harden Hugo build and remove unused CMS

'docker compose down' removes caddy_cf and the default network, which
intermittently severs the SSH session's own network path before 'up'
restores it (remote command exited without exit status). Replace with
'pull && up -d --force-recreate --remove-orphans' so the stack is
reconciled in place without tearing the network out from under the
connection, while still picking up the new :latest image.

.dockerignore

@@ -0,0 +1,18 @@
+# Send only files required by the Hugo build and SWS runtime stages.
+*
+
+!Dockerfile
+!go.mod
+!go.sum
+!sws.toml
+
+!assets/
+!assets/**
+!config/
+!config/**
+!content/
+!content/**
+!layouts/
+!layouts/**
+!static/
+!static/**

.gitea/workflows/build-docker-images.yml

@@ -0,0 +1,135 @@
+name: Build Hugo
+
+on:
+  push:
+    branches: [ "main" ]
+
+env:
+  REGISTRY: tea.ahmza.com
+  IMAGE_NAME: ${{ gitea.repository }}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+
+      - name: Login to Gitea Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ gitea.repository_owner }}
+          password: ${{ secrets.GITEATOKEN }}
+
+      # QEMU deliberately omitted.
+      #
+      # Hugo runs on BUILDPLATFORM in the Dockerfile, so the static site is
+      # built natively on the runner. The final amd64/arm64 stages only copy
+      # the resulting static files into the target-platform SWS image.
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/arm64, linux/amd64
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:latest
+            ${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:${{ gitea.event.head_commit.id }}
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:buildcache
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:buildcache,mode=max
+  deploy:
+    runs-on: ubuntu-latest
+    needs: build
+
+    steps:
+      - name: Pre-flight - verify VPN prerequisites
+        # NetBird brings up a WireGuard interface, which needs a TUN device and
+        # NET_ADMIN inside the job container. Without them, `netbird up` hangs
+        # ~50s and dies with a cryptic "DeadlineExceeded". Check up front so the
+        # failure is obvious and points at the fix (runner config.yaml).
+        run: |
+          echo "::group::NetBird prerequisites"
+          if [ -e /dev/net/tun ]; then
+            echo "OK: /dev/net/tun present"
+          else
+            echo "::error title=Missing TUN device::/dev/net/tun not found. Add --device=/dev/net/tun to the runner's config.yaml container.options."
+            exit 1
+          fi
+          if command -v capsh >/dev/null 2>&1; then
+            capsh --print | grep -q 'cap_net_admin' \
+              && echo "OK: NET_ADMIN present" \
+              || echo "::warning title=NET_ADMIN missing::netbird up will likely time out (DeadlineExceeded) configuring wt0. Add --cap-add=NET_ADMIN to the runner's config.yaml container.options."
+          else
+            echo "note: capsh unavailable, skipping NET_ADMIN check"
+          fi
+          echo "::endgroup::"
+
+      - name: Netbird Connect
+        id: netbird
+        timeout-minutes: 3
+        uses: Alemiz112/netbird-connect@v1
+        with:
+          setup-key: ${{ secrets.NETBIRD_SETUP_KEY }}
+          hostname: 'gitea-actions-blog'
+          management-url: ${{ secrets.NETBIRD_URL }}
+
+      - name: NetBird status
+        # Surface the actual peer/route state in the log and hard-assert that
+        # the management connection is up before attempting any deploys.
+        run: |
+          echo "::group::netbird status"
+          sudo netbird status --detail || true
+          echo "::endgroup::"
+          sudo netbird status | grep -q 'Management: Connected' \
+            && echo "NetBird management connected." \
+            || { echo "::error title=NetBird not connected::Management not connected after netbird up."; exit 1; }
+
+      - name: Deploy image to talos-prod
+        uses: actions-hub/kubectl@v1.36.2
+        env:
+          KUBE_CONFIG: ${{ secrets.KUBE_CONFIG }}
+        with:
+          args: >-
+            -n blog-ahmza-com
+            set image deployment/blog
+            blog=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:${{ gitea.event.head_commit.id }}
+
+      - name: Wait for rollout
+        uses: actions-hub/kubectl@v1.36.2
+        env:
+          KUBE_CONFIG: ${{ secrets.KUBE_CONFIG }}
+        with:
+          args: >-
+            -n blog-ahmza-com
+            rollout status deployment/blog
+            --timeout=5m
+
+      - name: Show deployed pods
+        uses: actions-hub/kubectl@v1.36.2
+        env:
+          KUBE_CONFIG: ${{ secrets.KUBE_CONFIG }}
+        with:
+          args: >-
+            -n blog-ahmza-com
+            get pods -o wide
+
+      - name: NetBird diagnostics & disconnect
+        # Runs even on failure: captures final state for debugging and tears the
+        # peer down so stale 'gitea-actions-blog' peers don't pile up.
+        if: always()
+        run: |
+          echo "::group::final netbird status"
+          sudo netbird status --detail || echo "netbird unavailable"
+          echo "::endgroup::"
+          sudo netbird down || true

