One operator, a whole estate

The situation

Most organizations do not have an infrastructure problem. They have a sprawl problem. Every team stands up its own tool, on its own account, with its own login, billed to its own card, and after a few years nobody can say what is running, who can reach it, or what happens when the one person who set it up leaves. The estate is real; the map is not.

I built the opposite of that, on purpose, and I run it in production. It is the back end for every WOPR Systems property, and it is the reference implementation for the hosting I sell. The whole point is that one operator can hold the entire thing in their head, because every part of it was made to be found, not guessed.

What is actually running

One front door. Every public hostname terminates at a single reverse proxy layer (Caddy), which handles TLS for all of it automatically and routes each name to the right backend. Public traffic reaches the estate over a Cloudflare Tunnel rather than an exposed public IP, so there is no open SSH port and no origin to scan. Adding a site is a config entry and a reload, not an afternoon.

One identity. Authentication is centralized in Authentik with OIDC clients per application, so access is one account and one policy surface instead of a hundred separate logins. When something should be private, it is gated at the proxy and at the identity layer both — a personal tool on the estate answers with a login redirect to the SSO, not with the app.

One provisioner. A control plane takes a new node from a bare host to a fully configured, TLS-terminated, SSO-integrated stack without manual steps — with per-job tokens, health verification and rollback. The same path that stands up my own services is the path that stands up a customer’s.

One security posture. Detection and vulnerability management are self-operated across the estate rather than outsourced and forgotten: SIEM and host monitoring, intrusion prevention at the edge, and scheduled scanning. It is not a compliance checkbox bought once; it runs.

One data plane. Streaming, not just storage. A real-time pipeline ingests content into Kafka, processes it with Apache Flink SQL, and runs Python UDFs that call a local LLM on owned GPUs — language detection, translation, and a triage score on every record, with event-time windows and watermarks so late data is handled correctly. This is the part most shops rent from a vendor and never see inside of. Here it runs on the same estate, which means the model, the data and the bill all stay in one place I control.

How I keep it honest

A system this size drifts the moment you stop looking. The defense is not heroics, it is ground truth on demand: the running configuration is the source of record, and I audit against it rather than against my own memory of what I think is deployed. Reserved-hostname guards fail a build if a new site was added without being declared. The provisioner verifies health before it calls a job done. When I recently checked the estate end to end, the one drift I found was a subdomain serving as an alias in front of an app that still identified as its old name — login worked, but the cutover was not clean. I found it because I tested the live system, not the note that said it was done.

And there is a way out.Every application is open source and the data is exportable. The estate is designed so a customer — or a future operator who is not me — can take their environment and leave. Infrastructure you cannot exit is not a service, it is a hostage situation, and I will not sell one.

Why it matters

This is the “design, build, install” door with the receipts attached. It is not a diagram of what I could stand up for you; it is the thing I run right now, under load, with real users and real secrets and real consequences when it breaks. Most people who can design an identity architecture do not also pull the cable and hold the pager, and most people who operate a stack did not architect it. Here it is one mind from the reverse proxy to the backup job.

If your organization has more running than anyone can account for, that is the problem I solve: not adding another tool, but making the estate you already have legible, owned, and safe to hand to the next person. Same work as the door buzzer, at a different scale — find what is actually there, test it instead of assuming it, and build the fix so the next person has the map I never got.