Meta

Colophon

How this site is built, the decisions behind it, and why. If an infrastructure portfolio cannot explain its own infrastructure, something is wrong.

Architecture

A single Node container serves both the public site and the administration panel. No frontend framework, no build step, and no third-party CDN: the HTML is rendered by the server and the browser only receives what it will use.

texto
browser
    │  HTTPS
    ▼
reverse proxy (Caddy/Traefik) ── automatic TLS
    │  HTTP on loopback
    ▼
forgekloud container (Node 26, unprivileged user, read-only FS)
    ├── Fastify ── public routes + /admin
    ├── SQLite (WAL) ── persistent volume
    └── /uploads ── byte-validated images

Decisions and why

SQLite instead of Postgres. One writer, concurrent reads, and a backup that consists of copying one file. Postgres would be another service to maintain, upgrade, and monitor without gaining anything here.

No build step. CSS and JavaScript are served exactly as written. There is no bundler to update and no 400 MB node_modules directory in the final image.

Markdown without raw HTML. The renderer has html: false, so there is no stored XSS vector and no need for a sanitizer.

Editable pages without deployment. The content of these pages lives in SQLite as an ordered list of blocks, not in code. Changing a number or adding a section does not require editing a file or restarting the container.

Server-side syntax highlighting. A small custom tokenizer covers bash, YAML, HCL, Dockerfile, JSON, SQL, and a few more languages. The client receives already-coloured HTML: zero syntax-highlighting JavaScript.

Security

  • JWT HS256 signed session in an httpOnly + SameSite=Strict + Secure cookie.
  • Password stored with scrypt (a memory-hard KDF), never in plain text.
  • CSRF token derived from the session identifier in every write form.
  • Rate limiting on login: 5 attempts per 15-minute window.
  • Uploads validated by magic bytes, not extensions or the Content-Type declared by the client. SVG is intentionally excluded.
  • Block content is schema-validated on save and escaped on render: what is entered in the panel never reaches the browser raw.
  • Headers: Content-Security-Policy without unsafe-inline, X-Content-Type-Options, Referrer-Policy, and X-Frame-Options.
  • Container with no-new-privileges, read-only filesystem, and non-root user.

Design

A bespoke system built from patterns observed in infrastructure and observability sites, not copied from any of them: a neutral-warm surface ramp, a single ember accent balanced by a cool data colour, monospace reserved for telemetry and code, and an asymmetric bento grid. Space Grotesk, IBM Plex Sans, and IBM Plex Mono are self-hosted.

Performance

No third-party JavaScript, remote fonts, or requests outside this domain. The site can be read and navigated entirely with JavaScript disabled; JavaScript only adds the mobile menu, terminal animation, and code-copy button.