01Live health
A new measurement every 5 seconds| Loading… |
02How this page reached you
One request, four stopsCloud DNS
this domain resolves to the VM's static IP.
Firewall + TLS
Only 80 and 443 are open. Caddy terminates HTTPS with a Let's Encrypt certificate.
VM web-1
A Python service on 127.0.0.1:8080, running as an unprivileged user.
Private bucket
The page and files are read with a read-only service account. No keys on the VM.
03Security by design
What protects this serviceHTTPS only
HTTP redirects to HTTPS. HSTS, nosniff and frame-deny headers on every response.
Read-only identity
The VM's service account can read one bucket. Writing, deleting or any other API returns 403.
Private storage
Public access prevention is enforced on the bucket. Files are only reachable through the service.
Closed network
Custom VPC. SSH is not open to the internet, only through Google's Identity-Aware Proxy.
Hardened VM
Shielded VM with Secure Boot, OS Login, and a systemd sandbox around the app.
Locked certificates
A CAA record allows only Let's Encrypt to issue certificates for this domain.
04Architecture
Open the detailed diagram05Files in the bucket
Served by the VM; the bucket itself returns 403| Loading… |