# Services & Projects

> The self-hosted stack behind helali.org, and the projects that keep it running.

This page describes software and protection tiers only. It deliberately does not
name which machine runs what, or any address: the topology is the sensitive part
and is kept out of every public surface, including this one.

## At a glance

- **3 Servers** — Two cloud providers, plus a workstation on the mesh
- **9 DNS zones** — Proxied by default, strict origin TLS
- **20 Services** — Self-hosted end to end, no managed panel
- **2 Overlay networks** — An admin mesh and an identity-aware tunnel
- **14 Zero Trust apps** — Edge policy in front of the sensitive ones

## The stack

### Edge & DNS

Every public name resolves to the edge first. Origins answer to it and, with a handful of deliberate exceptions, to nothing else.

- **Cloudflare** — Proxied DNS, WAF and caching across 9 zones, strict origin TLS
- **Cloudflare Access** — Zero Trust policy on 14 applications, delegating identity to the self-hosted provider
- **Turnstile** — Privacy-preserving challenge on the public forms, no tracking cookie
- **WARP** — Device tunnel on the workstation, MTU-pinned after a throughput regression

### Ingress & TLS

Two proxy layers with distinct jobs: one terminates TLS at the perimeter, one routes to applications and enforces auth.

- **NPMplus** — Perimeter reverse proxy, automated ACME issuance, OCSP stapling
- **nginx** — Origin routing, auth_request forward auth, pre-compressed Brotli and gzip assets
- **Traefik** — Ingress for the tunnel stack, routing per private resource
- **Let's Encrypt** — Certificates on both proxy layers, renewed on a timer rather than a reminder

### Identity & access

One policy engine, two integration paths, and a recovery path that does not depend on the thing it recovers.

- **authentik** — OIDC provider and forward-auth decision endpoint
- **OIDC / OAuth2** — Native login for the applications that implement it
- **auth_request** — nginx subrequest gating the applications that do not
- **TOTP / WebAuthn** — Second-factor options wired into the login flow
- **Vaultwarden** — Credentials held outside the SSO chain, independent by design

### Private networking

Two overlays with different jobs: a flat administrative mesh, and an identity-aware tunnel for resources with no public record.

- **Tailscale** — WireGuard mesh across every machine, MagicDNS, exit nodes, ACL-checked SSH
- **Pangolin** — Identity-aware tunnel; browser SSH mints a short-lived certificate per session
- **WireGuard** — The transport underneath both overlays
- **systemd-resolved** — Split-horizon DNS so overlay names resolve without leaking to public resolvers
- **dnscrypt-proxy** — Encrypted public resolution when the device tunnel is down

### Runtime & data

Applications are containers under declared stacks; the rest are supervised units. Each stack owns its own datastore.

- **Docker + Compose** — Every application stack declared in a file rather than assembled by hand
- **systemd** — Units and timers for the things that are not containers, including the backups
- **PostgreSQL** — Identity provider, cloud storage and the relay, on separate instances
- **MariaDB · Redis** — Mail metadata and queue state, cache for the groupware stack
- **Debian · Ubuntu · Fedora** — Server base, and the workstation that administers them

### Observability & backup

The stack reports on itself without sending anything to a third party, and the restore path is exercised rather than assumed.

- **Netdata** — Per-second metrics and alarms with per-container breakdowns
- **CrowdSec** — Behavioral ban engine across the fleet, enforcement kept independent per host
- **GoAccess** — Access-log analytics streamed over websocket, no client-side script
- **vnStat** — Interface transfer history for capacity planning
- **GnuPG + rclone** — Archives encrypted before they leave the host, uploaded off-site on a retention window
- **YubiKey** — Decryption and certification keys that have never touched a disk

## Self-hosted services

### Identity Provider (HelaliAUTH)

Single sign-on for the services on this list that use it, issuing OIDC to the applications that speak it and forward-auth decisions to the ones that don't. Runs its own database rather than sharing one.

- **Stack:** authentik · PostgreSQL · Docker
- **Access:** SSO — authentik
- **URL:** https://auth.helali.org

### Files, Calendar & Contacts (HelaliCLOUD)

Files over WebDAV, calendars over CalDAV, contacts over CardDAV, plus groupware and a Deck board my automation writes into. Deployed as separate containers for the app, database, cache, full-text index and background jobs.

- **Stack:** Nextcloud · PostgreSQL · Redis · Docker
- **Access:** SSO — authentik
- **URL:** https://cloud.helali.org

### Mail Server (HelaliMAIL)

Postfix and Dovecot for transport and delivery, Rspamd for filtering and DKIM signing, SOGo for webmail — across two domains, with SPF, DKIM and DMARC all published and aligned.

