Cane Infographic · Hosting Topology

One asset tree, four ways to serve it

The site is built once into a single relative-path asset tree, then served from four independent origins. Every origin resolves the same paths, so any page can fall back to another origin's bytes when its primary is unreachable.

build bf2c83f82c26 CID bafybe…u2in5q dist 3.5 GB · 2,634 files as of Jul 10, 2026

The single source of truth

The default bun run build (hybrid mode) emits relative asset URLs and packages everything — SPA shell, exhibit PDFs, and all narration/courtroom audio — into dist/. Because links are relative, the same tree resolves whether it is served at a subpath (/bf2c83f82c26/ on Vercel), under a CID (/ipfs/<cid>/), or at the root of a Worker.

src/ + assets/ → bun run build (hybrid) → dist/ — relative paths ⇒ CF · IPFS · VPS · Vercel

The four serving origins

Cloudflare Worker + R2

Centralized · free tier

HoldsAll assets in R2 (system of record), keyed by relpath. Small/hot files also fronted by Workers Static Assets for edge cache.
ServesWhole site from one Worker; range/streaming for audio; SPA fallback.
Cost3.5 GB < 10 GB free · $0 egress
Statebuilding preview

IPFS / IPNS

Decentralized

HoldsContent-addressed CID bafybe…u2in5q; IPNS k51qzi…003b5ls → latest CID.
Servesservices.atsignhandle.xyz/ipfs (→ spark-1 kubo), ipfs.io, dweb.link, inbrowser.link.
Audiovia Pinata CIDs + media-dir CIDs on the atsign gateway.
Statelive · verified

VPS (Hostinger)

Independent origin

HoldsKubo node — CID pinned + fully local (2,580 blocks). Byte-cache 489 files (2.8 GB).
ServesSwarm :4001 (provider/pinner) + byte-host cane.files.atsignhandle.xyz/files/<sha256>.
LatentContainer HTTP gateway :8080 works but is not routed publicly — one traefik rule would expose it.
Statelive gateway not exposed

Vercel

Current production

Holds--gateway build: SPA + 139 PDFs (371 MB). No audio (Vercel 100 MB/file + 1 GB deploy cap).
Serveskyleen-cane.xyz/bf2c83f82c26/ (apex → Vercel anycast).
Audiofalls back to the Pinata / atsign / VPS cascade.
Statelive

How the assets are organized on CF

R2 is the system of record for every asset — the whole 3.5 GB tree, each object keyed by its served relpath (identical to the path the built SPA requests). The Worker serves the centralized site from R2, and because the same keys are relpaths, an R2 public custom domain turns R2 into a byte-host any other origin can borrow from. Workers Static Assets optionally fronts the small, hot files for free edge caching — but nothing depends on it: R2 alone can serve the entire site.

Layer	Contents	Files	Size	Why
R2 — complete tree	Every asset, keyed by relpath (system of record + universal byte-host)	2,634	3.5 GB	Single store; free tier; serves any origin
↳ oversized (uploaded)	15 mp3 + 7 pdf > 25 MiB	21 / 22	1.84 GB	Exceed the 25 MiB static-asset cap
Workers Static Assets	SPA shell, data JSON, fonts, PDFs + audio ≤ 25 MiB	2,612	1.66 GB	Free edge cache for hot paths (optional layer)

Free-tier math. R2 storage 3.5 GB < 10 GB free · egress $0 · Class-B reads 10 M/mo free. Hosting the entire site + all audio + all PDFs on CF is free at this scale.

Cross-origin cascade — how any instance borrows bytes

Each resource declares its hosts; the client probes them in order and drops to the next when one fails. This is why a page served from IPFS can still pull a PDF or audio file from CF/R2 or the VPS — the bytes are content- or path-addressed and origin-independent.

Same-origin
The page's own host — relpath on Vercel, CID subpath on IPFS, or the Worker root.
CF / R2 to be wired
R2 public domain, keyed by relpath. New universal byte-host — reachable from every instance, free egress.
Pinata
Per-file CID on its dedicated gateway (multi-account).
dweb.link / atsign
Any IPFS CID via public dweb.link or service.atsignhandle.xyz (spark-1 kubo).
VPS byte-host
cane.files.atsignhandle.xyz/files/<sha256> — survives IPFS/Pinata/Vercel all being down.
Embed (last resort)
Opaque remote player (SoundCloud) for audio with no byte copy, e.g. the 245 MB Wallace deposition.

Routing facts (verified via DNS, Jul 10)

Hostname	Resolves to	Fronted by	Origin	Role
kyleen-cane.xyz	64.29.17.1	Vercel anycast	Vercel	Production site
services.atsignhandle.xyz	104.21.50.212	Cloudflare proxy	Tunnel → spark-1 kubo	IPFS gateway
service.atsignhandle.xyz	104.21.50.212	Cloudflare proxy	Tunnel → spark-1 kubo	IPFS gateway (alias)
cane.files.atsignhandle.xyz	72.60.25.146	direct A-record	VPS traefik → :3900	Byte-host `/files/<sha>`
ipfs.kyleen-cane.xyz	104.21.77.138	Cloudflare proxy	not VPS — no traefik rule	Legacy · deprecated

Answer: no — ipfs.kyleen-cane.xyz/ipfs does not route to the VPS. It sits on Cloudflare proxy IPs, and the VPS has no traefik router for it. The VPS's only public HTTP host is the byte-host cane.files.atsignhandle.xyz (direct to 72.60.25.146). The VPS kubo gateway :8080 is functional but unrouted — exposing it (or repointing ipfs.kyleen-cane.xyz at the VPS) would make the VPS a full IPFS HTTP gateway.