// A FIELD EXPERIMENT IN RUNNING YOUR OWN CORNER OF THE INTERNET

THE WHOLE
STACK,
OWNED.

This page is served from a small kubernetes cluster at home, through our own addresses, our own autonomous system, and our own nameservers — to learn how anycast, multihoming and BGP actually behave when you hold all the pieces yourself. Rented: wires and names. Owned: the rest.

FIG. 1 REQUEST PATH

TAB. 1 SYSTEM INVENTORY

ROUTING: BIRD 2 · BGP to upstream · RPKI-valid ROA · one AS of our own: 154742
ADDRESSES: IPv6 /48, APNIC-assigned · IPv4 /24 announced (203.24.209.0/24) — anycast: nameservers .1 / .2, web .4
DNS: Knot · ns.oddie.sg + ns.oddie.ch — two names, two TLDs, two registries, one anycast fleet · DNSSEC, single CSK, ECDSA P-256
EDGE OS: Flatcar, immutable · daemons as systemd-sysext images · a full reinstall is one pasted Ignition file, zero manual steps
CACHE: Caddy + Souin at the edge · TLS terminates there · the assets on this page are cache hits and never travel home
TUNNEL: WireGuard, edge <-> living room · the origin has no public entrance of its own
WATCH: Gatus on the edge · public resolvers as canaries · alerts by Telegram and mail
THIS PAGE: hand-written HTML/CSS · two self-hosted fonts · zero external requests, zero cookies · one inline script (the FIG. 2 live readout — asks our own edge, tells only you)

MEMO WHY BOTHER

Because the interesting parts of the internet — who may announce which addresses, why packets take the route they take, what breaks when a link dies — are invisible from inside a rented cloud. Announcing one prefix from several places and watching half the world arrive at each is the kind of lesson you can only buy with your own ASN.

As of now there are two edges — Singapore and Los Angeles — announcing the same /48. Asia lands in Singapore, the Americas in LA, the same URL either way. The x-oddie-edge header below tells you which one answered you.

Next: a European edge, so three continents each get their own; then the LA edge gets its own tunnel home; then the IPv4 /24 goes live, the home LAN gets real public addresses, and the last rented pieces retire.

MEMO WHAT SOVEREIGN MEANS HERE

The addresses are registry-assigned to us, not leased from a host. A provider can cancel a server; the /48 and AS154742 move to the next wire unchanged. The nameserver names live under two TLDs, at two registrars, in two jurisdictions — no single decision removes both. Keys — DNSSEC, WireGuard, TLS — are generated here and stay here.

The remainder is rented because it has to be, or because it has to be elsewhere. Transit is a relationship, not a possession — peering reduces it, nothing removes it. Every domain name is an entry in someone's registry; ours are spread across two so neither is a single point of decision. The edge VMs could become owned hardware in a rack — that swap costs money, not architecture.

1Password and Telegram stay external on purpose: the keys that restore this platform and the alarm that watches it must not share a failure domain with it. Everything else runs on machines we can touch.

TAB. 2 GLOSSARY

AS / ASN: A network with its own routing identity. Ours: 154742.
BGP: How networks tell each other which addresses live where. No central authority — announcements, trust, and filters.
PREFIX: A block of addresses announced as one unit. Here: 2001:df7:2b40::/48.
ANYCAST: The same prefix announced from several places. Routing takes each visitor to the nearest copy — no load balancer involved.
MULTIHOMING: More than one way in. A link dies, the announcement stays, traffic reroutes on its own.
RPKI: A signed statement of which AS may announce which prefix. Hijacked announcements get dropped at the border.
DNSSEC: Signatures on DNS answers, so a resolver can verify nobody rewrote them in transit.

FIG. 2 SEE FOR YOURSELF

$ curl -s -D - -o /dev/null https://www.oddie.app | grep -iE 'cache-status|x-oddie-edge'
x-oddie-edge: sgp-01   ← or lax-01, depending where you are
cache-status: Souin; hit; ttl=…

Which edge answered you, and whether your copy came from cache. A GET, not curl -I — the cache refuses bodyless HEAD responses, so a HEAD always reads as a miss. Run it from Asia and from the Americas — the first line changes. That's anycast: same address, nearest edge.

// OR LET THE PAGE ASK FOR YOU — LIVE, THIS VISIT

EDGE: …
YOU: …
YOU HIT: …
THIS COPY: …

And to feel the difference: skip every cache — fetch this page fresh from the living room ↻ (a timestamped URL no cache has seen; the miss travels the whole FIG. 1 path).

Odette, a long-haired ginger cat, in front of her networking equipment. Rendered as a 1-bit dithered halftone. — FILE THE NAMESAKE

NAME
Odette

ROLE
Supervisor, machine room

COAT
Long-haired ginger, just like her daddy

ACCESS
Root. Unrequested, irrevocable.

NOTES
The platform is named after her. She sits beside the servers and tolerates the fan noise. Original photograph available to cache-warm visitors: odette.jpg

THE WHOLESTACK,OWNED.