Architecture

​

System diagram

​

Request flow: web page

​

User session lifecycle

​

Infrastructure

​

Terraform

just tf-init    # initialize backend and download providers
just tf-plan    # preview changes before applying
just tf-apply   # provision or update staging infrastructure

• Hetzner Cloud VPS for staging
• Cloudflare DNS records (atl.sh, staging.atl.sh, and subdomains)

​

Ansible Structure

ansible/
├── site.yml                   # main playbook
├── inventory/
│   ├── hosts.yml              # dev / staging / prod host groups
│   └── group_vars/
│       └── all/
│           ├── main.yml       # shared variables
│           └── vault.yml      # encrypted secrets (Ansible Vault)
├── playbooks/
│   ├── create-user.yml        # onboard a new pubnix user
│   └── remove-user.yml        # offboard a user
└── roles/
    ├── common/                # apt cache, base packages, NTP, journald
    ├── packages/              # shells, languages, editors, CLI tools, games
    ├── security/              # hardening, SSH, firewall, fail2ban, auditd, AIDE
    ├── users/                 # skel, MOTD, PAM limits, social commands
    ├── environment/           # cgroup limits, quotas, private /tmp, PATH
    ├── services/              # nginx, Gemini, Gopher, finger, dictd, games, webring
    ├── ftp/                   # vsftpd (FTP/S)
    ├── monitoring/            # Prometheus node exporter, smartd, lm-sensors
    └── backup/                # Borgmatic (BorgBackup)

​

Role: packages

• Shells: bash, zsh, fish, mksh, tcsh, ksh93, rc, elvish, nushell, dash
• Nushell installed via Gemfury apt repository (not in Debian repos)
• Editors: vim, neovim, nano, emacs, micro, joe, vis, kakoune
• File managers: ranger, lf, mc, nnn, vifm
• Languages: Python, Node.js, Go, Rust, Ruby, C/C++, Haskell, Elixir, Java, and 20+ more
• CLI tools: ripgrep, fzf, jq, pandoc, miller, taskwarrior, newsboat, sc-im, duf, and many more
• Networking: gping, trippy, xh, drill, prettyping, fping, sipcalc, termshark, speedtest-cli, rclone
• Chat: irssi, weechat, profanity, talk, talkd (with openbsd-inetd)
• Mail: alpine, neomutt, aerc
• Browsers: lynx, w3m, elinks, links, amfora
• Games: nethack, crawl, angband, bsdgames, botany, arcade games
• Fun: fortune, cowsay, figlet, cmatrix, cbonsai, boxes, asciinema, nyancat
• /etc/shells registration for all available login shells

​

Role: security

• CIS kernel parameter hardening via sysctl (ASLR, ptrace restrictions, network protections)
• Kernel module blacklisting (uncommon filesystems, protocols)
• Password and sudo policy
• SSH configuration (key-only auth, ports 22 + 2222, AllowGroups)
• UFW firewall (allowlist — only required ports open)
• Fail2ban (5 failures in 10 minutes → 1-hour ban)
• Auditd with 40+ rules (identity files, privilege escalation, LOLBins, MITRE ATT&CK-tagged syscall rules)
• journald hardening (1 GB cap)
• AIDE file integrity monitoring (daily check at 05:00 UTC)
• Automatic security updates via unattended-upgrades
• Malware scanning (rkhunter, chkrootkit, lynis)

​

Role: users

• /etc/skel/ — scaffold copied to every new user’s home on account creation
• MOTD — welcome message shown on SSH login
• PAM resource limits — per-user caps enforced via /etc/security/limits.conf
• Social commands: menu, plan, lastplan, online, community
• Private /tmp via pam_namespace polyinstantiation
• Per-user logrotate cron job

​

Role: environment

• Cgroup v2 user slices — systemd enforces 1.5 GB RAM, 200% CPU, 200 process limits per user session
• Disk quotas — 5 GB soft / 6 GB hard per user (XFS or ext4 quota)
• Private /tmp — pam_namespace polyinstantiation gives each session an isolated tmpdir
• XDG directories — XDG_CONFIG_HOME, XDG_CACHE_HOME, XDG_DATA_HOME, XDG_STATE_HOME all set via /etc/profile.d/
• PATH additions — ~/.local/bin, ~/.cargo/bin, ~/.go/bin, ~/.local/share/gem/bin, ~/.deno/bin, and others added at login

​

Role: services

​

Network

​

Open Ports

​

Internal Services

​

Tilde Web Architecture

nginx (443)
  └── location ~ ^/~([^/]+)
        root /home/$1/public_html
        fcgiwrap for *.cgi, *.pl, *.py scripts
        sub_filter </body> → webring widget injection

• go.cgi — Python CGI for next/prev/random navigation
• members.json — generated every 15 minutes by a cron job scanning ~/.ring files
• widget.js — auto-injected into all tilde pages via nginx sub_filter

​

Environments