when i first purchased my small, featureless, grey mini-PC box, i had and have all these grand ambitions of all the public services i would build it to offer, whatever those services are, just to prove that i could do it. a lot of my lead-up towards moving and going to college, living on my own as an adult for the first time, has been defined by this beautiful latent now starving passion to challenge myself to learn new things about these machines that i've loved all my life.
it's not the 90's anymore though, kid, and making your machine public-facing and accessible to anyone in any way opens it up to a whole host of dangers that i have made it my sworn duty to anticipate and understand. a truly unfathomable amount of internet traffic is constantly happening, and we've gotten used to it as much as anyone tends to get used to the sound of tires rolling on asphault. it's the cost of doing business.
i should have expected going into this that i'd have to wade through oceans of AI hyperscaler marketing sludge1 to arrive at a service that doesn't seem like it's goal was to boil away as much water and occupy as much land area as possible. infomaniak (goofy name) was the only VPS2 provider i could find that seems to actually perhaps certifiably be 100% emissions free and clean, but this is not an endorsement in case that's a lie. it was also three dollars a month.
tailscale; bypassing your router through software using hardware somewhere else
tailscale is how i connect to my home server from anywhere; it bypasses needing to touch any home internet settings at all. which is good, because surely my student housing isn't going to allow me to touch them. i'd be too piss scared to touch them even if i could. all you have to do to use tailscale is sign up for an account3, install a daemon (system service) onto your server, validate your account credentials through the command line, and boom. you can now enrol devices into your "tailnet" from the web admin console. it's as easy as it sounds. what tailscale doesn't do though is touch the internet. i've been thinking a lot about "networks that aren't the internet" lately. what all that entails is out of scope for this post.
tailscale is not a VPS
i've gotten fairly used to using tailscale at this point. the service that infomaniak provides solves the same problem as tailscale does --- you don't have to touch your router to host or provide a service, ever --- but tailscale is limited to it's own infrastructure and "namespace" (.ts.net). i do not own this infrastructure. to wit: i cannot use tailscale to host a website. what infomaniak will provide me, though, is infrastructure. i have the keys to the building. i manage the building. this website that my mini-PC serves will become a Thing people can see. pretty cool, a large reason why i purchased one to begin with, but still pretty scary!
why not use neocities?
this is a question i asked myself for a while before commiting to this. and i really think the answer is mostly, "because i can", though this comes with secondary privacy and mental health benefits. neocities itself is a type of social media but it's as much of a social media as the original geocities was, which is to say that this is not an indictment of neocities at all. discoverability just isn't something that i value anymore; that's what neocities would provide me while also depriving me of a cool commitment and learning experience, and i've been really enjoying the "oh, i really like this... oh, i really like this!" feeling i've been experiencing lately, catching up on all this hardware literacy i desired having but was too scared to reach for. it also feels nice to discover some tiny obscure website completely on your own, doesn't it? i'm relying on webrings/stamps and people clicking my website in my discord profile, and imagining someone finding this website from a stranger-of-a-friend-of-a-friend-of-a-friend makes me happy, and i hope it happens somehow.
what is a DNS
it's a registry. this sort of blows my mind for some reason but "giving a name to a number" is all a DNS does in the same way you address your friends by name and not by their social security number. this is also how TLS handshakes work4; they're bound to domain names. the physical server decides what to serve based on which hostname (local domain name, essentially) was requested, so theoretically, one IP address could host multiple websites. one social security number can house multiple credit cards. maybe this is how neocities works. i wouldn't know5
wait --- no, it's not a registry
not conflating things is difficult. OK, no, a DNS is not "a registry". it's the network of servers world-wide that permit that registry to work, which is a different thinking. registrars buy and sell shit and write the Deed. OK.
A record, AAAA reeeecoooord
A stands for "address record". it sounds funny to use a one word acronym for a word with two syllables but i'm sure there is some interesting historical reason that it's named this way. all it does is tie a domain name to an IP(v4) adress.
an AAAA record is the same as an A record but for the much more recent IPv6 standard which uses big enormous numbers for everything for security reasons i bet. it has more A's because it's larger and louder than an A record
OK --- and a registry is different from a host
registrars are the landlords of domain names, they sign the Deed, they're the Controlling Entity of the domain name i purchased. i have free reign to point "where to look for records" anywhere else i may please, great. enough of this
pausing and reflecting upon bot traffic
now this i'm remiss to think about because it just makes me sad. these days, here's the number one reason why almost anybody who isn't a nerd should always be registering a personal website with something like neocities: they protect you from bot traffic, and quite a substantial amount of it.
