Notes on running small, honest infrastructure: GitOps, Kubernetes, security, and the bugs in between.
One container for management, signal, relay and identity; the dashboard behind the same Caddy edge; no extra ports. It all worked on the first deploy — except login, because the owner password must be a bcrypt hash.
An exposed Caddy edge, a log-driven intrusion prevention layer, and a deploy script that registers its own bouncer keys. It caught a real scanner within minutes — here is the whole setup, including the one trap.
Long polling allows exactly one poller per token. Moving a bot is therefore a small choreography: stop, seed, switch on — in that order, with a safety catch.
I edited the Caddyfile, the deploy ran, Caddy reloaded — and nothing changed. Mounting a single file is not the same as mounting its directory.
An unchanged image kept getting a new ID. The culprit was the build attestation the containerd image store folds into the manifest list — and the fix is one environment variable.
One small VPS, one git repository, a five-minute pull loop and a single edge: the architecture behind divyam.top, the status page and a Telegram bot that shares the box.