From b69cb680e8d6437a795c0aa50aa3309e4d9047ad Mon Sep 17 00:00:00 2001 From: Christian Cleberg Date: Wed, 8 Apr 2026 10:55:01 -0500 Subject: update /now page --- content/uses/index.org | 79 +++++++++++++++++++++++++------------------------- 1 file changed, 39 insertions(+), 40 deletions(-) (limited to 'content/uses/index.org') diff --git a/content/uses/index.org b/content/uses/index.org index 2abe758..7192c2d 100644 --- a/content/uses/index.org +++ b/content/uses/index.org @@ -2,9 +2,8 @@ #+slug: index #+options: toc:nil -Tools powering this site and the infrastructure behind it. Each entry includes -a threat model justification and an exit strategy. ~TECHNICAL DEBT~ flags items -with no clean migration path or active sovereignty risk. +Tools powering this site and the infrastructure behind it. Each entry includes a +threat model justification. * Philosophy @@ -15,49 +14,49 @@ with no clean migration path or active sovereignty risk. * Software -| Technology | What I Use | Threat Model | Exit Strategy | -|-----------------------+-----------------------+------------------------------------------------------------------------+--------------------------------------------------------------------------------------------------------------| -| Registrar | [[https://njal.la][Njalla]] | Registers domains on your behalf. No WHOIS identity exposure. | Any registrar accepting anonymous payment. Portable. | -| DNS | [[https://njal.la][Njalla]] | Same as above. DNS records are portable on day one. | Self-hosted BIND or any other provider. | -| Security | [[https://github.com/fail2ban/fail2ban][fail2ban]] | Automated auth-failure bans. No cloud WAF. No data leaving machine. | nftables rate limiting or self-hosted crowdsec. | -| Routing | [[https://ui.com/][UniFi]] | Local network segmentation. Controller must run self-hosted. | ~TECHNICAL DEBT~ - cloud dependencies by default. OpenWrt on compatible HW. | -| Server | [[https://cleberg.net/blog/server-build.html][Self-hosted]] | Physical control. No hypervisor escape vector. No subpoena to a DC. | N/A. This is the exit strategy. | -| Operating System | [[https://ubuntu.com][Ubuntu]] + [[https://www.apple.com/os/macos/][macOS]] | Ubuntu: telemetry off, LTS, stable. macOS: workstation only. | Ubuntu → Debian. macOS → ~TECHNICAL DEBT~. Target: NixOS/Fedora on ThinkPad or Framework. | -| Web Server | [[https://nginx.org][Nginx]] + [[https://community.torproject.org/onion-services/setup/][Tor]] | Static file serving. Tor layer for censored-network access. | Caddy or lighttpd. Tor is already the exit layer. | -| SSL | [[https://certbot.eff.org][Certbot]] | Free automated TLS. No commercial CA dependency. | acme.sh. Same protocol, no Python dependency. | -| Static Site Generator | [[https://github.com/emacs-love/weblorg][Weblorg]] + [[https://git.sr.ht/~ccleberg/cleberg.net/tree/main/item/build.py][build.py]] | Org-mode source compiles to plaintext HTML. No JS build chain. | Pandoc + shell script. Source files survive any generator change. | -| Terminal | [[https://iterm2.com/][iTerm2]] | Functional. Inherited from macOS. | ~TECHNICAL DEBT~ - macOS-only. Target: foot or Alacritty on Linux. | -| Shell | [[https://www.zsh.org/][Zsh]] | Portable, POSIX-adjacent, available on every target OS. | bash or fish. Config is plain text. | -| Editor | [[https://github.com/doomemacs/doomemacs][Doom Emacs]] | Editor and markup are the same tool. No proprietary format. | Vanilla Emacs + org-mode. Doom is a config layer only. | -| Markup Language | [[https://orgmode.org][org-mode]] | Plain text. Readable without any software. Version-control native. | N/A. Org files are the source of truth. | -| Image Processing | [[https://github.com/Homebrew/homebrew-core/blob/HEAD/Formula/w/webp.rb][webP (CLI)]] | CLI-only. No GUI, no cloud, no account. | ImageMagick or cwebp. Trivial swap. | -| Browser(s) | [[https://www.torproject.org/][Tor]] + [[https://librewolf.net/][LibreWolf]] | Tor for anonymity-critical use. LibreWolf for hardened daily use. | N/A. Safari dropped - proprietary and redundant. | -| Version Control | [[https://git-scm.com/][Git (CLI)]] | Decentralized. The repo is the backup. | N/A. Content is portable to any host. | -| Git Host | [[https://github.com/ccleberg][GitHub]] | Public mirror only. | ~TECHNICAL DEBT~ - Microsoft-owned. Target: self-hosted Forgejo. One-line remote URL change. | -| CI/CD | [[https://git.sr.ht/~ccleberg/cleberg.net/tree/main/item/build.py][build.py]] + [[https://www.openssh.org/][OpenSSH]] | A Python script and SSH. No CI runner, no stored secrets, no webhooks. | A shell script. Python is not load-bearing here. | -| Email Host | [[https://soverin.com/][Soverin]] | Privacy-focused provider. Better than Gmail. | ~TECHNICAL DEBT~ - not self-hosted. Target: Postfix + Dovecot + Rspamd, or maddy. MX records portable day one. | -| Search Engine | [[https://docs.searxng.org/][SearXNG]] (self-hosted) | Queries route through own instance. No third-party search profile. | Any other self-hosted SearXNG instance. | -| Backups | N/A | Nothing to back up. No user data. Source mirrored via Git. | Intentional. If this changes: restic to a local target. | -| Monitoring | N/A | Monitoring creates logs. Logs are a liability. | Intentional. | -| Analytics | N/A | No interest in visitor data. Content finds its way via RSS. | Intentional. | -| Social Media | N/A | — | Intentional. | -| Newsletter | RSS Only | No subscriber list. No email vendor. No data relationship. | N/A. | +| Technology | What I Use | Threat Model | +|-----------------------+-------------------------+-----------------------------------------------------------------------------------------------------| +| Registrar | [[https://njal.la][Njalla]] | Registers domains on your behalf. No WHOIS identity exposure. | +| DNS | [[https://cloudflare.com][Cloudflare]] | Portable DNS, secure infrastructure, and acceptable privacy. | +| Security | [[https://cloudflare.com][Cloudflare]] + [[https://github.com/fail2ban/fail2ban][fail2ban]] | Automated auth-failure bans. Minimal Cloudflare functionality enabled. | +| Routing | [[https://ui.com/][UniFi]] | Local network segmentation. | +| Server | [[https://cleberg.net/blog/server-build.html][Self-hosted]] | Physical control. No hypervisor escape vector. No subpoena to a DC. | +| Operating System | [[https://ubuntu.com][Ubuntu]] + [[https://www.apple.com/os/macos/][macOS]] | Ubuntu: telemetry off, LTS, stable. macOS: workstation only. | +| Web Server | [[https://nginx.org][Nginx]] + [[https://community.torproject.org/onion-services/setup/][Tor]] | Static file serving. Tor layer for censored-network access. | +| SSL | [[https://certbot.eff.org][Certbot]] | Free automated TLS. No commercial CA dependency. Ensures Cloudflare can't view unencrypted traffic. | +| Static Site Generator | [[https://github.com/emacs-love/weblorg][Weblorg]] + [[https://git.sr.ht/~ccleberg/cleberg.net/tree/main/item/build.py][build.py]] | Org-mode source compiles to plaintext HTML via native Lisp. | +| Terminal | [[https://iterm2.com/][iTerm2]] | Functional. Inherited from macOS. | +| Shell | [[https://www.zsh.org/][Zsh]] | Portable, POSIX-adjacent, available on every target OS. | +| Editor | [[https://github.com/doomemacs/doomemacs][Doom Emacs]] | Editor and markup are the same tool. No proprietary format. | +| Markup Language | [[https://orgmode.org][org-mode]] | Plain text. Readable without any software. Version-control native. | +| Image Processing | [[https://github.com/Homebrew/homebrew-core/blob/HEAD/Formula/w/webp.rb][webP (CLI)]] | CLI-only. No GUI, no cloud, no account. | +| Browser(s) | [[https://www.torproject.org/][Tor]] + [[https://www.apple.com/safari/][Safari]] | Tor for anonymity-critical use. Safari for hardened daily use. | +| Version Control | [[https://git-scm.com/][Git (CLI)]] | Decentralized. The repo is the backup. | +| Git Host | [[https://sr.ht][SourceHut]] + [[https://github.com/ccleberg][GitHub]] | SourceHut is the primary and GitHub is the mirror. | +| CI/CD | [[https://git.sr.ht/~ccleberg/cleberg.net/tree/main/item/build.py][build.py]] + [[https://builds.sr.ht][builds.sr.ht]] | A Python script and SSH. builds.sr.ht for convenience, but not required. | +| Email Host | [[https://soverin.com/][Soverin]] | Privacy-focused provider. | +| Search Engine | [[https://docs.searxng.org/][SearXNG]] (self-hosted) | Queries route through my own instance. No third-party search profile. | +| Backups | N/A | Nothing to back up. No user data. Source mirrored via Git. | +| Monitoring | N/A | Monitoring creates logs. Logs are a liability. | +| Analytics | N/A | No interest in visitor data. Content finds its way via RSS. | +| Social Media | N/A | — | +| Newsletter | RSS Only | No subscriber list. No email vendor. No data relationship. | * Hardware Custom rack-mounted server. Physical control, no hypervisor, no vendor lock-in. See: [[https://cleberg.net/blog/server-build.html][server build post]]. -| Component | Spec | Threat Model / Notes | -|---------------+----------------------------------------------------+------------------------------------------------------------| -| Chassis | Rosewill RSV-R4100U 4U Rackmount | — | -| Motherboard | NZXT B550 | — | -| CPU | AMD Ryzen 7 5700G | Onboard GPU eliminates need for discrete card in the rack. | -| RAM | 64GB DDR4 (2x32GB) | — | -| Boot Drive | 500GB WD M.2 NVMe SSD | — | -| Storage (HDD) | 1x10TB WD White, 1x8TB WD White, 2x8TB WD Red Plus | — | -| PSU | Corsair RM850 | — | -| Cooling | Noctua (1x120mm front, 2x80mm rear) | — | +| Component | Spec | +|---------------+-------------------------------------| +| Chassis | Rosewill RSV-R4100U 4U Rackmount | +| Motherboard | NZXT B550 | +| CPU | AMD Ryzen 7 5700G | +| RAM | 64GB DDR4 (2x32GB) | +| Boot Drive | 500GB WD M.2 NVMe SSD | +| Storage (HDD) | 6 x 8TB WD Red Plus | +| PSU | Corsair RM850 | +| Cooling | Noctua (1x120mm front, 2x80mm rear) | Physical hardware under personal control eliminates the hypervisor escape vector and the cloud provider subpoena vector. Full recovery from a fresh OS install: -- cgit v1.2.3