- Heading capitalization consistent Title Case throughout
- Moved the three personal sections (What I Have Explored, What I'm
Focused On, Fun Fact) from between the two strongest technical
sections to after Systems/What's Running, as a closing note -
keeps momentum through the trust-boundary story into the diagram
and full Systems breakdown, and gives the page a real closing beat
instead of ending on a bare stack-count line
- Split the dense opening bio paragraph into two at its natural seam
Adds a real drawio-exported diagram to "Why Four Trust Boundaries,
Not One" showing the physical blast-radius split behind the routing-
authority claim in the text (previously prose-only). Sanitized -
verified no real hostnames/IPs made it into the export.
Also reorders all 14 Systems bullets alphabetically for easier
scanning.
Fixed one real inaccuracy (Gitea registry scope, Secret Distribution
path count) and replaced generic descriptions with true, specific
detail across all 14 Systems bullets - real incidents, real design
decisions, concrete numbers - each checked against Trilium and, where
relevant, the live Ansible roles rather than trusted at face value.
Also stages a verified-but-unintegrated PAM hardening finding in
docs/firewall-and-network.md for that file's own upcoming audit pass.
1.15em rendered fine (sanitizer allow-list is working, confirmed by
the stat-table numbers) but was too subtle a jump to actually look
bigger next to body text. 1.4em matches the visual weight of the
stat-strip numbers.
Gitea's default sanitizer strips style="" from every element; added a
markup.sanitizer allowlist for style on common tags (app.ini, this
Gitea instance) and restarted the service. Now that it's actually
respected: table centered via style="margin:0 auto" (the deprecated
align attribute never reliably did this), and the app-name font-size
bump from the last commit should finally show up too.
Plain markdown bold has no size control. Switched each app name to
<strong style="font-size:1.15em;"> so it stands out from the
description text instead of just being the same size in bold.
align="center" and a div wrapper both failed to actually center the
table under Gitea's markdown CSS. Rather than keep guessing, dropped
the centering attempt - table stays left-aligned with its per-cell
alignment intact.
align="center" on <table> itself gets ignored - Gitea's markdown CSS
forces tables to display:block for horizontal scroll, which breaks
that attribute. Wrapping in <div align="center"> actually centers it.
Table wasn't centered on the page (only text inside cells was) - added
align=\"center\" to the table itself. Icons were arbitrary; replaced
with ones that actually trace back to the related system's own icon
elsewhere in this doc (Docker whale for compose stacks, the brick wall
from Firewall & Network Segmentation for trust boundaries, the same
cycle icon Orchestration uses for automated maintenance flows).
Both paragraphs made the same 'this isn't a hobby, it's a platform'
point and duplicated tech mentions. Merged into one section: a
bulleted list naming the real technology behind every category
(Vault for secrets, Kestra for orchestration, Wazuh+Dashy for the
SOC, etc.) instead of one dense paragraph or abstract category names.
Caption claimed all dashed arrows were telemetry reporting, but two
of them ('proxies', 'auth') are traffic-routing relationships, not
telemetry - the old caption was written for the full 20-edge version
and never updated when the diagram got simplified.
No more Mermaid, per standing rule - the architecture diagram is now
a real image (assets/architecture-overview.svg), built and exported
from the Nextcloud Diagramming app, fetched via WebDAV and validated
as well-formed XML before committing. Ends the rendering-gap chase
entirely since there's no live renderer involved anymore, just a
static image.
Restructured so the edge proxy feeds forward into the app host
(EdgeProxy -.proxies.-> Apps) instead of the app host and SSO
pointing backward into the proxy - matches the real traffic
direction (browser hits the proxy first, which routes to the app)
and removes the long rank-spanning edges that were likely behind the
rendering gap. Full node set restored, colors restored.
7 nodes, strictly tree-shaped, no diamond merges (removed DNS-->Vault
and the EdgeProxy/SSO/InternalProxy branch entirely). If gap is gone,
the rejoining-path topology is the trigger, not raw node count.
Diagnostic bisection - if gap reappears here, it's a size/complexity
threshold. If not, the trigger is specifically in the observability
fan-in portion I removed for this test.
Diagnostic only - not a real content change. If the gap disappears
with this minimal diagram, it's genuinely about the real diagram's
content and I can bisect from here. If the gap is still there, it's
not about the diagram at all.
None of edge reduction, classDef removal, or multi-line label removal
fixed the gap - restoring the full diagram content since there's no
reason to keep it degraded for a fix that didn't work.
Compared node labels between this diagram and the non-gapped
architecture-overview.md one - this had 5 two-line labels, that one
only 2. Reduced to 1 remaining (App Host) to test whether multi-line
label height is what's breaking the container size calculation.
The docs/architecture-overview.md diagram has no custom colors and
renders with no gap; this one had classDef/class styling and did.
Real comparative evidence, not a blind guess this time - testing
whether custom fill/stroke styling is what's breaking Gitea's
container height calculation.
8 dotted 'reports to' edges converging on 2 nodes was likely forcing
Mermaid's layout engine to reserve extra vertical space for edge
routing in the LR diagram, leaving a large blank area below the
visible nodes. Reduced to 2 representative edges - can't verify the
actual render myself, this is a targeted guess to test.
Removed by request - it was the one unfinished system in the repo,
and it's the user's call on what represents them publicly. Removed
completely: the README section, docs/content-pipeline.md, and the
two stacks that only existed to back it (postiz, nocodb-content).
Fixed cross-links in dns-naming.md and firewall-and-network.md that
pointed at it (replaced the public-facing-app example with the
still-present Ghost blog), and notifications.md (dropped the
reference, also fixed a leftover 'documented rather than hidden'
phrase in the same paragraph). Stat strip and stack counts updated
(55->53 stacks, 16->15 systems).
The 'Every system, at a glance' table and the Systems section covered
the same 16 things in the same order - removed the table, kept the
narrative section since that's where the actual selling has to happen.
Rewrote every paragraph to lead with what the system does and its
real scope (what an employer needs to see) instead of a debugging
edge case or failure-mode trivia standing in for the description.
thesabear