Gitea's default sanitizer strips style="" from every element; added a
markup.sanitizer allowlist for style on common tags (app.ini, this
Gitea instance) and restarted the service. Now that it's actually
respected: table centered via style="margin:0 auto" (the deprecated
align attribute never reliably did this), and the app-name font-size
bump from the last commit should finally show up too.
Plain markdown bold has no size control. Switched each app name to
<strong style="font-size:1.15em;"> so it stands out from the
description text instead of just being the same size in bold.
align="center" and a div wrapper both failed to actually center the
table under Gitea's markdown CSS. Rather than keep guessing, dropped
the centering attempt - table stays left-aligned with its per-cell
alignment intact.
align="center" on <table> itself gets ignored - Gitea's markdown CSS
forces tables to display:block for horizontal scroll, which breaks
that attribute. Wrapping in <div align="center"> actually centers it.
Table wasn't centered on the page (only text inside cells was) - added
align=\"center\" to the table itself. Icons were arbitrary; replaced
with ones that actually trace back to the related system's own icon
elsewhere in this doc (Docker whale for compose stacks, the brick wall
from Firewall & Network Segmentation for trust boundaries, the same
cycle icon Orchestration uses for automated maintenance flows).
Both paragraphs made the same 'this isn't a hobby, it's a platform'
point and duplicated tech mentions. Merged into one section: a
bulleted list naming the real technology behind every category
(Vault for secrets, Kestra for orchestration, Wazuh+Dashy for the
SOC, etc.) instead of one dense paragraph or abstract category names.
Caption claimed all dashed arrows were telemetry reporting, but two
of them ('proxies', 'auth') are traffic-routing relationships, not
telemetry - the old caption was written for the full 20-edge version
and never updated when the diagram got simplified.
No more Mermaid, per standing rule - the architecture diagram is now
a real image (assets/architecture-overview.svg), built and exported
from the Nextcloud Diagramming app, fetched via WebDAV and validated
as well-formed XML before committing. Ends the rendering-gap chase
entirely since there's no live renderer involved anymore, just a
static image.
Restructured so the edge proxy feeds forward into the app host
(EdgeProxy -.proxies.-> Apps) instead of the app host and SSO
pointing backward into the proxy - matches the real traffic
direction (browser hits the proxy first, which routes to the app)
and removes the long rank-spanning edges that were likely behind the
rendering gap. Full node set restored, colors restored.
7 nodes, strictly tree-shaped, no diamond merges (removed DNS-->Vault
and the EdgeProxy/SSO/InternalProxy branch entirely). If gap is gone,
the rejoining-path topology is the trigger, not raw node count.
Diagnostic bisection - if gap reappears here, it's a size/complexity
threshold. If not, the trigger is specifically in the observability
fan-in portion I removed for this test.
Diagnostic only - not a real content change. If the gap disappears
with this minimal diagram, it's genuinely about the real diagram's
content and I can bisect from here. If the gap is still there, it's
not about the diagram at all.
None of edge reduction, classDef removal, or multi-line label removal
fixed the gap - restoring the full diagram content since there's no
reason to keep it degraded for a fix that didn't work.
Compared node labels between this diagram and the non-gapped
architecture-overview.md one - this had 5 two-line labels, that one
only 2. Reduced to 1 remaining (App Host) to test whether multi-line
label height is what's breaking the container size calculation.
The docs/architecture-overview.md diagram has no custom colors and
renders with no gap; this one had classDef/class styling and did.
Real comparative evidence, not a blind guess this time - testing
whether custom fill/stroke styling is what's breaking Gitea's
container height calculation.
8 dotted 'reports to' edges converging on 2 nodes was likely forcing
Mermaid's layout engine to reserve extra vertical space for edge
routing in the LR diagram, leaving a large blank area below the
visible nodes. Reduced to 2 representative edges - can't verify the
actual render myself, this is a targeted guess to test.
Removed by request - it was the one unfinished system in the repo,
and it's the user's call on what represents them publicly. Removed
completely: the README section, docs/content-pipeline.md, and the
two stacks that only existed to back it (postiz, nocodb-content).
Fixed cross-links in dns-naming.md and firewall-and-network.md that
pointed at it (replaced the public-facing-app example with the
still-present Ghost blog), and notifications.md (dropped the
reference, also fixed a leftover 'documented rather than hidden'
phrase in the same paragraph). Stat strip and stack counts updated
(55->53 stacks, 16->15 systems).
