Raspberry Pi 5 · Debian 13 · ARM64
Everything you can reach from here was deliberately chosen. Push to
main, CI verifies it, the Pi pulls the approved commit and
serves it. Nothing gets hand-edited on the machine.
Denzel's project space. His sandbox, his rules, his code.
/projects/hurricane/Allow-listed JSON endpoints. Health and version only, for now.
/api/health · /api/versionSensors, jobs and household automation. Added one deliberate route at a time.
reserved| / | this page, public-web |
| /projects/hurricane/ | Denzel's project space |
| /assets/* | css, js, images |
| /health | public-web health |
| /api/health | public-api health |
| /api/version | public-api version |
| /admin /private /jobs /metrics | 404, and staying that way |
One nginx ingress on :8080. Exact-match routes only, no wildcard proxy. The catch-all returns 404.
Admin web and internal API bind to loopback only. They have no route through the funnel. They never will.
Background jobs on an isolated Docker network with no listening socket at all.