Unreleased Hybrid Deployment Prototype
Implemented an unreleased static-site deployment prototype across a Public Edge VPS and an On-site Server, with private Tailscale transport, containerized services and a repeatable delivery workflow.
Case Snapshot
Role
Platform ownership: frontend implementation, deployment workflow, content structure, CI validation, and production release path.
Scope
The delivery workflow validates linting, type checks and the static Next.js build before synchronizing the export through the Public Edge VPS to the On-site Server over Tailscale. Docker Compose and Nginx Proxy Manager provide...
Constraints
The prototype applies defense in depth: the private runtime is reached over Tailscale rather than through direct router exposure, ingress and administration are separated, and baseline web security headers are configured at the...
Result
Implemented a repeatable hybrid deployment prototype without presenting Elkaza.at as a released public site
Architecture
Node
The intended request path begins at the Public Edge VPS and forwards approved application traffic over Tailscale to the private runtime.
Edge
The On-site Server hosts the private runtime layer with Docker Compose, Nginx Proxy Manager, static web services, observability and backup components.
Cloud
The Public Edge VPS remains deliberately thin and acts as the deployment relay and intended TCP ingress layer rather than storing primary application data.
Node
The intended request path begins at the Public Edge VPS and forwards approved application traffic over Tailscale to the private runtime.
Edge
The On-site Server hosts the private runtime layer with Docker Compose, Nginx Proxy Manager, static web services, observability and backup components.
Cloud
The Public Edge VPS remains deliberately thin and acts as the deployment relay and intended TCP ingress layer rather than storing primary application data.
Architecture Views
Concise system views summarize the project boundary, deployment path, and data flow without adding implementation claims.
System overview diagram
Node
Deployment diagram
Edge
Data flow diagram
Cloud
Technical Decisions
- Public Edge VPS as a thin deployment relay and intended TCP ingress layer
- Private Tailscale transport to the On-site Server runtime
- Dockerized static Next.js export behind Nginx Proxy Manager
- Automated lint, typecheck, build, synchronization and smoke-check workflow
Challenges
- A simple static VPS workflow did not exercise the desired separation between delivery automation, edge ingress and a private runtime. The prototype therefore needed repeatable validation...
- The prototype applies defense in depth: the private runtime is reached over Tailscale rather than through direct router exposure, ingress and administration are separated, and baseline web...
- Automated builds, scripted synchronization, bounded smoke checks and service separation reduce manual delivery risk. Backup integrity and isolated recovery evidence belong to the...
Lessons Learned
- Implemented a repeatable hybrid deployment prototype without presenting Elkaza.at as a released public site
- Kept the private runtime behind Tailscale instead of direct router ingress
- Validated lint, typecheck, build, synchronization and smoke-check stages
Future Improvements
- Keep architecture views aligned with the implementation.
- Keep documentation concise: align README, architecture decisions, and screenshots.
Tech Stack
Artifacts
Related Project
Follow the adjacent case study to see how this project connects with the rest of the work.
Engineering Portfolio Platform
Built a multilingual portfolio platform with structured content, CI-enabled deployment, and maintainable publishing workflows.