The 'Every system, at a glance' table and the Systems section covered
the same 16 things in the same order - removed the table, kept the
narrative section since that's where the actual selling has to happen.
Rewrote every paragraph to lead with what the system does and its
real scope (what an employer needs to see) instead of a debugging
edge case or failure-mode trivia standing in for the description.
README is short/sharp facts, docs/*.md is full depth/process/reasoning
- that split had collapsed into either near-duplicate text in both
files or the fact missing from the README entirely. README now states
the OIDC zone-crossing fact in one crisp sentence; the full doc has
the complete step-by-step breakdown. The LDAP superuser workaround
claim is removed from both - the source material frames it as
contingency guidance for a scenario that may never have come up, not
documented deployed behavior, so it doesn't belong in either file.
The source material says header-based forward-auth is 'the viable
path instead, if SSO is wanted for an app like this' - conditional
contingency guidance for a scenario that may not have actually come
up, not a description of something built and running. Presenting it
as live, deployed behavior in both docs/sso-and-identity.md and the
README was a real accuracy error. Removed from both; the doc still
covers what's actually confirmed (Authentik, dual-zone registration,
native OIDC vs. proxy forward-auth split, least-privilege Git access).
The paragraphs were near-duplicates of each doc's own opening -
added nothing beyond the table row above them or the full doc below.
Rewrote every one to lead with a different angle/detail than its
doc (the before/after story, the concrete failure math, the vendor
limitation) instead of restating the same sentences shorter. Also
removed every remaining 'documented honestly / rather than hidden /
caught during an audit' self-referential phrasing - state the fact,
don't narrate the act of documenting it.
New opening frames the repo as a platform, not a media-server-plus-
extras, and draws the direct line to what an employer's platform/
security team actually owns. Added a condensed version of the
trust-boundary story (the single hardest decision in the repo) right
in the README, ahead of the systems table, so a reader gets a real
'this person thinks like an engineer' moment before they even scroll.
Diagram: switched to LR layout, color-coded by role (edge/core/
observability), dropped the repeated 'reports to' labels that were
clipping in the browser - same fix already applied to
architecture-overview.md. Added a stat strip (11 hosts, 55 stacks,
16 systems, 4 boundaries, 13 flows) and a scannable systems-at-a-
glance table above the detailed sections, so a reader gets the full
picture in a 10-second skim before the deeper 2-minute read.
Actually fixed the 4 problems named earlier instead of just naming
them: a numbers-at-a-glance strip up top, the trust-boundary diagram
is now color-coded by boundary type, added a concrete blast-radius
table showing exactly what stays up vs goes down per failure, and
replaced vague figures ('~40 stacks', 'every managed host') with
real ones (41 stacks, 11 fleet hosts).
Leads with the hardest actual decision (4 trust boundaries, each
calibrated to a different risk level, enforced by 3 separate routing
authorities) given full narrative depth instead of flat template
treatment. The other 6 traffic laws move to a compact reference
table linking to their own dedicated docs, avoiding redundancy with
content that already lives elsewhere in more depth.
Previously only delivered 2-3 of the 8 traffic categories it claimed
to cover. Now states every law (ingress, east-west, secrets, DNS,
observability, notifications, CI/CD, management) with its own
Law/Flow/Failure-behavior, plus the 4 global architectural laws that
apply across all of them.
Switch to LR layout, restore all 12 observability-reporting edges
(cut them by mistake, they belong in a dependency graph), drop the
repeated 'reports to' label text that was breaking legibility and
let line style (solid=dependency, dotted=async reporting) carry that
distinction instead. Also shortened edge labels on the trust-boundary
diagram to avoid the same clipping issue.
Completes the full depth pass across all 16 docs - real tech names,
why-this-vs-the-alternative reasoning, heavy cross-linking between
every doc, ranked/specific tradeoffs instead of generic hedges.
Same treatment as the security batch - real tech names, 'why this vs
the alternative' reasoning, heavy cross-linking, ranked/specific
tradeoffs instead of generic hedges.
Names real technology throughout (Vault, Authentik, pfSense,
firewalld, Wazuh) instead of staying generic, adds a 'why this
approach vs the alternative' section to every doc, cross-links
heavily between docs instead of treating each system in isolation.
Names real technology (Technitium) instead of staying vague, adds
explicit cross-links to every other system that actually depends on
DNS, explains why self-hosted DNS was chosen, and adds a 'what I'd
improve' section. Template for redoing the rest.
thesabear