YuInfra

YuInfra is a small, public field note for Yuri's infrastructure. It is intentionally not an administrative dashboard: the interface shows continuity and resource pressure without exposing the shape of private environments.

What is running

• Static Astro frontend with a responsive React chart island.
• Overview and individual pages for cloud-dbs, cloud-arm, cloud-services, and cloud-lab.
• Full interface localization in the seven website locales (en at the root, pt, es, ja, zh-CN, fr, de prefixed), with hreflang alternates; localized not-found responses keep a real 404 status.
• A Cloudflare Worker that serves both static assets and same-origin API routes.
• Cloudflare D1 migration for raw snapshots, daily rollups, and limited activity records.
• Strict per-host bearer-token ingest authentication.
• A standard-library Python collector for Linux hosts.
• Development sample data for a useful local interface before the first real snapshot.
• Daily retention/downsampling jobs and five-minute offline detection.
• Automated production verification and deployment through GitHub Actions.

Production is available at yuinfra.yuricunha.com. Pushes to main run the complete verification suite and deploy to Cloudflare Workers only when every gate passes.

Local development

Requirements: Node 22+, pnpm 12+, Python 3.11+, and Wrangler.

pnpm install
pnpm test
pnpm test:collector
pnpm lint
pnpm typecheck
pnpm build

For the static design with sample data:

pnpm dev

For the full Worker + local D1 path, build the static assets first and use demo mode:

pnpm dev:edge

DEMO_MODE=true is passed only by the local development command. It must never be configured in Cloudflare production settings.

To exercise D1 locally rather than demo mode:

pnpm db:migrate:local
pnpm db:seed:local

Public API

All public APIs are read-only and same-origin:

• GET /api/overview
• GET /api/hosts/:host
• GET /api/hosts/:host/history?range=24h|7d|30d|365d
• GET /api/activity

The only write route is POST /api/ingest/:host. It accepts exactly nine allowlisted fields, rejects unknown fields, limits bodies to 2 KB, and requires the dedicated token for the host named in the route.

See docs/api.md for the response and ingest contract.

Data retention

Data	Retention	Purpose
Raw snapshots	30 days	Short-term responsive charts
Daily rollups	365 days	Long-term trend lines
Activity records	90 days	Minimal public continuity history

The Worker scheduled event runs daily. It recalculates complete-day rollups before deleting expired rows, so retention does not produce gaps in the yearly view.

Collector

The collector has no third-party Python dependencies. It sends only CPU usage, memory pressure, disk pressure, load average, uptime, aggregate service/container counts, status, and collection time.

It never serializes or logs IP addresses, hostnames, secrets, environment values, filesystem paths, service names, container IDs, process lists, container environment, or configuration content.

Use the units in collector/systemd/ and start from collector/collector.env.example. Each host needs its own token and must use its own name:

• cloud-dbs → INGEST_TOKEN_CLOUD_DBS
• cloud-arm → INGEST_TOKEN_CLOUD_ARM
• cloud-services → INGEST_TOKEN_CLOUD_SERVICES
• cloud-lab → INGEST_TOKEN_CLOUD_LAB

See docs/deployment.md for automated deployment, recovery, and collector installation procedures.

Security posture

• No credentials are embedded in the browser bundle, sample data, repository, or Worker configuration.
• Browser pages never make privileged requests and use same-origin public reads only.
• Ingest tokens are Cloudflare Worker secrets, separated per host.
• The Worker validates host names, timestamp freshness, JSON shape, numeric ranges, body size, and token equality before D1 access.
• Static assets receive a generated strict CSP with SHA-256 hashes for Astro hydration, plus nosniff, frame denial, referrer policy, and a narrow permissions policy through public/_headers.
• The collector rejects non-HTTPS endpoints and does not print bearer tokens.

Read docs/security.md before deploying.

CI

Forgejo Actions CI runs on the cloud-lab runner (see .forgejo/workflows/ci.yml). Deploy is a separate manual workflow.