How this site works

A server-rendered shell plus small independent modules, all behind a single gateway. Each module is its own container, in whatever language suits it.

Design ideas

One front door. Only the gateway publishes ports. Every other container sits on an internal network and is addressed by service name.
HTML over the wire. Pages are rendered on the server and modules answer with small HTMX fragments, so there is no front-end build step or client-side app state.
Untrusted input has one door. Uploaded files are parsed only by the Rust ingest service, in short-lived child processes with memory and time limits. Downstream services receive plain decoded pixels.
Small blast radius. The processing services run with read-only root filesystems, dropped capabilities, and CPU, memory and process limits.
Pluggable modules. A new module is a container with GET /health, a handle block in the Caddyfile, and a dependency on the gateway.

The browser requests a page. The gateway terminates TLS and forwards anything it doesn't recognise to the shell.
The shell renders a Thymeleaf template inside the shared layout and returns HTML.
CSS, htmx, images and the WebGL projects come straight from disk through the gateway's /static/* handlers, without touching the shell.

The PRNU form posts up to six photos to /api/prnu/analyze. The gateway rate-limits per client (IPv6 grouped by /64) and caps the request body. In production it also asks the shell to verify a Cloudflare Turnstile token before any upload byte is forwarded.
The gateway sends that one route to ingest. It streams the multipart body, checks magic bytes and headers, then decodes each file in a sandboxed child process.
Ingest forwards only decoded pixels and a few sanitised strings (make, model, serial) to PRNU's /internal/jobs. The gateway answers 404 for /internal/*, so this path is service-to-service only.
PRNU starts a job in a fresh process and returns a status fragment. HTMX polls /api/prnu/jobs/<id> every second, and those requests go straight to PRNU.
When the job finishes, the result fragment replaces the status and polling stops. Pixel data is deleted when the job ends, and jobs expire after 15 minutes.

The rendering detail page loads a widget from /api/renderer/{program} with HTMX. Changing the scene or size picker re-requests the fragment.
The Go server accepts only GET, and visitors choose a scene by name from scenes.json and a scale from a fixed list. Nothing they send reaches the C code.
On a cache miss, the server renders in a temp directory under prlimit and a timeout, one render at a time by default.
Renders are deterministic, so results are cached in memory. Every scene is also pre-rendered in the background at startup.

The shell reads projects.json to build the gallery.
A project page frames /static/rendering/<slug>/<entry>.html in an iframe. The files are plain WebGL2 pages that share one copy of the helper scripts.
Only /static/rendering/* may be framed, and only by this site. Every other response is sent with X-Frame-Options: DENY.

The gallery is rendered by the shell from metadata in the media volume.
/admin/* sits behind a single bcrypt-hashed login (Spring Security). The gateway rate-limits login attempts and allows uploads up to 1 GB.
The shell writes each upload as .part, validates the header, then renames it to a random hex id with a JSON metadata file. It is the only writer of the volume.
The gateway mounts the volume read-only and serves /media/* for hex-named media files only. Metadata and in-progress files return 404, and files are cached as immutable because a new upload always gets a new name.

Module	Stack	Public routes	Protections
gateway	Caddy	everything	TLS, per-route rate limits, body size caps, security headers
shell	Java, Spring Boot, Thymeleaf	`/`, `/admin/*`	admin login, 512 MB memory limit
ingest	Rust	`POST /api/prnu/analyze`	sandboxed decode, pixel and size limits, fuzz-tested, read-only fs
prnu	Python, FastAPI	`/api/prnu/jobs/*`	no image decoders, process per job, tmpfs scratch, read-only fs
renderer	Go, C	`GET /api/renderer/*`	fixed scene list, rlimits, timeout, read-only fs
rendering, game	WebGL2, C++/WASM	`/static/rendering/`, `/static/game/`	static files only, read-only mounts