Coming soon
Video + text edition
72 lessons · ~16.3 hours
System Design on a Sovereign Stack
Design, build, scale, observe, and exit production systems without hyperscaler lock-in — one reference system, evolved section by section.
13sections
71lessons
~16.3hreading
6capstone
🎬 Watch: course introduction
What this course builds, who it's for, and how to use it — about 2 minutes.
Edition honesty: this course pairs written lessons with short video lectures — the text is the complete course, the videos teach the key ideas out loud. Work at your own pace.
Syllabus
The full curriculum, section by section
Click a section to see every lesson. Lesson links open in the learning platform once you own the course (or sign in for a preview of what's inside).
Section 1 — Why Sovereign? The Philosophy and Economics of Owning Your Stack
- The four tests of sovereignty 10 min read
- Control planes, data planes, and hidden gravity 12 min read
- Convenience has a carrying cost 12 min read
- Build vs. rent is a portfolio decision 11 min read
- The reference stack and its escape hatches 10 min read
Section 2 — Foundations: The Sovereign Reference Architecture
- Workload and service boundaries 14 min read
- Debian or Ubuntu LTS host hardening 18 min read
- The single-server Compose baseline 20 min read
- Configuration, secrets, and health 14 min read
- Backup, restore, and first runbook 14 min read
Section 3 — Scaling Compute: From One Box to Many
- Read the Saturation Signals 12 min read
- Make Application Nodes Disposable 14 min read
- Replicate Behind Caddy or Nginx 13 min read
- When Compose Runs Out 16 min read
- Move the Baseline to k3s 10 min read
Section 4 — Load Balancing, Service Discovery, and Networking
- L4 versus L7 Load Balancing 12 min read
- Caddy as the Sovereign Edge 15 min read
- Discovery in Compose and k3s 12 min read
- Private Overlays with WireGuard 14 min read
- mTLS and Failure Budgets 12 min read
Section 5 — Caching Strategies with Valkey
- Cache economics and key design 11 min read
- Cache-aside without stampedes 12 min read
- Write-through and invalidation 10 min read
- Eviction, persistence, and failure 11 min read
- Why Valkey over Redis 11 min read
Section 6 — Databases: PostgreSQL Deep Dive
- Model for invariants and access paths 16 min read
- Indexes that pay rent 16 min read
- PgBouncer and connection budgets 14 min read
- Replication and read routing 16 min read
- Partitioning before sharding 14 min read
- WAL-G backups to MinIO 19 min read
Section 7 — Messaging and Event-Driven Design
- Core NATS: subjects, queues, request-reply 13 min read
- JetStream persistence 15 min read
- Delivery semantics without mythology 13 min read
- The transactional outbox 16 min read
- When Redpanda wins 10 min read
- Schema evolution and poison messages 8 min read
Section 8 — Object Storage and Media Pipelines
- Object storage is not a filesystem 11 min read
- MinIO baseline and failure domains 12 min read
- Presigned upload and download 12 min read
- Multipart upload and completion 10 min read
- Lifecycle tiers and retention 10 min read
Section 9 — Authentication, Authorization, and Security
- Realms, clients, users, and groups 14 min read
- OIDC flows for humans and services 15 min read
- RBAC, ABAC, and policy placement 12 min read
- Secrets and key rotation 12 min read
- mTLS, segmentation, and edge hardening 12 min read
- Threat modeling and abuse cases 10 min read
Section 10 — Observability
- Metrics that answer questions 13 min read
- Prometheus scrape and recording rules 13 min read
- Grafana dashboards with a job 12 min read
- Loki logs without cardinality explosions 11 min read
- RED, USE, and SLOs 11 min read
- Alerts and runbooks 10 min read
Section 11 — Deployment, GitOps, and CI/CD
- Gitea as the source-of-truth forge 14 min read
- Woodpecker CI pipelines 16 min read
- OpenTofu provisioning 16 min read
- Bootstrap k3s without snowflakes 14 min read
- Flux GitOps reconciliation 14 min read
- Blue-green, canary, and rollback 16 min read
Section 12 — Cost Control, Capacity Planning, and the Exit Strategy
- Build a workload model 10 min read
- Capacity with headroom 10 min read
- Compare like with like 10 min read
- Rightsize and schedule 10 min read
- The portability and exit drill 10 min read
Section 13 — Capstone Projects
- Capstone method and design review 15 min read
- URL shortener 25 min read
- Real-time chat 25 min read
- Video upload and transcode 25 min read
- E-commerce backend 25 min read
- Portfolio defense and exit test 5 min read
- Capstone: Design and document a sovereign production stack 30 min read
Outcomes
What you'll be able to do
✓ Decide what to own vs. rent using the four tests of sovereignty
✓ Stand up a hardened single-server reference architecture with backups and runbooks
✓ Scale from one box to many: load balancing, service discovery, private overlays
✓ Add caching (Valkey), messaging, object storage, and a PostgreSQL deep-dive
✓ Secure the stack: auth, mTLS, secrets management, failure budgets
✓ Observe, deploy with GitOps and CI/CD, control cost — and plan an exit strategy
✓ Finish with capstone projects: a system you architected yourself
Prerequisites
Comfort with the Linux command line and basic programming concepts. No prior DevOps role required.
Instructor
Instructor bio coming soon — written by the course author.
What's included
- 72 text lessons (~16.3 hours of reading), each ending with something to do
- Exercises built into every section — applied, not theoretical
- Capstone projects with self-review rubrics — prove you can do the thing, and check your own work
- Lifetime access — buy once, keep it; founding price locked
Start building.
Self-study text edition. Opens soon — founding price locked for early buyers.
Resources
Free downloads that go with this course.
The cheat sheet is a dense reference distilled from the course lessons. The starter project is a skeleton with TODOs that map to course sections — a starting point, not a finished product.