The project
What it is
Road to CISSP is a study platform that starts at IT fundamentals and works up to the CISSP. It's built around guided tracks and career paths, in React with Three.js for the visual lab. Each lesson has an overview, a Learn section and a cheat sheet, plus flashcards, practice exams, hands-on labs and an AI tutor you can ask while you study.
It started on 2026-07-16 and has had about 120 commits since. The last week has been the busiest.
- Frontend
- React · Vite · Tailwind
- Backend
- FastAPI · PostgreSQL
- Hosting
- Vercel + homelab VM
- Sign-in
- Google / GitHub OAuth
How it's put together
The backend
The API runs as a systemd service on FedServ, a Fedora Server VM on the second Proxmox node. It's published the same way as this site: a named Cloudflare Tunnel dials out from the VM, so no inbound ports are open. The frontend on Vercel reaches it through VITE_API_BASE_URL.
- Auth. OAuth sign-in through the backend, which sets an HttpOnly session cookie. No token ever reaches
localStorageor browser JavaScript. The dev-only owner login is behind a flag that production never sets. - AI tutor.
POST /api/ai/tutorstreams answers over SSE. It's for signed-in learners only, with a per-user rate limit. - Labs. Each lab runs on one of two providers:
mock, a simulation used by default, ordocker, which runs real containers and is opt-in per lab once that lab's image is published. - Progress sync. Progress is stored on the server with optimistic concurrency (
If-Match), so two open tabs can't silently overwrite each other. - Billing. Stripe Checkout, webhooks and subscription status, with premium content gated on the subscription.
Recent work
This week's push
- Security+ (SY0-701). A 90-question, 90-minute practice exam scored by domain weight, plus 448 new flashcards across all five domains.
- Seven new tracks. Rust, Go, C++, SQL, Docker, Kubernetes and Terraform: 58 lessons in total. DevOps, Software Development and Data & Databases career paths use them.
- Four interactive labs. Pentesting methodology, Docker, Kubernetes and Terraform fundamentals: 31 objectives checked by 153 tests.
A broken build
A merge left conflict markers in committed files, and the site returned 502 until they were found and removed.
What's open
Next
An automated site audit on 2026-10-06 found that every URL serves the same client-rendered shell. To a search engine, all 15 sitemap pages look like one page with no text. The fix is to prerender the public routes and give each one its own title, description and canonical URL. Analytics and link-preview images come after that.
