Hey all! You asked for it, so here it is. I’ma drop a diagram here and will refer to it throughout the rest of this post:

Our infrastructure

In simple terms, the way it all works is we have our protected servers in the backend.

PERSISTENCE

We run our postgres database defensively with 3 dedicated (metal) servers, the main servers each have 2× 1.92TB enterprise-grade NVMe drives mirrored (RAID-1).

We use patroni + percona postgres to manage the cluster. Each instance has a software watchdog to trip-wire a failure.

Scripts automate promotion to make sure under normal circumstances (healthy cluster) that the main server, our big EPYC 7401P 128GiB DDR4(ECC) i350 NIC is the primary.

We have a second server which is a less-powerful i9-12900K 128Gib DDR4(non-ECC) i219v NIC that acts as a read-only secondary, and gets promoted to primary on failover.

Then there’s the little server that replicates for backups and potential dual-failure disaster scenarios, a meager Ryzen 7 3700X 64GiB DDR4(ECC) i210 NIC and it has 2× 8TB enterprise-grade spinny disks striped (RAID-0), to keep the DB and backups safe.

It will become primary if the other 2 servers cannot.

The database servers are not connected to directly by any of our services, there’s instead a load balancer in front which targets the 3× server’s HAProxy instances that have one port directed at the current primary and another port for the current secondary.

This database infrastructure is the biggest, costliest and most engineered part of our setup (which is very frugal for what it is). It’s taken me through a near catastrauphic situation (double server failure). You can ask Ada… I was freaking the fuck out.

Additionally we have a single Redis instance which runs on a quad CPU ARM (Ampere) 8GiB RAM 80GB SSD.

• Primary server: €83.70/m
• Secondary server: €61.70/m
• Backup server: €40.70/m
• Load balancer: €5.39/m
• Redis: €6.49/m
• Total: €197.98/m (AUD ~$350) for the persistence layer.

APPLICATION

We then have a prometheus/grafana monitoring box at another €6.49/m.

Then we have the services which run just like everyone else on various pieces of hardware, in docker containers for most, but some run standalone on their own hosts. Sharkey €24.49, Lemmy €12.49/m, Synapse €12.49/m, everything else smaller (pyfedi, pixelfed, friendica, photon frontend, various different static frontends, Ada’s latest project of the week) runs on a single dedicated docker host costing €38.70/m.

That brings us to another €101.15/m for the application layer.

EDGE

Then under that we now have the edge nodes, which are completely standalone and do not have internal VPCs etc, it’s TLS in, TLS out for these machines.

Each node is generally around 2× vCPU 1GB RAM 25GB SSD 2TB bandwidth for around €6/m. We have 4, so that’s around €24/m all up.

End user flow

So when you vist the site, you will first typically hit our DNS server. Our DNS server uses the requesting IP, or EDNS client subnet provided to work out which healthy node is closest to your region, and gives you back that IP address.

Side note: It’s important to realise that up until this point, what domain you requested is known to yourself and the DNS provider you used. If you care about privacy, you should install a pihole (you can install it in a docker container, you don’t need a raspberry pi), and set it’s upstream DNS to Quad9 with ECS and DNSSEC enabled (or if you’re really adventurous, install your own unbound server and bypass intermediaries completely).

We run a dual-stack IPv4/IPv6 network all the way through so if you’re on IPv6, you’ll get our v6 IPs, and hopefully enjoy a less NATted, wider MTU’d, packet un-fragmented journey through the internet.

Once you have the IP address from the DNS server, you will connect to the caching caddy server on the closest healthy node to your geographical location and it will terminate your TLS session, decrypting your request.

At this point we’ll see if we have the asset to the request you made cached locally, if so we can send it straight back to you, super quickly!

If not then it will connect to the upstream server in our core location over a (presumably) much larger, less latent and more resilient trunk pipe than most consumer-grade bandwidth will provide. (Unless you run your own redundant-path dark fibre into your house, which I’m not discounting entirely… I know people.)

The returned response will then be evaluated for cacheability and sent back to you.

The build

We wanted to make sure that if one of these endpoints degrade / get attacked / shut down / die, that we can spin up a new one really quick. So the deployment and configuration is completely managed by an Ansible configuration. The deployment of a single node or even a complete replacement of all nodes takes about 10 minutes.

Our nodes run 2 pieces of third party software, and a few scripts to manage things.

DNS

For the DNS resolution we run gdnsd with 2 plugins, http_status and geoip.

The http_status plugin monitors the health of the other nodes to make sure it’s not sending people to nodes that don’t respond.

The geoip plugin uses the requesting IP to determine what region/country you’re from, and select a priority list of nodes closes to that region. The first healthy node in that list is the node that’s selected.

CACHING REVERSE-PROXY

For the web-serving component, we run a custom xcaddy compiled caddy server with a few modules included: cache-handler, otter storage, coraza WAF, ratelimit, layer4, maxmind and crowdsec.

At the moment only the first 3 are in use, but the other 4 are included in case we need to mitigate attacks or other edge cases in the future.

And that’s pretty much it!

If anyone wants any help with setting up their own version of this, or needs more details, let me know. I’d be happy to help.

If a lot of people are interested (which I doubt at this stage, but who knows?) I’d even be willing to create a project or make it dockerisable etc, but I suspect that it’s something that most people would just use Cloudflare et. al. for, if the privacy aspect wasn’t such a concern.