Technology — Andy Denley

One front-end stack, three products

FrameworkNext.js 16 · React 19 · TypeScriptApp Router, server-rendered pages, standalone container builds. Fully typed codebases end to end, with Tailwind CSS for styling. This site, SouthpawStrings, and the orchestrator’s dashboard all share it.

In-house library@denley/desk-engineThe window-manager engine extracted from SouthpawStrings, consumed by all three sites from a private npm registry — the desktop you may be looking at right now. Read the case study.

DataPostgreSQL 16, run properlyCloudNativePG high-availability clusters with WAL archiving and point-in-time recovery for the products that need a database; encrypted fields with blind indexes where user data is sensitive.

AI, gatedEngineer-led AI deliveryAI agents accelerate the engineering across every repo here, inside guardrails: human review, approval gates, and evidence trails. The AI Orchestrator is that principle built as software.

Self-hosted, zero-trust, isolated

Everything runs on self-hosted Kubernetes (k3s) in a home lab, with public traffic entering only through Cloudflare Tunnels — no inbound ports, no exposed origin. Public-facing workloads live in an isolated DMZ network segment that cannot reach the rest of the LAN, so a compromised site is a contained site. Private surfaces sit behind Cloudflare Access zero-trust sign-in.

The software supply chain is self-hosted too: a Gitea instance carries every repository, runs CI, builds container images, and serves the private npm registry that distributes desk-engine. Deployments are digest-pinned images applied by guarded scripts that preview by default and demand explicit confirmation to touch production — every release paired with a version bump and a changelog entry.

Observability is home-built as well: a FastAPI/Vue monitoring dashboard watches the sites, certificates, DNS, and media pipelines from inside the LAN, and first-party Umami analytics (proxied same-origin, no third-party trackers, do-not-track respected) count page views without following anyone around the web.