Standing up Vault and Boundary proves you can secure infrastructure. Shipping an application through it — with its own SSO login, its own secrets, its own release pipeline — proves you can operate it for something that has to work for someone else. This is that application.
A FastAPI backend and a React frontend, deployed to the same Kubernetes cluster shown in the infrastructure diagram — not a sandbox namespace, the same cluster, behind the same ingress, trusting the same certificate authority.
Structured daily logging with a deterministic progression engine — rule-based load recommendations computed from logged RPE and technique, not a model guessing.
A food photo is analyzed against a third-party LLM API for a nutrition estimate; a scheduled job compiles a weekly report the same way. The API key never touches a manifest — it's delivered as a Kubernetes secret sourced from the same secrets store as everything else.
Progress photos are proxied through the backend into an in-cluster object store — never a public presigned URL, never exposed directly.
Login is OIDC against the same identity provider that fronts every other internal application — one account, one session model, everywhere.
The request never touches a port opened on a home network — it arrives through an outbound-only Cloudflare Tunnel running inside the cluster itself. The dashed line is the only place a credential changes hands with the outside world — a login redirect to the identity provider. Everything after that is a session token, not a password.
No manual kubectl edits, no hand-run SQL. A change to the application is a change to Git, run through this sequence.
Backend and frontend each build to a versioned container image.
Images never leave infrastructure I control — no public registry dependency.
Kubernetes replaces pods without downtime; the previous version stays up until the new one is healthy.
Database changes run as an explicit, versioned migration step — never an ad hoc statement against production.
The release isn't done until the application confirms it's actually serving traffic correctly.
The third-party API key is a Kubernetes secret sourced from the same vault as infrastructure credentials — never a plaintext env var in a repo, never hardcoded in an image.
The application's login is the same identity provider and session model as every operational tool in the stack — one fewer identity system to secure, not one more.
Every deploy follows the identical five-step sequence — nothing about shipping this application is tribal knowledge.
Securing a platform nobody uses is an exercise. This is infrastructure put under load by a real, daily-used application.
Same cluster, same certificate authority, same identity provider as the infrastructure overview — this isn't a demo environment bolted on the side.