested over every triple, and an append-only audit record.
- Runs in production on a self-updating box that rebuilds from every push to main.
The response, decoded
For the engineers: this is a response head from this site, annotated with the crate that produced each part. No nginx, no certbot, no Cloudflare — every hop below is code in the repository.
$ curl -svI https://rockywearsahat.com/ 2>&1
* Resolved rockywearsahat.com ← dns: authoritative answer, RFC 1035
* wire format + name compression written by hand
* Connected to 40.7608°N 111.8910°W ← proxy: owns the sockets, routes
* TCP accept on hardware I own the request to the right site
* TLS handshake, cert verified OK ← acme: the machine ordered its own
* issuer trusted, auto-renewed certificate (RFC 8555, http-01)
> HEAD / HTTP/1.1
< HTTP/1.1 200 OK ← http: HTTP/1.1 written from the
< content-type: text/html socket up — parsing, routing,
< content-length: … static file service
<
…and the mail for alex@rockywearsahat.com terminates in the same
workspace: smtp, imap, dkim — the same owner as every layer above.
The build you are reading was produced by npm run build and copied into
place by the platform itself; a push to main is the whole deploy.