as an aside, Xe Iaso, the lead developer of Anubis, has a pretty cool blog, and if you check out their highlighted sponsors on their Anubis github page, your based alarm should be going off. long live being a shameless furry and/or therian system in the public eye.
the fact that a program like this needs to exist is in no small part the reason the world wide web has really lost it's luster. every single HTML file uploaded to the internet is constantly being harvested, harvested, harvested. this huge, unfathomably large rototiller of gross and violent extraction. i don't want to ever consider adding such computationally expensive software to my website and i hope i never do. i hope for our sake that something dramatic happens or something better comes along.
maybe i should keep an eye on i2p.
also, something else that i just don't have the mental bandwidth to understand right now, is that as soon as you have a public IP address you are constantly, constantly being touched and fingerprinted by things, including even old as fuck things. i said this before: as much as i know that radio waves are constantly being blasted through our bodies, "the internet" still registers as this ephemeral magical thing for whatever reason
with that small rant out of the way though, what's done is done, and my A record now points to the IP address of the infomaniak VPS from a while back. i'll return to the bot bemoaning later. the only change i've made is purely informational as i don't have anything to give anyone yet.
installing pangolin, newt, and gerbil
what an awesome set of animals to enlist the aid of
| animal | function | location |
|---|---|---|
| pangolin | keeps an admin-configured list of authorized connection types (what we discussed above) and issues credentials to newt. carries none of the traffic itself. | VPS |
| newt | recieves issued credentials from pangolin and initiates contact with gerbil. * receives credentials, but never connections directly. it can't, because perch has no public IP. * newt sends one outbound packet per connection to gerbil, the same as it would if the machine were reaching out to any other website. |
perch |
| gerbil | listens for an outbound connection request from newt on ports 51820 and 21820. this is the one animal with a known public address: it's the manager and facilitator of public connections to a shared resource, in this case, this website. * i glossed over port setup in this post, but these ports are for newt and only newt specifically. * see footnote six for a minor addendum |
VPS |
i've set up one of three of these service animals: pangolin. newt and by extension gerbil have been installed but not yet configured.
i installed newt, which kicks gerbil into operation as it's a little minion already attached to the base pangolin install, it just waits for the newt to talk to it. i neglected to realize that i had to set up not one but two sets of firewall rules: one for ufw (Uncomplicated Firewall, a Linux utility) and one via infomaniak's dashboard. after sorting that out and restarting Traefik6,
traefik | 2026-08-21T03:18:26Z INF I have to go...
traefik | 2026-08-21T03:18:26Z INF Stopping server gracefully
traefik | 2026-08-21T03:18:26Z INF Server stopped
traefik | 2026-08-21T03:18:26Z INF Shutting downi'm met with this lovely enthusiastic log message from newt.
❯ sudo journalctl -u newt -n 3 --no-pager -o cat
INFO: 2026/08/20 20:18:40 Connecting to endpoint: pangolin.dumbsplash.com
INFO: 2026/08/20 20:18:41 Tunnel connection to server established successfully!
INFO: 2026/08/20 20:18:42 Client connectivity setup. Ready to accept connections from clients!drumroll please
i've scrapped the idea of documenting two hours worth of troubleshooting; this all didn't work right away, nothing ever Just Works for me; when it comes to web hosting, output can look right three ways and critically wrong in one other; Traefik has middleware called badger7, isn't that cute? ---
tah-dah
i wanted to skip to the good part, and here it is. at around 2PM PST on the day this post was published, this website officially now serves content, and has a comments server, down there.
i'm tuckered. i'm going to go take a break, now. this site at time of writing has almost 40 minutes of stuff for people to read, so i'm gonna call it here for a bit. i hope people enjoy watching my quaint little space grow as my comfort with web hosting increases.
companies are currently gambling on line going up as much as possible. AI as we all know produces Value from thin air for as long as there is still air left to breathe
virtual private server: a virtual machine that shares hardware space with other virtual machines. that's the best i can do
there is an open source self hosted version of tailscale called headscale, which would be entirely too much to learn and too much of a responsibility for me to manage myself.
transport layer security: essentially verification that a website is what it claims to be. these seem to have silently replaced SSL certificates for internet things nearly a decade ago which is news to me
definitely not. i think it's more of a CNAME thing.
including Traefik in the explanation would have ruined the cute animal thing going on. Traefik is what receives ordinary public internet traffic for actual TLS/routing work, but gerbil is still the tunnel-master for each end. you're also supposed to pronounce it "traffic", so that sentence reads: "traffic is what receives internet traffic". what a stupid name
OK, great, there's an animal