clx.ad

A single machine, run deliberately — nginx in front, TLS on everything, and one small privileged core that can be read in an afternoon.

• edge

  nginx, tested per write

  Every vhost is rendered from a registry and validated before it is allowed to load.

• control

  An agent on a socket

  No daemon on the network. Nothing here listens that does not have to.

• change

  Every write is audited

  One line per mutation, with the before and after of anything it touched.

• recovery

  Releases, not overwrites

  Deploys land beside the last one and a rollback is a symlink away.