How this site works

The page you are reading is the clearest thing in my portfolio, so it is documented like a system rather than described like a hobby.

There is no server

A classic portfolio is a VPS: an operating system to patch, nginx to configure, certificates to renew, a deploy over ssh. Thirty złoty a month and an hour of work every few weeks, for a page that changes once a quarter.

This platform has a second problem on top of that: the projects are ephemeral. A scraper lives three weeks, a Kubernetes cluster two, and then it is gone. On a server each one is manual work in nginx and DNS twice — once to stand it up and once to remove it.

So there is no server. There is code that runs on demand in Cloudflare's network, and infrastructure described in Terraform, whereterraform apply brings a subdomain to life andterraform destroy returns it to an offline page. No manual DNS edits in either direction.

The path of this request

browser
  │  where is knapiontek.com?
  ▼
Cloudflare DNS  ──  AAAA 100::, proxied
  │  the address belongs to Cloudflare
  ▼
Cloudflare network
  │  Access: is this hostname protected?
  │  route match, by hostname, before any IP lookup:
  │     knapiontek.com/*      → Worker web     (this page)
  │     lab.knapiontek.com/*  → Worker dash    [Access: owner only]
  │     *.knapiontek.com/*    → Worker router  (offline pages)
  ▼
D1 — projects, posts, health_checks

Nobody ever connects to 100::. It is a reserved discard address; what matters is that the record is proxied, because only then may Cloudflare intercept the request and run a Worker at all.

Every subdomain is a single label

Free Universal SSL covers *.knapiontek.com but nota.b.knapiontek.com, so a deeper name could never present a valid certificate. That is not a convention — it is enforced in the router and in the slug validation, because a value that is invalid there would be an invalid hostname.

Two switches, not one

A project's card and a project's running instance are independent. One controls whether it appears here; the other whether<slug>.knapiontek.com lets a visitor in without logging in. Both default to private, so an admin panel can be shown off without being opened.

What is verified, not asserted

  • A private project and an unpublished post return 404 and appear in no listing, sitemap or feed.
  • The offline page shows no title or description for a private project, so a misconfigured Access policy still leaks nothing.
  • Markdown cannot inject scripts: raw HTML never enters the tree, and the output is sanitised against an allow-list.
  • An upload is identified by its magic bytes, so a renamed extension is refused.
  • Publishing is blocked when the linked repository is not public.