Bringing this website home

A small public surface

The site is static HTML, CSS, and JavaScript served by Nginx. Cloudflare handles public HTTPS, and Cloudflare Tunnel connects it to the local web service. The origin listens only on the machine itself. I did not need to open a router port for visitors to reach it.

1. 1. Public HTTPSCloudflare receives the visitor's request.
2. 2. TunnelThe connection reaches the local web service.
3. 3. Static releaseNginx serves pages and approved audio.

That is the delivery path for this implementation, not a claim that a tunnel removes every operational risk. The site still depends on a home machine, power, and an internet connection.

Publishing is a separate decision

Gabrielf Studio keeps original recordings and working metadata in a local file catalog. Importing a recording or drafting its description does not publish it. The public audio export accepts reviewed items, verifies their assets, and builds a complete release before switching the active version.

The listening room exposes audio-only copies. The public web service does not mount the private preview directory, and original media and review notes are excluded from the export. The homepage and recording pages can work without JavaScript; the player adds track selection without autoplay.

What I check before switching

I check the generated pages in a browser, test playback and seeking, compare the published audio checksums and byte ranges, and verify that private preview paths are not reachable publicly. Previous releases are retained for rollback. The base website assets are served separately, so restoring an old release also means restoring its matching HTML, CSS, and JavaScript.

The result is a small publishing system I can inspect as ordinary files. It is also a useful constraint: working material stays local until I deliberately turn it into a public release.