Titan is Saturn's largest moon — a world of nitrogen skies and methane seas, stranger and more alive than anything we expected. This machine shares its name. A single ARM core in Oracle's Sydney region, carrying everything that runs under the cckit.au banner.
titan runs on Oracle Cloud Infrastructure's ARM A1.Flex — perpetually free-tier compute in the ap-sydney-1 region. ARM64 architecture. Unexpectedly capable.
| Machine | OCI ARM A1.Flex (free tier) |
| Architecture | ARM64 (aarch64) |
| OS | Ubuntu 24.04 LTS (Noble) |
| Region | ap-sydney-1 · Sydney, Australia |
| Public IP | 161.33.224.188 |
| Tailscale IP | 100.93.113.80 |
| Operator | ubuntu (UID 1001) |
| Domain | cckit.au |
SSH never touches the public internet. The only door into titan is Tailscale — a WireGuard-based mesh VPN that makes this server appear at 100.93.113.80 from any trusted device, regardless of location. The public firewall drops everything except port 443. The wormhole is the only door.
Every service on titan runs in a Docker container. All containers are citizens of one internal network: cosmos. Compose stacks live under /opt/. The Docker socket is mounted into Nova — GID 988 — giving the control plane full visibility over the fleet.
Caddy is titan's single entry point for all web traffic — a custom build with the caddy-dns/cloudflare module for DNS-01 TLS. Wildcard certificates, zero open ports for ACME validation. Every subdomain resolves containers by name on the cosmos network.
Gatus watches titan's core services from within the cosmos network, polling every 60 seconds. Full status at gatus.cckit.au.
A nova is a stellar explosion — a star that suddenly becomes luminous beyond measure. Nova is titan's AI operating interface: a Telegram bot backed by five specialised agents that make this server fully operable through natural language. Every message is triaged by Beacon, routed to the right agent, and stored in ChromaDB for persistent memory.
Forge deserves special mention. Given a single message — "build a countdown timer" — it writes the code, adds the Caddyfile entry, creates the Cloudflare DNS record, and reloads Caddy. Fully autonomous.
ChromaDB (v1.0.0) provides vector storage for Nova's memory. Every exchange is embedded in the nova_memory collection and retrieved by cosine similarity — so Nova remembers what you've built, what broke, and what was fixed.
Ollama runs locally on ARM64 CPU serving gemma3:1b — light enough for the free tier, fast enough for real-time triage. No API calls, no latency, no cost.
| Vector DB | ChromaDB 1.0.0 · HTTP server mode |
| Collection | nova_memory · cosine similarity |
| LLM Runtime | Ollama · ARM64 CPU |
| Model | gemma3:1b |
| LLM Purpose | Beacon triage / intent classification |
Apps deployed to titan live under /home/ubuntu/projects/ — containerised, connected to cosmos, routed by Caddy, DNS registered automatically. One Telegram message from concept to live URL.
All traffic to cckit.au passes through Cloudflare first — DNS, DDoS absorption, outer filtering. TLS terminates at Caddy via certificates issued through the Cloudflare API. Nova's Forge creates DNS records automatically on every deploy.
titan runs a double firewall. OCI Network Security Groups at the hypervisor level, then UFW on Ubuntu. Both must clear a connection for it to land anywhere. Port 80 closed — Caddy uses DNS-01, HTTP validation never needed.
| Outer Layer | OCI Network Security Groups (NSG) |
| Inner Layer | UFW (Ubuntu Firewall) |
| Inbound Open | 443 (HTTPS) · Tailscale UDP 41641 |
| SSH | Tailscale network only — no public exposure |
| HTTP 80 | Closed — DNS-01 requires no open port |