Kyber Cypher v002/v001 KC//NODE-01 00:00:00:00

I put this site in my own house

Field Log // 005 Status Live Difficulty Medium Cost About ten bucks a year
The Story

You're reading this off a small computer sitting in a room in my house. Not a host, not a platform, not somebody's edge network. A single board computer that used to do something else entirely, and cost me nothing because I already owned it.

The only thing I pay for is the domain name. About ten dollars a year. That's the whole operating cost of this website.

Why bother, when free hosting exists

Because a platform can decide it's done with you overnight and there is nothing you can do about it. Accounts get suspended by systems with no human in the loop. Services shut down. Terms change. If your work lives entirely somewhere you don't control, you're one automated decision away from losing it.

This domain is mine, this box is mine, and the words are on a drive I can physically hold. The social accounts point here. Not the other way around.

It's just files

There's no database here. No app server, no login, no comment system, nothing that runs. It's a folder of plain files, and the web server's entire job is to hand them to you.

That sounds primitive. It's the strongest part of the design. Nothing to crash at three in the morning, nothing to keep patched, nothing to break into. The whole thing lives in version control, so every change is a commit and every bad idea I have is one command away from being undone.

Getting it online without opening your house

Here's the part people get wrong, and it's the part that actually matters.

The obvious way to put a home server on the internet is to open a port on your router and point the world at your house. Don't. That publishes your home address to every scanner on the planet and it makes your router the front door.

The better way is a tunnel. The little computer makes an outbound connection to a service, the way your laptop connects to a website, and that connection stays open. Traffic comes back down the pipe it already opened. Nothing inbound. No ports open. My home address appears nowhere in public.

The tightest version of this: my web server doesn't listen to the network at all. It only answers requests coming from the same machine. The tunnel program sits on that same box and is the only thing that can reach it.

So there is exactly one door into this site, and it's a door that opens outward. Nothing on my home network can reach it either. That's not paranoia, it's just the cheapest way to have fewer things to worry about.

Side benefit I didn't plan for: I have two internet connections, and when one drops the tunnel just re-establishes itself over the other. The site doesn't notice. Try getting that out of a port forward.

The part that's a little unusual

I don't intend to leave this site alone. I want to rebuild it constantly, and I want my own machines doing it.

So the design got split in two. There's a locked layer, which is the colors, the type, the mask, and the waveform you keep seeing. That never changes. Then there's everything else, the actual shape of every page, and that's supposed to change every single time.

Both halves are written down in a file that any rebuild has to read first. A rebuild that changes the colors failed. A rebuild that keeps the same layout also failed. Identity holds, structure rotates.

Every version gets kept, and you can go look at all of them. Most sites bury their old design like it's embarrassing. Watching the thing mutate while staying recognizably itself is more interesting than any single version of it, and it's the closest thing to showing my work that a website can do.

What it cost

  • Domain: about ten dollars a year.
  • Hosting: nothing. Hardware I already had.
  • Tunnel: nothing at this scale.
  • Software: nothing. All of it open.
  • Electricity: a few dollars a year for a computer that sips power.

Ten bucks a year for a site nobody can take away from me. That's the entire pitch, and it's why I'd rather run it on a computer in a spare room than get it free somewhere I don't control.

The Build

The whole pattern, start to finish. Any always-on low-power box works: a Raspberry Pi 5 (8GB) or an old laptop that sips power. You need a domain (about ten dollars a year) and a free Cloudflare account. Replace every value in angle brackets with your own.

1. Make the site a folder of plain files

No database, no app server. A small static build script turns your source into a dist/ folder of finished HTML and CSS, and the whole thing lives in git so every change is a commit you can undo.

git init
python3 build.py        # writes the finished site into dist/
ls dist/                # index.html, css, fonts, done

2. Serve it, but only to the same machine

Install a web server and point it at the built folder. The one rule that matters: bind it to 127.0.0.1 (loopback), not 0.0.0.0. Loopback means nothing on your network, and nothing on the internet, can reach it directly. Only a program on the same box can.

# /etc/nginx/sites-available/<your-site>
server {
    listen 127.0.0.1:80;          # loopback only. this is the whole trick.
    server_name <your-domain>;
    root /var/www/<your-site>;    # your dist/ folder
    index index.html;
}
sudo ln -s /etc/nginx/sites-available/<your-site> /etc/nginx/sites-enabled/
sudo nginx -t                    # check the config
sudo systemctl reload nginx

3. Put it online with an outbound tunnel

A Cloudflare Tunnel makes an outbound connection from your box to Cloudflare and traffic comes back down that same pipe. Nothing inbound, no router port opened, your home address never appears in public. Install cloudflared, then:

cloudflared tunnel login
cloudflared tunnel create <tunnel-name>
cloudflared tunnel route dns <tunnel-name> <your-domain>

Map the hostname to your loopback web server:

# ~/.cloudflared/config.yml
tunnel: <tunnel-name>
credentials-file: /home/<you>/.cloudflared/<tunnel-id>.json
ingress:
  - hostname: <your-domain>
    service: http://127.0.0.1:80
  - service: http_404

4. Make it survive reboots

Run the tunnel as a service so it comes back on its own after a power blip.

sudo cloudflared service install
sudo systemctl enable --now cloudflared
systemctl status cloudflared     # should read active (running)

5. Ship an update

Every change is the same three steps. The tunnel keeps serving the old files until the reload swaps them, so there's no downtime.

git pull
python3 build.py
sudo systemctl reload nginx

The gotcha that makes it safe

Bind to loopback, not all interfaces. If the web server listens on 0.0.0.0, every device on your network can hit it and a misconfigured firewall can leak it to the internet. On 127.0.0.1 the only thing that can reach it is the tunnel on the same box. One door, and it opens outward. Never open a port on your router to do this. You do not need to, and it undoes the entire point.