Newplatform-systemsGrafanaMeilisearchPortainerTraefik ProxyStatus Page

v1.0.0 - Platform Foundation: From Zero to Production on Hetzner Cloud

platform-systems-release-v1

After 229 commits, the Revenexx platform infrastructure is ready and daily in use. This release marks the completion of the first cycles. A fully automated, private-first, multi-stack platform built with Terraform + Ansible on Hetzner Cloud.

Everything you need to run, scale, and understand the platform is in this repo.

What's included

Compute & Orchestration

  • Docker Swarm — 3 managers + 6 workers with Traefik ingress and Portainer management, fronted by a public Hetzner Load Balancer
  • NFS Shared Storage — active/standby storage cluster with persistent volumes for Swarm workloads
  • Bastion Host — SSH jump host with NAT gateway, the only public entry point into private infrastructure

Databases

  • Postgres HA — 3-node Patroni cluster with etcd consensus, PgDog connection pooling (custom fork with wildcard DB support), private load balancer on port 5432, and Infisical-based secrets sync
  • MariaDB Galera — 3-node cluster with ProxySQL, automated S3 backups with encryption, user auto-sync, private load balancer on ports 3306/6032

Cache & Search

  • Dragonfly — Redis-compatible cache with master-replica replication, private load balancer on port 6379, multi-tenancy via namespaces
  • Meilisearch — full-text search engine with Caddy TLS, HTTP basic auth UI, and dedicated firewall hardening

Observability

  • Prometheus + Grafana — centralized monitoring with node, Postgres, MySQL, Redis, and ProxySQL exporters
  • Grafana OIDC via Zitadel PKCE, SMTP alerting via Resend, fail2ban hardening
  • Gatus Status Page — public health dashboard at status.rvnxx.com

Networking & Security

All stacks run on a shared private network (platform-network, 10.0.0.0/16) in Hetzner's Nuremberg region.

Subnet CIDR Purpose
Swarm / NFS 10.0.10.0/24 Container workloads and shared storage
Postgres 10.0.30.0/24 Patroni, etcd, PgDog
MariaDB 10.0.40.0/24 Galera + ProxySQL
Dragonfly 10.0.50.0/24 Cache cluster
Mail 10.0.70.0/24 Postal (external repo)

Security posture:

  • Databases, caches, and storage have zero public IPs — access only via private load balancers or bastion
  • 4 scoped firewalls (platform, container, monitoring, meilisearch)
  • Floating IPs for stable public endpoints
  • fail2ban, UFW, unattended upgrades, and systemd sandboxing on public-facing servers
  • No secrets in the repo — all managed via Infisical and GitHub Secrets

Related Repositories

The platform spans three repos on the same Hetzner account:

Repo Purpose Must-deploy order
secrets Infisical secrets management — base layer for everything 1st
platform-systems Core infrastructure (this repo) 2nd
mail Postal mail delivery — connects to MariaDB over the shared network 3rd

Automation

  • 18 GitHub Actions workflows — every stack has its own plan/apply pipeline, plus a full-sequence global apply
  • All applies run via CI — no manual console changes (no-click policy)
  • Terraform states separated per stack — safe, independent lifecycle for each component
  • Ansible inventories powered by the Hetzner Cloud plugin — dynamic, label-based, zero manual host management

Documentation

26 docs pages rendered via Backstage TechDocs, covering:

  • Architecture overview and network topology diagram
  • Operations workflows, GitHub Secrets reference, and CI/CD procedures
  • Stack-specific docs for every service (setup, configuration, access, troubleshooting)
  • Terraform module reference — every module and production environment with variables, outputs, and usage examples
  • Runbooks for on-call (Patroni recovery, Galera bootstrap, ProxySQL health, NAT debugging, and more)
  • Security posture and hardening documentation
  • Cross-repo guide explaining how the three infrastructure repos fit together

A new team member can understand the full platform from the docs alone.

Developer Portal

16 Backstage catalog entries registered — every infrastructure component is discoverable, from Hetzner Cloud baseline to individual services like etcd, PgDog, Traefik, and Grafana.

By the numbers
Commits 229
Terraform modules 9
Production environments 11
Ansible roles 41
CI/CD workflows 18
Backstage catalog entries 16
Documentation pages 26

What's next

  • Prometheus dashboards and alerting rules
  • Replace Gatus with an better solution and implement auto discovery for status monitoring
  • Harden the security and introduce an VPN