Built for privacy, reliability, and multi-cloud portability. Every architectural decision reflects a deliberate trade-off between simplicity, security, and operational control.
Internet
│
▼
┌─────────────────┐
│ Cloudflare │
│ Edge (TLS) │
└────────┬────────┘
│ Tunnel (outbound-only)
▼
┌───────────────────────────────────┐
│ VM · GCP / Azure / AWS │
│ │
│ ┌──────────┐ ┌───────────────┐ │
│ │ allerac │ │ PostgreSQL │ │
│ │ app │ │ + pgvector │ │
│ └──────────┘ └───────────────┘ │
│ │
│ ┌──────────┐ ┌───────────────┐ │
│ │ Ollama │ │ Prometheus │ │
│ │ (LLM) │ │ Loki Grafana│ │
│ └──────────┘ └───────────────┘ │
│ │
│ ┌────────────────────────────┐ │
│ │ Telegram Bot · Webhook │ │
│ └────────────────────────────┘ │
└───────────────────────────────────┘
▲
│ git push → deploy
GitHub ActionsAll public traffic is routed through Cloudflare Tunnel (cloudflared). The tunnel creates an outbound-only encrypted connection from the VM to Cloudflare's edge — no inbound ports are opened on the firewall, no public IP needs to be exposed for the application.
The monitoring stack runs entirely on the VM alongside the application — no external monitoring service dependency. Logs and metrics stay on the machine, cost nothing extra, and work even without internet access.
Ollama runs LLM inference directly on the VM. No prompts, conversations, or user data are sent to external AI providers unless explicitly configured. This is the foundation of the privacy model: the AI runs where the data lives. Models are pulled once and stored in a persistent Docker volume, surviving deploys and restarts.
The application container is fully stateless — it can be stopped, rebuilt, and restarted at any time without data loss. All persistent state lives in external Docker volumes.
The entire infrastructure is defined in Terraform, split across three clouds (GCP, Azure, AWS) with identical structure. Switching clouds is a terraform apply in the target directory. DNS records are managed by Terraform and point to Cloudflare Tunnel IDs — switching a cloud updates the DNS automatically.
Each VM runs a GitHub Actions self-hosted runner, labeled by cloud (gcp, azure, aws). Deployments are triggered by pushes to main and run directly on the target VM — no external CI service required. The webhook service receives GitHub push events, validates HMAC-SHA256 signatures, and triggers the update script, which pulls the latest code and restarts only the containers that changed.
The application stack uses Docker Compose profiles to adapt to the environment without maintaining separate compose files. The exact same docker-compose.yml runs correctly on a developer laptop, a GCP VM, an Azure VM, and an AWS EC2 instance — with no modifications.