Jimi Leander
• 8 min read • Production

Project Smörgåsbord: Two-Tier Sovereign Cloud & Zero-Trust Mesh

Multi-node Proxmox, NixOS, and Docker infrastructure connected via an encrypted WireGuard edge relay, Zitadel OIDC identity plane, GitLab CE 19.5, Stalwart Mail + DMARC telemetry, Stoat Chat, and a zero-JS Obsidian-to-Zola publishing engine.

#Infrastructure #WireGuard #Zitadel #Cloudflare #GitLab #Mail
GitLab Repository ↗

Overview

Project Smörgåsbord is the sovereign, self-hosted infrastructure platform powering leander.media—combining local Proxmox virtualization and high-capacity storage with stateless Cloudflare Zero Trust tunnels and a Nordic WireGuard edge relay.

LEANDER.MEDIA // SOVEREIGN CLOUD & ZERO-JS PUBLISHING ARCHITECTURE VECTOR SVG // 0 KB JS 1. AUTHORING & LOCAL WORKFLOW • Obsidian Mobile & Desktop Vaults • Encrypted Peer-to-Peer Syncthing • Camera Photos, Video & Audio Clips • Versioned via Obsidian Git to GitLab CE • Zero Browser CMS Attack Surface 2. SOVEREIGN COMPUTE & STORAGE CORE • Obsidian-to-Zola Media Preprocessor • Automated EXIF & GPS Metadata Scrubber • GitLab CE 19.5 (PostgreSQL 17) + CI/CD • Stalwart Mail + DMARC Telemetry Exporter • Stoat Chat Backend + Zitadel OIDC Bridge 3. ZERO-TRUST EDGE & RELAY TIER • Zola SSG (<50ms Build, 0 KB Client JS) • Strict CSP: script-src 'none' on Static • Dedicated Cloudflare Zero Trust Tunnels • Nordic WireGuard WebRTC & SMTP Relay • Outbound TLS Mail Deliverability Relay PUBLIC SOVEREIGN SERVICES (leander.media) • blog.leander.media & www.leander.media — Zero-JS Portfolio & Blog • chat.leander.media — Stoat Real-Time Messaging, Voice & Video • gitlab.leander.media — Self-Hosted GitLab CE 19.5 Code Forge • mail.leander.media & info.leander.media — Mail & Bilingual Legal Hub IDENTITY, OBSERVABILITY & R&D PIPELINES • auth.leander.media — Zitadel OIDC PKCE Single Sign-On & Passkeys • VictoriaMetrics + Loki + Grafana DMARC Security Dashboards • Autonomous KiCad ERC/DRC & 3D CAD Hardware Workbench • RekordRescue & Real-Time REAPER JSFX Audio DSP Tooling
Project Smörgåsbord Two-Tier Sovereign Cloud Topology (Vector SVG)

Key Subsystems

1. Split-Horizon WireGuard Edge & Zero-Trust Ingress

  • HTTP/HTTPS workloads are isolated per stack behind dedicated Cloudflare Zero Trust Tunnels (leander.media, blog.leander.media, chat.leander.media, info.leander.media, mail.leander.media, biohacking.leander.media, djtools.leander.media, gitlab.leander.media, registry.leander.media).
  • Latency-sensitive UDP WebRTC voice/video streams (chat.leander.media, turn.leander.media), Matrix S2S federation (matrix.leander.media), Git SSH (ssh.gitlab.leander.media), dedicated game servers (mc, swamp, ftb, vh.leander.media), and inbound/outbound SMTP/IMAPS mail connections traverse dedicated kernel WireGuard tunnels to Nordic cloud edge relays in Helsinki (hel1.leander.media) and Stockholm (mx.leander.media), keeping the home origin network completely unexposed (0 residential WAN IP records in public DNS).

2. Self-Hosted GitLab CE 19.5 (gitlab.leander.media, ssh.gitlab.leander.media & registry.leander.media)

  • Self-hosted GitLab Community Edition 19.5 and GitLab Container Registry (registry.leander.media) hosting public open-source mirrors/releases, OCI container images, and private engineering repositories behind a dedicated Cloudflare HTTP/2 Tunnel and a 2 ms Helsinki WireGuard SSH relay (ssh.gitlab.leander.media).
  • Powers automated CI/CD verification for hardware EDA designs, container builds, and versioned backups of our Obsidian knowledge base.

3. Sovereign Mail (mail.leander.media) & DMARC Security Pipeline

  • Stalwart Mail Server + SnappyMail Webmail configured with dual RSA-2048 & Ed25519 DKIM signing, strict SPF, and DMARC enforcement, paired with an authenticated European outbound TLS relay.
  • Custom DMARC Prometheus Exporter parses aggregate XML/ZIP reports in real time and feeds VictoriaMetrics and Grafana security dashboards.

4. Zitadel OIDC Identity (auth.leander.media) & Bilingual Info Hub (info.leander.media)

  • Centralized Zitadel OIDC identity provider supporting Passkeys/WebAuthn and OAuth 2.0 PKCE across internal and external portals.
  • Standalone bilingual (FI / EN) compliance portal at info.leander.media (public source repo) serving GDPR privacy documentation, Terms of Service, EULA, and open-source attributions.

5. Zero-JS Obsidian-to-Zola Publishing Engine

  • Real-time Syncthing replication from desktop and mobile Obsidian vaults directly to our build pipeline.
  • Automated exiftool + Pillow preprocessor strips EXIF/GPS metadata from camera photos, converts Obsidian callouts and wikilinks, and triggers sub-50ms Zola static builds with 0 KB of client-side JavaScript.
# Compile-time syntax highlighting & zero client-side JavaScript
base_url = "https://blog.leander.media"
compile_sass = false
generate_feeds = true
feed_filenames = ["atom.xml", "rss.xml"]

[markdown]
highlight_code = true
highlight_theme = "ayu-dark"