Cloudflare on Artur Rios Lab

Landing Pages

Wed, 21 Oct 2026 17:55:00 +0000

A landing page sells something: a hero section, a grid of features, pricing, a contact or waiting-list form. It has to look polished, load fast everywhere, and occasionally do something dynamic, such as accept a form. That last part is why landing pages are not plain static sites.

Concern	Choice
Framework	Next.js, with the App Router
UI	shadcn/ui and Tailwind CSS
Hosting	Vercel, on the free tier
DNS	Cloudflare
Deploys	Vercel’s Git integration

Building one

bash

npx create-next-app@latest my-landing --ts --tailwind --app --eslint
cd my-landing
npx shadcn@latest init
npx shadcn@latest add button card input navigation-menu

shadcn/ui is not a component library installed as a dependency: it copies each component’s source into the project, built on Radix and Tailwind, so every component can be changed like my own code.

The Platform: Traefik, Monitoring and the Console

Wed, 21 Oct 2026 17:55:00 +0000

On top of the server runs one Compose project, yggdrasil, that every application shares: the reverse proxy, the monitoring, and a status API with its console. It is started once per host, and serves every environment on that host.

bash

scripts/platform.sh up

Component	Version	Job
Traefik	v3.6	Routes every request, terminates TLS
Docker socket proxies	1.13.1	Give Traefik, Alloy and the status API read-only access to Docker
Status API	.NET 10	Health, version and deploy time of every application
Console	Flutter	Shows the status API, on the web, Windows and Android
Prometheus	v3.5	Metrics, kept 30 days
Loki	3.5	Logs, kept 31 days
Alloy	v1.10	Ships every container’s logs to Loki
Grafana	12.1	Dashboards over Prometheus and Loki
Jenkins	LTS	Deploys, covered in Deploying With Yggdrasil

Traefik and one wildcard certificate

Traefik is the only container that publishes ports, 80 and 443, and port 80 does nothing but redirect to 443. It watches Docker for containers that opt in with labels, so a new application is routed the moment it starts, without touching Traefik’s configuration.

Web Apps

Wed, 21 Oct 2026 17:55:00 +0000

My interactive front ends are Flutter apps, and on the web they are a set of static files: HTML, JavaScript and WebAssembly. So the container that runs one is just a web server, small and stateless. Heimdall’s web app is the example.

Concern	Choice
Framework	Flutter, built for the web
Build stage	Debian with a Flutter SDK pinned by version and checksum
Runtime	nginx, unprivileged, with a read-only file system
Settings	Compiled in at build time, once per environment
API	Its own origin’s `/api/`, routed to the API by Traefik
Health	`/healthz`
Checks	Analysis and tests, and generated code checked in GitHub Actions

The image

The build stage installs Flutter itself, rather than starting from a community Flutter image, so the exact SDK version is pinned and its download is checked against a SHA-256 checksum. It builds as a non-root user, and fetches packages with --enforce-lockfile, so the build uses exactly the versions the repository was tested with: