update /now page

1 files changed, 39 insertions, 40 deletions

diff --git a/content/uses/index.org b/content/uses/index.org
index 2abe758..7192c2d 100644
--- a/content/uses/index.org
+++ b/content/uses/index.org
@@ -2,9 +2,8 @@
 #+slug: index
 #+options: toc:nil
 
-Tools powering this site and the infrastructure behind it. Each entry includes
-a threat model justification and an exit strategy. ~TECHNICAL DEBT~ flags items
-with no clean migration path or active sovereignty risk.
+Tools powering this site and the infrastructure behind it. Each entry includes a
+threat model justification.
 
 * Philosophy
 
@@ -15,49 +14,49 @@ with no clean migration path or active sovereignty risk.
 
 * Software
 
-| Technology            | What I Use            | Threat Model                                                           | Exit Strategy                                                                                                |
-|-----------------------+-----------------------+------------------------------------------------------------------------+--------------------------------------------------------------------------------------------------------------|
-| Registrar             | [[https://njal.la][Njalla]]                | Registers domains on your behalf. No WHOIS identity exposure.          | Any registrar accepting anonymous payment. Portable.                                                         |
-| DNS                   | [[https://njal.la][Njalla]]                | Same as above. DNS records are portable on day one.                    | Self-hosted BIND or any other provider.                                                                      |
-| Security              | [[https://github.com/fail2ban/fail2ban][fail2ban]]              | Automated auth-failure bans. No cloud WAF. No data leaving machine.    | nftables rate limiting or self-hosted crowdsec.                                                              |
-| Routing               | [[https://ui.com/][UniFi]]                 | Local network segmentation. Controller must run self-hosted.           | ~TECHNICAL DEBT~ - cloud dependencies by default. OpenWrt on compatible HW.                                    |
-| Server                | [[https://cleberg.net/blog/server-build.html][Self-hosted]]           | Physical control. No hypervisor escape vector. No subpoena to a DC.    | N/A. This is the exit strategy.                                                                              |
-| Operating System      | [[https://ubuntu.com][Ubuntu]] + [[https://www.apple.com/os/macos/][macOS]]        | Ubuntu: telemetry off, LTS, stable. macOS: workstation only.           | Ubuntu → Debian. macOS → ~TECHNICAL DEBT~. Target: NixOS/Fedora on ThinkPad or Framework.                      |
-| Web Server            | [[https://nginx.org][Nginx]] + [[https://community.torproject.org/onion-services/setup/][Tor]]           | Static file serving. Tor layer for censored-network access.            | Caddy or lighttpd. Tor is already the exit layer.                                                            |
-| SSL                   | [[https://certbot.eff.org][Certbot]]               | Free automated TLS. No commercial CA dependency.                       | acme.sh. Same protocol, no Python dependency.                                                                |
-| Static Site Generator | [[https://github.com/emacs-love/weblorg][Weblorg]] + [[https://git.sr.ht/~ccleberg/cleberg.net/tree/main/item/build.py][build.py]]    | Org-mode source compiles to plaintext HTML. No JS build chain.         | Pandoc + shell script. Source files survive any generator change.                                            |
-| Terminal              | [[https://iterm2.com/][iTerm2]]                | Functional. Inherited from macOS.                                      | ~TECHNICAL DEBT~ - macOS-only. Target: foot or Alacritty on Linux.                                             |
-| Shell                 | [[https://www.zsh.org/][Zsh]]                   | Portable, POSIX-adjacent, available on every target OS.                | bash or fish. Config is plain text.                                                                          |
-| Editor                | [[https://github.com/doomemacs/doomemacs][Doom Emacs]]            | Editor and markup are the same tool. No proprietary format.            | Vanilla Emacs + org-mode. Doom is a config layer only.                                                       |
-| Markup Language       | [[https://orgmode.org][org-mode]]              | Plain text. Readable without any software. Version-control native.     | N/A. Org files are the source of truth.                                                                      |
-| Image Processing      | [[https://github.com/Homebrew/homebrew-core/blob/HEAD/Formula/w/webp.rb][webP (CLI)]]            | CLI-only. No GUI, no cloud, no account.                                | ImageMagick or cwebp. Trivial swap.                                                                          |
-| Browser(s)            | [[https://www.torproject.org/][Tor]] + [[https://librewolf.net/][LibreWolf]]       | Tor for anonymity-critical use. LibreWolf for hardened daily use.      | N/A. Safari dropped - proprietary and redundant.                                                             |
-| Version Control       | [[https://git-scm.com/][Git (CLI)]]             | Decentralized. The repo is the backup.                                 | N/A. Content is portable to any host.                                                                        |
-| Git Host              | [[https://github.com/ccleberg][GitHub]]                | Public mirror only.                                                    | ~TECHNICAL DEBT~ - Microsoft-owned. Target: self-hosted Forgejo. One-line remote URL change.                   |
-| CI/CD                 | [[https://git.sr.ht/~ccleberg/cleberg.net/tree/main/item/build.py][build.py]] + [[https://www.openssh.org/][OpenSSH]]    | A Python script and SSH. No CI runner, no stored secrets, no webhooks. | A shell script. Python is not load-bearing here.                                                             |
-| Email Host            | [[https://soverin.com/][Soverin]]               | Privacy-focused provider. Better than Gmail.                           | ~TECHNICAL DEBT~ - not self-hosted. Target: Postfix + Dovecot + Rspamd, or maddy. MX records portable day one. |