- **Stack:** mailcow · Postfix · Dovecot · Rspamd · SOGo
- **Access:** SSO — authentik
- **URL:** https://mail.helali.org
- **Note:** SSO covers the web interfaces; mail clients authenticate with per-application passwords.

### Password Vault (HelaliVAULT)

Bitwarden-compatible vault in a single Rust binary. Held outside SSO by design — a recovery path shouldn't depend on the system it exists to recover.

- **Stack:** Vaultwarden · Rust · SQLite
- **Access:** App login — Credentials held outside SSO
- **URL:** https://vault.helali.org

### Encrypted Pastebin (HelaliPASTE)

Zero-knowledge paste sharing. The browser encrypts before upload and the key stays in the URL fragment, which browsers never send to the server — so the server only ever holds ciphertext it cannot read.

- **Stack:** PrivateBin · PHP
- **Access:** Open — No sign-in
- **URL:** https://paste.helali.org

### File & Image Hub

Upload, get a link, set an expiry. Storage is a hash-sharded directory tree with links held as files, so resolving one costs a stat call rather than a database query.

- **Stack:** Jirafeau · PHP
- **Access:** Open — No sign-in
- **URL:** https://i.helali.org
- **Note:** Share links stay public; uploading requires an account.

### Nostr Relay

A paid relay on the Nostr protocol — event ingest and filtered subscriptions over websocket, advertising its own limits and fee schedule to clients over NIP-11.

- **Stack:** nostream · Node.js · PostgreSQL
- **Access:** Open — No sign-in
- **URL:** https://nostr.slothy.win

### Verified Nostr Relay

A second relay on the same protocol, in Rust rather than the paid one's Node.js stack. Reads are open to anyone; publishing is restricted to identities under this domain.

- **Stack:** nostr-rs-relay · Rust · SQLite
- **Access:** Open — No sign-in
- **URL:** https://nostr-verif.slothy.win

### Key Recovery Network

One operator in a FROST threshold-signing network for Nostr keys: a registrant's private key is split across a k-of-n set of independent operators so that no single one ever holds the whole thing, and reconstructing it needs contributions from enough of them to clear the threshold. Recovery routes through an OAuth login rather than a password only the registrant holds.

- **Stack:** Pyramid (Pomegranate) · Go · FROST
- **Access:** Open — No sign-in
- **URL:** https://pomegranate.slothy.win
- **Note:** Registration is open to anyone; the operator's own admin configuration is not.

### Bitcoin & Lightning Payments (HelaliPAY)

Self-custodial payment processing on top of my own Lightning node: invoices, point of sale, channel management. No third party between payer and node, and no custodian holding the keys.

- **Stack:** BTCPay Server · LND · NBXplorer
- **Access:** App login — Credentials held outside SSO
- **URL:** https://pay.helali.org

### Ark Delegate

A Bitcoin Layer 2 wallet running in delegate mode: other Ark clients connect to it, submit spend intents, and pay a small delegate fee to settle on-chain without keeping their own signer online. The handshake and intent submission are public by design — the wallet backing them is not.

- **Stack:** Fulmine · Ark protocol
- **Access:** Open — No sign-in
- **URL:** https://ark-delegate.slothy.win

### Ark Delegate Admin

The same delegate's own wallet — balance and VTXO management, gated by a macaroon that grants full spend authority. It sits behind the identity-aware tunnel below rather than on public routing.

- **Stack:** Fulmine · macaroon auth
- **Access:** SSO — authentik
- **URL:** https://ark-delegate.spoofer.net

### Identity-Aware Tunnel

Private ingress for resources that should not carry a public DNS record. WireGuard tunnels terminate at a Traefik ingress, and browser-based SSH mints a short-lived certificate per session instead of trusting a long-lived key.

- **Stack:** Pangolin · Gerbil · Traefik · WireGuard
- **Access:** SSO — authentik
- **URL:** https://burrow.spoofer.net
- **Note:** Federated to the same identity provider as an external OIDC source.

### AI Chat Gateway (HelaliCLANKERS)

An OpenAI/Anthropic-compatible API gateway in front of GitHub Copilot's backend, with a dark-mode chat workspace and a usage-quota viewer built on top of it.

- **Stack:** Node.js · TypeScript · GitHub Copilot API
- **Access:** SSO — authentik
- **URL:** https://clankers.spoofer.net
- **Note:** Reached through the identity-aware tunnel above rather than a public sign-up; access is by account, not by URL.

### Container Management

One console across every host running Docker — image lifecycle, stack deploys, logs and exec — signing in over OIDC rather than with a local password.

