Exploration of technical topology: from user interaction to continuous deployment pipeline.
Lifecycle of a web request: from client browser through Cloudflare and Nginx down to Nuxt 4.
The application runs in the user's browser with progressive Vue 3 DOM hydration. The HTML5 audio player leverages the Web Audio API and directly queries public Deezer, Apple Music/iTunes, and YouTube endpoints to retrieve high-definition album artwork and real-time metadata, playing streamed audio delivered in chunks by the server.
Cloudflare acts as a fronting reverse proxy between the visitor and the origin host. It intercepts all public web traffic, completely conceals the origin server's real IP address, and serves static assets from its global edge cache to maximize delivery speed.
Cloudflare inspects all ingress packets. Volumetric attacks (SYN/UDP flood) and application-layer threats (HTTP flood, SQLi, XSS) are attenuated at the edge. IP reputation checks and Geo-IP filtering stop malicious automated scrapers.
TLS 1.3 cryptographic handshakes terminate on the Cloudflare point of presence closest to the visitor. Static assets, fonts, and icons are served from edge cache with Brotli compression, keeping global latency under 25 milliseconds.
Only TCP port 443 is exposed to the outside on the Linux server host. Nginx terminates Cloudflare Authenticated Origin Pulls, forwards real visitor IP headers (CF-Connecting-IP), and reverse-proxies requests over private loopback port 3000 to Docker.
The Nitro engine performs server-side rendering and handles API routes. Sensitive operations (Breach Protocol anti-spam, DNS MX email checks, NVIDIA NIM AI inference, and Telegram alert relays) are sealed and executed server-side without exposing API keys to the client.
Automated Zero-Trust pipeline: cloud build, HMAC validation, and zero-downtime rollover.
The developer pushes cryptographically signed Git commits to the GitHub repository main branch. This commit push serves as the sovereign, immutable trigger for the entire continuous delivery pipeline.
The GitHub Actions cloud runner runs unit tests and TypeScript linting. On success, it builds a multi-stage Docker image: a builder stage compiles the code, and an ultra-lean Alpine runner stage copies only the Nitro binary, stripping npm to shrink attack surface.
If and only if all tests pass and build succeeds, the verified image is published to GitHub Container Registry (GHCR) tagged with the commit SHA. This verified artifact state triggers the automated update notification to the server.
GitHub Actions dispatches an HTTPS POST request to /api/deploy-webhook signed with a strong shared secret. The Nitro backend validates the payload using crypto.timingSafeEqual in constant time, neutralizing timing attacks and tampering.
The web container operates with zero root privileges, no shell access, and no Docker socket mounts. Once the HMAC signature is verified, it touches an empty pending.flag file in a shared volume, eliminating web-to-host RCE attack vectors.
The isolated website_deployer daemon detects the flag, pulls the new image from GHCR, and hot-swaps the container without downtime. It polls /api/health for 10 seconds, immediately rolling back to the previous healthy container if checks fail.
Defensive hardening implemented to guarantee runtime integrity, isolation, and resilience.
The application runs strictly under the unprivileged node user, preventing host escalation or runtime container modifications in the event of an intrusion.
System updates are communicated exclusively through a signal file in a shared volume, making remote shell code execution from the web impossible.
All webhook deployment cryptographic signatures are compared in constant time, preventing side-channel and timing-based forge attempts.
Continuous post-deployment synthetic monitoring with immediate automatic reversion to the previous known-good image on error.
Host system health, deployment events, and security logs are continuously monitored and dispatched to Telegram alert channels.
Container base images and node dependencies are routinely rebuilt and patched against newly disclosed CVE security advisories.