Cesar Petrescu

Work

PhotonSpark Hosting Platform

I built this to replace hand-run, cPanel-style provisioning. You point it at a Git repo or upload an archive. It builds an immutable release, runs it on Kubernetes with TLS and DNS, and keeps every earlier release ready to switch back to. I designed, built and run it alone.

Runs PhotonSpark’s own sites, including this one. Customer hosting is still on the legacy cPanel stack.

How it works

From a repository to a routed, recoverable release

  1. Declare
  2. Build
  3. Reconcile
  4. Recover

Step 1 of 4 · React · Go API · PostgreSQL

Declare

You create a site or app, choose Git or an upload, add domains, and optionally ask for a Postgres database or a tunnel to a private origin. The Go API checks ownership, stores the desired state and queues a durable job.

Step 2 of 4 · Git workers · S3 · Checksums

Build

A worker builds and packages the source, checksums it, and stores it in S3-compatible storage as an immutable release. Uploads take the same path.

Step 3 of 4 · Kubernetes · Gateway API · Cilium

Reconcile

A Kubernetes operator turns desired state into workloads, Gateway API routes with TLS, Cilium policies between tenants, the optional database, and DNS records in PowerDNS or Cloudflare.

Step 4 of 4 · Observability · Snapshots · Rollback

Recover

Health, logs, usage and release history sit on the resource’s own page. Rolling back activates an earlier release; nothing is rebuilt.

System map

  • Request
  • Engines
  • Data
ClientsClientsEdgeEdgeCoreCoreEnginesEnginesDataDataHosting dashboardsites + apps + DNS + dataHosting dashboard — sites + apps + DNS + dataGit repositoriesbuild and deploy sourceGit repositories — build and deploy sourcePrivate originLAN / workstation / servicePrivate origin — LAN / workstation / serviceGateway APIHTTP routing + TLSGateway API — HTTP routing + TLSDNS providersPowerDNS + CloudflareDNS providers — PowerDNS + CloudflareGo control planeauth + lifecycle + policyGo control plane — auth + lifecycle + policyKubernetes operatordesired-state reconciliationKubernetes operator — desired-state reconciliationBuild workersGit + artifact jobsBuild workers — Git + artifact jobsStatic runtimeverified release artifactsStatic runtime — verified release artifactsApplication runtimefrontend + backend workloadsApplication runtime — frontend + backend workloadsSparkTunnelHTTP + WebSocket originsSparkTunnel — HTTP + WebSocket originsPlatform PostgreSQLownership + releases + jobsPlatform PostgreSQL — ownership + releases + jobsApp DB workspacesschema + rows + snapshotsApp DB workspaces — schema + rows + snapshotsS3 artifactsbuilds + releases + exportsS3 artifacts — builds + releases + exports

Tap a service to see what it calls and what calls it.

Clients

Edge

Core

Engines

Data

Decisions

Activate releases, never rebuild them.
A rollback switches to an artifact that already exists, so it can’t fail on a broken build or an unreachable dependency.
Jobs live in Postgres.
Builds and reconciles are durable jobs with real state, so the dashboard never reports a deploy as finished before it is.
An operator, not deploy scripts.
Desired state lives in custom resources, so drift is corrected on the next reconcile.
Tenants are isolated at the network layer.
Cilium policies stop one tenant’s workloads from reaching another’s apps or databases.

Not done yet

  • Moving customers off cPanel.
  • The Rust/Tauri desktop connector for SparkTunnel is a scaffold.

Stack

Go · Kubernetes · Gateway API · Cilium · PostgreSQL · S3-compatible storage · PowerDNS · Cloudflare · React