- **Stack:** Portainer · Docker API
- **Access:** Zero Trust — Cloudflare Access
- **URL:** https://docker.helali.org

### Real-Time Metrics

Per-second telemetry with alarms: CPU, memory, disk I/O, network and per-container breakdowns, retained long enough to reconstruct an incident after it is over rather than during it.

- **Stack:** Netdata · eBPF · cgroups
- **Access:** Zero Trust — Cloudflare Access
- **URL:** https://netdata.helali.org

### Web Log Analytics

Traffic analysis parsed straight from the access logs and streamed to the browser over a websocket. No third-party script, no cookie, and no request leaving the origin — the client address it reports is recovered from the forwarded-for chain.

- **Stack:** GoAccess · nginx logs
- **Access:** Zero Trust — Cloudflare Access
- **URL:** https://stats.helali.org

### Bandwidth Accounting

Interface-level transfer totals by hour, day and month, kept in a local database instead of sampled at query time, so capacity questions get an answer with numbers in it.

- **Stack:** vnStat
- **Access:** SSO — authentik
- **URL:** https://vnstat.helali.org

### OpenPGP Key Directory

My public key, published over Web Key Directory so a compliant mail client discovers it from the address alone — no keyserver round trip, no manual import. The certification and decryption keys never leave a hardware token.

- **Stack:** WKD · GnuPG · OpenPGP smartcard
- **Access:** Open — No sign-in
- **URL:** https://www.webkeydirectory.com/?email=skander%40helali.org

### IP Echo

Returns the requesting address as plain text and nothing else — no markup, no framing, 13 bytes on the wire. One endpoint per domain, which is the point: comparing the two answers tells you which path a request actually took.

- **Stack:** nginx
- **Access:** Open — No sign-in
- **URL:** https://myip.helali.org

## Projects

### helali-brand

The identity system every service on this page wears: five brand marks plus utility icons, emitted by idempotent generators. Re-running them reproduces each committed asset byte for byte, which makes the generator its own regression test.

- **Visibility:** private
- **Language:** Python
- **Year:** 2026
- **Tags:** design system, SVG, generators

### nohawk-nt256

Reverse-engineered the USB protocol of an undocumented thermal camera from captured traffic, then built a driver and both Linux and Android applications on top of it.

- **Visibility:** private
- **Language:** Kotlin
- **Year:** 2026
- **Tags:** reverse engineering, USB, Android, embedded

### personal-portfolio

The source of this site. A static Vite build with hand-tuned chunking, backed by two small PHP endpoints instead of an application server — the deployed artefact is a directory of files behind nginx.

- **Visibility:** private
- **Language:** TypeScript
- **Year:** 2026
- **Tags:** React, Vite, static site

### delegate-agy

A CLI bridge that routes coding and research tasks from one AI agent runtime to another, with per-task usage accounting so the routing decision can be judged against numbers.

- **Visibility:** private
- **Language:** Shell
- **Year:** 2026
- **Tags:** CLI, tooling, LLM

### helali-clankers

A customized fork of an OpenAI/Anthropic-compatible gateway in front of GitHub Copilot's backend — stripped to the one provider actually in use, hardened, and given a chat workspace and usage-quota viewer on top.

- **Visibility:** private
- **Language:** TypeScript
- **Year:** 2026
- **Tags:** gateway, LLM, Node.js

### openclaw-deck-tracker

Lets an AI agent manage its own task lifecycle on a self-hosted Deck board — queue through to completion, with a heartbeat that reports progress so a long-running task is distinguishable from a hung one.

- **Visibility:** private
- **Language:** JavaScript
- **Year:** 2026
- **Tags:** automation, Nextcloud, agents

### claude-track-extension

Browser extension that surfaces AI assistant quota consumption in real time, reading the usage window rather than inferring it from failures.

- **Visibility:** private
- **Language:** JavaScript
- **Year:** 2026
- **Tags:** browser extension, observability

### claude-quota-pinger

The daemon half of the same idea — watches quota windows and notifies ahead of a reset instead of after one.

- **Visibility:** private
- **Language:** Shell
- **Year:** 2026
- **Tags:** daemon, notifications

### AccelProject

Wearable accelerometer logger built for GlycoTrem.com, my undergraduate thesis project on detecting hypoglycemia from hand tremors (Texas A&M, B.S. Electrical Engineering, 2020) — captures and stores motion data on-device for offline analysis.

- **Visibility:** private
- **Language:** Java
- **Year:** 2019
- **Tags:** Android Wear, sensors, thesis

## Access tiers

- **Open** — No sign-in
- **SSO** — authentik
- **Zero Trust** — Cloudflare Access
- **App login** — Credentials held outside SSO