Austin Thorne
← All projects
02 / Citadel

Secure Cloud Hosting Platform.

The Ubuntu VPS behind austinthorne.com: a hardened administrative baseline and a containerized portfolio behind Caddy and Cloudflare.

Ubuntu Server 24.04 LTSDocker ComposeCaddyNginxCloudflare

Overview

Citadel is my cloud-hosted Ubuntu VPS and the infrastructure platform behind this portfolio. It serves the site through a layered web stack: Cloudflare handles public DNS and proxying, Caddy manages the origin reverse proxy and certificates, and Nginx serves the portfolio on an isolated Docker application network.

The site is itself an infrastructure project: a small static application with a clear boundary between public ingress and the application container.

Current state

Server baseline

Ubuntu Server 24.04 LTS with a non-root administrative account, UFW, Fail2ban, and unattended security updates.

Administrative access

SSH access uses Ed25519 public-key authentication. Direct root login and password-based SSH authentication are disabled.

Application isolation

Docker Engine and Compose run the web stack. Only Caddy exposes public web ports; the Nginx application container is not directly host-published.

DNS, TLS & proxying

Cloudflare DNS and proxying with DNSSEC, automated Let’s Encrypt certificates, and Cloudflare Full (strict) TLS protect the public web path.

Architecture

CITADEL / REQUEST PATH
  1. Internet
  2. Cloudflare — DNS and proxy
  3. Citadel — Ubuntu VPS
  4. UFW — host firewall
  5. Caddy — public web ports and reverse proxy
  6. Private Docker application network
  7. Portfolio — Nginx container
Approximate service path supplied for the project. The Nginx application container has no direct host-published port.

Technologies

  • Ubuntu Server 24.04 LTS · Ed25519 SSH · UFW · Fail2ban · unattended security updates
  • Docker Engine · Docker Compose · isolated application networking
  • Caddy reverse proxy · Nginx portfolio container
  • Cloudflare DNS/proxy · DNSSEC · Let’s Encrypt · Full (strict) TLS

Security model

Citadel separates administrative access, public ingress, and application delivery. Administration uses a non-root account with Ed25519 SSH keys, while UFW, Fail2ban, and unattended security updates protect the host. Cloudflare DNSSEC protects signed DNS responses, and Full (strict) TLS validates the encrypted connection to Caddy. Caddy remains the single public web entry point; the Nginx application container stays on the private Docker network.

Build history

Selected milestones, grouped by engineering area.

  1. PROJECT MILESTONE

    Secure Ubuntu baseline

    Provisioned Ubuntu Server 24.04 LTS with non-root administration, Ed25519 SSH keys, UFW, Fail2ban, and unattended security updates.

    Established the host and restricted its administrative access path.

  2. PROJECT MILESTONE

    Isolated container stack

    Installed Docker Engine and Compose, then placed the Nginx application container on a private network without a directly published port.

    Kept application delivery behind a single reverse-proxy entry point.

  3. PROJECT MILESTONE

    Public ingress & DNS security

    Configured Caddy for public web ingress and connected the domain through Cloudflare DNS, proxying, and DNSSEC.

    Centralized request handling while adding proxy and signed-DNS protections.

  4. PROJECT MILESTONE

    Validated origin encryption

    Established automated Let’s Encrypt certificates and Cloudflare Full (strict) TLS.

    Provided encrypted, certificate-validated connections from Cloudflare to Citadel.

  5. PROJECT MILESTONE

    Containerized portfolio hosting

    Established the static Nginx portfolio container behind Caddy.

    Completed the public request path from Cloudflare to the isolated application service.