-| Search Engine         | [[https://docs.searxng.org/][SearXNG]] (self-hosted) | Queries route through own instance. No third-party search profile.     | Any other self-hosted SearXNG instance.                                                                      |
-| Backups               | N/A                   | Nothing to back up. No user data. Source mirrored via Git.             | Intentional. If this changes: restic to a local target.                                                      |
-| Monitoring            | N/A                   | Monitoring creates logs. Logs are a liability.                         | Intentional.                                                                                                 |
-| Analytics             | N/A                   | No interest in visitor data. Content finds its way via RSS.            | Intentional.                                                                                                 |
-| Social Media          | N/A                   | —                                                                      | Intentional.                                                                                                 |
-| Newsletter            | RSS Only              | No subscriber list. No email vendor. No data relationship.             | N/A.                                                                                                         |
+| Technology            | What I Use              | Threat Model                                                                                        |
+|-----------------------+-------------------------+-----------------------------------------------------------------------------------------------------|
+| Registrar             | [[https://njal.la][Njalla]]                  | Registers domains on your behalf. No WHOIS identity exposure.                                       |
+| DNS                   | [[https://cloudflare.com][Cloudflare]]              | Portable DNS, secure infrastructure, and acceptable privacy.                                        |
+| Security              | [[https://cloudflare.com][Cloudflare]] + [[https://github.com/fail2ban/fail2ban][fail2ban]]   | Automated auth-failure bans. Minimal Cloudflare functionality enabled.                              |
+| Routing               | [[https://ui.com/][UniFi]]                   | Local network segmentation.                                                                         |
+| Server                | [[https://cleberg.net/blog/server-build.html][Self-hosted]]             | Physical control. No hypervisor escape vector. No subpoena to a DC.                                 |
+| Operating System      | [[https://ubuntu.com][Ubuntu]] + [[https://www.apple.com/os/macos/][macOS]]          | Ubuntu: telemetry off, LTS, stable. macOS: workstation only.                                        |
+| Web Server            | [[https://nginx.org][Nginx]] + [[https://community.torproject.org/onion-services/setup/][Tor]]             | Static file serving. Tor layer for censored-network access.                                         |
+| SSL                   | [[https://certbot.eff.org][Certbot]]                 | Free automated TLS. No commercial CA dependency. Ensures Cloudflare can't view unencrypted traffic. |
+| Static Site Generator | [[https://github.com/emacs-love/weblorg][Weblorg]] + [[https://git.sr.ht/~ccleberg/cleberg.net/tree/main/item/build.py][build.py]]      | Org-mode source compiles to plaintext HTML via native Lisp.                                         |
+| Terminal              | [[https://iterm2.com/][iTerm2]]                  | Functional. Inherited from macOS.                                                                   |
+| Shell                 | [[https://www.zsh.org/][Zsh]]                     | Portable, POSIX-adjacent, available on every target OS.                                             |
+| Editor                | [[https://github.com/doomemacs/doomemacs][Doom Emacs]]              | Editor and markup are the same tool. No proprietary format.                                         |
+| Markup Language       | [[https://orgmode.org][org-mode]]                | Plain text. Readable without any software. Version-control native.                                  |
+| Image Processing      | [[https://github.com/Homebrew/homebrew-core/blob/HEAD/Formula/w/webp.rb][webP (CLI)]]              | CLI-only. No GUI, no cloud, no account.                                                             |
+| Browser(s)            | [[https://www.torproject.org/][Tor]] + [[https://www.apple.com/safari/][Safari]]            | Tor for anonymity-critical use. Safari for hardened daily use.                                      |
+| Version Control       | [[https://git-scm.com/][Git (CLI)]]               | Decentralized. The repo is the backup.                                                              |
+| Git Host              | [[https://sr.ht][SourceHut]] + [[https://github.com/ccleberg][GitHub]]      | SourceHut is the primary and GitHub is the mirror.                                                  |
+| CI/CD                 | [[https://git.sr.ht/~ccleberg/cleberg.net/tree/main/item/build.py][build.py]] + [[https://builds.sr.ht][builds.sr.ht]] | A Python script and SSH. builds.sr.ht for convenience, but not required.                            |
+| Email Host            | [[https://soverin.com/][Soverin]]                 | Privacy-focused provider.                                                                           |
+| Search Engine         | [[https://docs.searxng.org/][SearXNG]] (self-hosted)   | Queries route through my own instance. No third-party search profile.                               |
+| Backups               | N/A                     | Nothing to back up. No user data. Source mirrored via Git.                                          |
+| Monitoring            | N/A                     | Monitoring creates logs. Logs are a liability.                                                      |
+| Analytics             | N/A                     | No interest in visitor data. Content finds its way via RSS.                                         |
+| Social Media          | N/A                     | —                                                                                                   |
+| Newsletter            | RSS Only                | No subscriber list. No email vendor. No data relationship.                                          |
 
