System architecture
See Framework → Maintenance Services for what each of these categories is and why it matters. This page is which tool was actually picked for each, and where its setup is documented.
| Concern | Function | Tool | Status | Notes |
|---|---|---|---|---|
| Deployment | Deployment platform | Coolify | ✅ Running | Setup: Coolify → Install |
| CI/CD | — | Not evaluated | Forgejo Actions is the obvious candidate given code hosting is already Forgejo, but nothing's been evaluated yet | |
| Development | Code hosting | Forgejo | ✅ Running | Hosts this site's own source |
| Security | Password manager | Proton Pass | ✅ Running | The one deliberately non-self-hosted piece of this stack |
| Credential manager | Infisical | Not adopted, low priority | Proton Pass already covers this; self-hosting a credential manager reopens its own backup/recovery problem, not worth the added complexity right now | |
| Auth / IDP | Authentik | ✅ Running | Setup and known issues documented there | |
| Monitoring | Stats | Beszel | ✅ Running | |
| Status pages | Uptime Kuma | ⏳ Not deployed | ||
| Error tracking / APM | — | Not evaluated | Monitors individual apps, not the platform — last for that reason | |
| Backups | Infrastructure | — | ❌ Not doing | Coolify's per-resource backups plus each app's own native path already cover what actually needs protecting; the reproducible parts are already covered by Infrastructure as Code instead, so what's accepted as a gap is narrower than a whole-volume net |
| Service (resource) | Coolify | ✅ Running | Same tool as Deployment above — native per-resource backups to S3/Swift-compatible storage, database dumps and generic volumes alike | |
| Service (native) | — | Varies per app | Where an app backs itself up more completely than Coolify can from outside (e.g. WordPress, grabbing both database and S3-managed media). | |
| Credentials | Proton Pass | ✅ Running | Genuinely off-site, unlike everything above — a manual backup of the keys (APP_KEY, SSH keys, database passwords) needed to decrypt the rest if the server itself is lost |
Credential setup for provisioning tooling itself is in Infrastructure → Infrastructure as Code. Credentials generated once things are actually running go to Proton Pass.