Designing a Two-Tier Sovereign Cloud, Mail & Zero-JS Publishing Platform

Modern self-hosted infrastructure often falls into one of two traps: either exposing heavy management planes directly to the public internet, or locking everything behind a VPN so tightly that collaborating and sharing public work becomes a chore.

In Project Smörgåsbord, we solved this by splitting our infrastructure into a Zero-Trust Public Edge Tier and an Encrypted Compute & Storage Core, paired with a zero-JavaScript static publishing pipeline driven directly from Obsidian.

1. Two-Tier Split-Horizon Architecture

Rather than treating every workload the same, we enforce a strict boundary between public edge ingress and local stateful storage:

1. Zero-Trust Public Edge (Cloudflare Tunnels + Dual Nordic WireGuard Relays):

   • HTTP/HTTPS services—including this blog (blog.leander.media / leander.media), our real-time communication suite (Stoat Chat (chat.leander.media)), our bilingual compliance portal (info.leander.media), webmail (mail.leander.media), and GitLab HTTPS/Registry (gitlab.leander.media / registry.leander.media)—are routed through isolated container networks and dedicated Cloudflare Zero Trust HTTP/2 Tunnels.
   • Latency-sensitive UDP WebRTC voice/video media, Matrix federation (matrix.leander.media / turn.leander.media), Git SSH (ssh.gitlab.leander.media), multiplayer game traffic (mc, swamp, ftb, vh.leander.media), and inbound/outbound mail protocols traverse dedicated Nordic cloud relays in Helsinki (hel1.leander.media) and Stockholm (mx.leander.media) over kernel WireGuard, keeping origin hardware completely unexposed to public port scanners.
   • Static properties are compiled ahead-of-time into pure HTML5 and CSS with fluid responsive typography (clamp(96%, 46% + 0.45vw, 126%)) and 0 KB of third-party JavaScript.

2. Sovereign Compute & Storage Core:

   • All stateful databases, Git repositories, object stores, Syncthing vaults, hardware EDA verification runners (see Automated Hardware & KiCad EDA Verification Pipeline), and audio DSP workstations (see RekordRescue & Real-Time Audio/DSP Tooling) run on local hardware under our physical control.

2. Core Platform Pillars (leander.media)

A. Self-Hosted GitLab CE 19.5 (gitlab.leander.media)

Our self-hosted code forge runs GitLab Community Edition 19.5 backed by PostgreSQL 17. It hosts:

• Public Open-Source Mirrors & Releases: Including the complete client/server mirrors and pre-configured binary builds for Stoat Chat (gitlab.leander.media/services/chat) and the source code for our Legal & Info Hub (gitlab.leander.media/services/info-portal).
• Private Infrastructure & R&D Repositories: Versioned Docker Compose stacks, autonomous KiCad ERC/DRC hardware verification pipelines, and automated backups of the Obsidian knowledge vault itself.

B. Sovereign Mail (mail.leander.media) & Real-Time DMARC Telemetry

Running a reliable self-hosted mail stack requires careful attention to IP reputation and cryptographic authentication:

• Stalwart Mail Server + SnappyMail: Handles IMAP4/SMTP with dual 2048-bit RSA and Ed25519 DKIM signing, strict SPF, and DMARC policy enforcement, paired with a clean webmail interface at mail.leander.media where role addresses (admin@, contact@, abuse@, dmarc@) automatically sync into dedicated folders and Send-As identities.
• Authenticated Outbound TLS Relay: Outbound external delivery routes through an authenticated European SMTP TLS relay so residential or cloud subnet blocks never impact deliverability.
• Automated DMARC-to-Grafana Pipeline: A custom Python telemetry daemon parses incoming XML/ZIP aggregate DMARC reports (rua) in real time and exports Prometheus metrics (dmarc_messages_total, dmarc_dkim_pass_total, dmarc_spf_pass_total) into VictoriaMetrics and Grafana.

C. Centralized Identity (auth.leander.media) & Bilingual Legal Hub (info.leander.media)

• Zitadel OIDC Single Sign-On: Provides passwordless WebAuthn/Passkey and OAuth 2.0 PKCE authentication across internal and public services.
• Bilingual (FI / EN) Compliance Portal: info.leander.media serves our GDPR Privacy Policy, Terms of Service, EULA, Open-Source Licensing attributions, and EU Digital Services Act (DSA) contact points with automatic Finnish/English browser language detection.

3. Automatic EXIF Scrubbing & Media Optimization

When blogging from a phone in the workshop—taking photos of a custom PCB or a 16kW mountainboard battery spine—raw camera JPEGs contain sensitive EXIF metadata including GPS coordinates and device serial numbers.

Our watcher daemon intercepts every ![[photo.jpg|Caption]] embed and runs exiftool -all= plus responsive WebP generation before Zola builds the static site:

def scrub_and_optimize_image(src_path: Path, dst_clean: Path, dst_webp: Path) -> None:
    """Strip all EXIF metadata (GPS, serials) and generate a responsive 1600px WebP."""
    with Image.open(src_path) as img:
        img_rgb = ImageOps.exif_transpose(img)
        # Creating a fresh Image copy without passing info/exif strips all EXIF tags
        clean = Image.new(img_rgb.mode, img_rgb.size)
        clean.putdata(list(img_rgb.getdata()))
        clean.save(dst_clean, optimize=True)

        # Generate fast-loading WebP (max 1600px width)
        clean.thumbnail((1600, 1600), Image.Resampling.LANCZOS)
        clean.save(dst_webp, format="WEBP", quality=85, method=6)

4. What’s Next

Check out our companion guide—Stoat Chat on Leander.Media: Sovereign Real-Time Messaging, Voice & How to Get Started—to hop onto our chat and voice platform, or subscribe via the RSS feed / Atom feed for upcoming deep dives into our autonomous KiCad EDA verification pipeline and real-time audio DSP tooling.