 * Hardware
 
 Custom rack-mounted server. Physical control, no hypervisor, no vendor lock-in.
 See: [[https://cleberg.net/blog/server-build.html][server build post]].
 
-| Component     | Spec                                               | Threat Model / Notes                                       |
-|---------------+----------------------------------------------------+------------------------------------------------------------|
-| Chassis       | Rosewill RSV-R4100U 4U Rackmount                   | —                                                          |
-| Motherboard   | NZXT B550                                          | —                                                          |
-| CPU           | AMD Ryzen 7 5700G                                  | Onboard GPU eliminates need for discrete card in the rack. |
-| RAM           | 64GB DDR4 (2x32GB)                                 | —                                                          |
-| Boot Drive    | 500GB WD M.2 NVMe SSD                              | —                                                          |
-| Storage (HDD) | 1x10TB WD White, 1x8TB WD White, 2x8TB WD Red Plus | —                                                          |
-| PSU           | Corsair RM850                                      | —                                                          |
-| Cooling       | Noctua (1x120mm front, 2x80mm rear)                | —                                                          |
+| Component     | Spec                                |
+|---------------+-------------------------------------|
+| Chassis       | Rosewill RSV-R4100U 4U Rackmount    |
+| Motherboard   | NZXT B550                           |
+| CPU           | AMD Ryzen 7 5700G                   |
+| RAM           | 64GB DDR4 (2x32GB)                  |
+| Boot Drive    | 500GB WD M.2 NVMe SSD               |
+| Storage (HDD) | 6 x 8TB WD Red Plus                 |
+| PSU           | Corsair RM850                       |
+| Cooling       | Noctua (1x120mm front, 2x80mm rear) |
 
 Physical hardware under personal control eliminates the hypervisor escape vector
 and the cloud provider subpoena vector. Full recovery from a fresh OS install: