TR Travis Rousseau Photographer + web systems
Technical notes
Technical Note

Operating the systems behind the site

Rousseau.tv is the visible layer. Behind it sits real infrastructure: cloud-provisioned static sites, a self-hosted Linux server fleet, backups with restore testing, and monitoring, run the way production is run.

June 29, 2026 5 focus areas
Linux / NixOSAWSNetworkingBackups & DRObservability

Why this note exists

Most of this site is photography and the systems that publish it. This note covers the part that does not show up on a page: the infrastructure those properties actually run on, and how it is operated. It is written at the capability level (what the stack does and how it is kept reliable), not as a configuration dump.

Cloud properties

The public sites are static-first and provisioned as code, not clicked together in a console:

  • AWS for delivery: S3 origin, CloudFront CDN, Route 53 DNS, and a WAF in front.
  • Builds run through checks (links, privacy, performance, layout) before anything ships.

Self-hosted fleet

Alongside the cloud properties, a small Linux server fleet runs on NixOS, with a server and several workstations defined declaratively from one source of truth. Reproducible configuration means a machine is a build artifact, not a snowflake. Core services it provides:

  • DNS: a self-hosted resolver with local resolution and encrypted upstream (DoH/DoT).
  • Networking: a mesh VPN for secure remote access, and a reverse proxy that terminates TLS with automatically renewed certificates.
  • Access: key-based SSH and least-privilege accounts on the fleet; AWS IAM for cloud resources.
  • Virtualization: KVM/QEMU plus containers for isolated workloads.
  • File services: SMB/NFS shares with encrypted (LUKS) storage on a checksumming filesystem.

Backups and disaster recovery

Recovery is designed in two layers, not bolted on:

  • Scheduled backups on the server with defined targets and retention, plus replication between machines.
  • For cloud-hosted data, automatic volume snapshots with a documented storage budget and retention thresholds.
  • Restores are tested, not assumed: a backup that has never been restored is a hypothesis.

Observability

Metrics and dashboards (Prometheus and Grafana) make the fleet legible, so a problem is something you notice early rather than discover during an outage.

How it is run

The whole thing is documented in runbooks and troubleshooting notes, kept reproducible, and changed deliberately. That is the actual job: keep a small set of systems boring, recoverable, and easy for the next person to understand.