V1 — Hetzner Secure Cloud Routing (Legacy)
Executive Summary
Section titled “Executive Summary”V1 — Hetzner Secure Cloud Routing was a containerized infrastructure designed to host and route all web traffic — static and dynamic — from a single VPS in Nuremberg, Germany, with a Zero Trust approach for administrative access.
Docker containerized every service. Cloudflare handled DNS and edge proxying. Nginx Proxy Manager managed TLS and virtual hosts. Tailscale isolated SSH and admin access from the public internet.
Key Capabilities
Section titled “Key Capabilities”- Public Web Hosting: Served
pablorosi.devanddocs.pablorosi.devfrom the same VPS. - Legacy Redirection: Intercepted and redirected
.comtraffic to.devat the Cloudflare edge. - Zero Trust Administration: Restricted SSH and the Nginx control panel to authenticated devices on the Tailnet.
- Automated Deployments: GitHub Actions built static sites and deployed over Tailscale via SCP + SSH.
Architecture Diagram
Section titled “Architecture Diagram”
Stack and Responsibilities
Section titled “Stack and Responsibilities”| Component | Role |
|---|---|
| Hetzner VPS | Compute host running Ubuntu and Docker |
| Cloudflare | DNS, CDN, DDoS protection, and legacy redirects |
| Hetzner Cloud Firewall | Layer 4 ingress filter on the public interface |
| Nginx Proxy Manager | Reverse proxy, virtual hosts, and origin TLS |
| Tailscale | Encrypted overlay for SSH, admin UI, and CI/CD |
| GitHub Actions | Build static sites and deploy over Tailscale |
| Docker Compose | IaC for container lifecycle and networking |