.github/workflows/build-docker-images.yml

@@ -1,86 +0,0 @@
-name: Build Hugo
-
-on:
-  push:
-    branches: [ "main" ]
-
-env:
-  REGISTRY: tea.ahmza.com
-  IMAGE_NAME: ${{ gitea.repository }}
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-
-    permissions:
-      contents: read
-      packages: write
-      attestations: write
-      id-token: write
-
-    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v4
-
-      - name: Login to Gitea Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ gitea.repository_owner }}
-          password: ${{ secrets.GITEATOKEN }}
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          platforms: linux/arm64, linux/amd64
-          push: true
-          build-args: |
-            BUILDKIT_CONTEXT_KEEP_GIT_DIR=true
-          tags: |
-            ${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:latest
-            ${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:${{ gitea.event.head_commit.id }}
-          # Registry-backed build cache. The GitHub-hosted 'gha' cache is not
-          # reachable from self-hosted Gitea runners, so store the cache as a
-          # dedicated tag in the same registry instead.
-          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:buildcache
-          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:buildcache,mode=max
-  deploy:
-    runs-on: ubuntu-latest
-    needs: build
-
-    steps:
-      - name: Netbird Connect
-        uses: Alemiz112/netbird-connect@v1
-        with:
-          setup-key: ${{ secrets.NETBIRD_SETUP_KEY }}
-          hostname: 'gitea-actions-blog'
-          management-url: ${{ secrets.NETBIRD_URL }}
-
-      - name: Deploy to RPIC-Cluster
-        # RPIC cluster is temporarily out of service. Don't let its failure
-        # block the Gimli deploy or fail the whole job. Remove this line once
-        # the cluster is back.
-        continue-on-error: true
-        uses: appleboy/ssh-action@v1
-        with:
-          host: ${{ secrets.RPIC_HOST }}
-          username: ${{ secrets.SSH_USER }}
-          key: ${{ secrets.RPIC_KEY }}
-          port: ${{ secrets.SSH_PORT }}
-          script: 'kubectl rollout restart deployment blog -n blog-ahmza-com'
-
-      - name: Deploy to Gimli
-        uses: appleboy/ssh-action@v1
-        with:
-          host: ${{ secrets.GIMLI_HOST }}
-          username: ${{ secrets.SSH_USER }}
-          key: ${{ secrets.GIMLI_KEY }}
-          port: ${{ secrets.SSH_PORT }}
-          script: 'docker compose down && docker compose pull && docker compose up -d'

.gitignore

@@ -5,5 +5,4 @@ styles/
 node_modules
 public/
 resources/
-go.sum
 themes/

Caddyfile

@@ -15,34 +15,19 @@
 	# X-Forwarded-For) are honoured only when the request actually comes from
 	# Cloudflare. This prevents header spoofing from any other source.
 	#
-	# Ranges from https://www.cloudflare.com/ips-v4/ and /ips-v6/ .
-	# Keep in sync when Cloudflare updates them (rarely). If you rebuild
-	# caddy-cf with the caddy-dynamic-cloudflare / caddy-cloudflare-ip plugin,
-	# this static list can be replaced with `trusted_proxies cloudflare`.
+	# The `cloudflare` IP source (WeidiDeng/caddy-cloudflare-ip, baked into the
+	# caddy-cf image) auto-fetches the ranges from cloudflare.com/ips-v4 and
+	# /ips-v6 and refreshes them periodically, so there's no static list to
+	# keep in sync.
 	servers {
-		trusted_proxies static \
- 173.245.48.0/20 \
- 103.21.244.0/22 \
- 103.22.200.0/22 \
- 103.31.4.0/22 \
- 141.101.64.0/18 \
- 108.162.192.0/18 \
- 190.93.240.0/20 \
- 188.114.96.0/20 \
- 197.234.240.0/22 \
- 198.41.128.0/17 \
- 162.158.0.0/15 \
- 104.16.0.0/13 \
- 104.24.0.0/14 \
- 172.64.0.0/13 \
- 131.0.72.0/22 \
- 2400:cb00::/32 \
- 2606:4700::/32 \
- 2803:f800::/32 \
- 2405:b500::/32 \
- 2405:8100::/32 \
- 2a06:98c0::/29 \
- 2c0f:f248::/32
+		trusted_proxies cloudflare {
+			interval 12h
+			timeout 15s
+		}
+		# Read the real visitor IP from these headers (only honoured for
+		# requests from trusted_proxies above). Cf-Connecting-Ip is
+		# Cloudflare's single authoritative end-user IP; X-Forwarded-For is
+		# the fallback if a request ever arrives without the CF header.
 		client_ip_headers Cf-Connecting-Ip X-Forwarded-For
 	}
 }

Dockerfile

@@ -1,6 +1,19 @@
-FROM ghcr.io/hugomods/hugo:0.157.0 AS build
+# syntax=docker/dockerfile:1
+# Pin the build stage to the native build platform so Hugo runs once (never
+# under QEMU emulation). Hugo output is static HTML — identical across arches —
+# so there's no reason to run it per target arch. The runtime stage below stays
+# on TARGETPLATFORM, so multi-arch (amd64 + arm64) runtime images are preserved.
+FROM --platform=$BUILDPLATFORM ghcr.io/hugomods/hugo:0.165.0 AS build
 WORKDIR /tmp/hugo
-COPY . .
+
+COPY go.mod go.sum ./
+COPY config ./config
+RUN hugo mod graph
+
+COPY assets ./assets
+COPY content ./content
+COPY layouts ./layouts
+COPY static ./static
 RUN hugo --gc --minify
 
 FROM ghcr.io/static-web-server/static-web-server:2

README.md

@@ -50,5 +50,5 @@ sacrificing performance.
 The Blowfish theme is managed as a Hugo module, so no submodules are required.
 Clone the repository with:
 ```bash
-git clone ssh://gitea@tea.ahmza.com:2222/ahmza/blog-ahmza-com.git
+git clone ssh://git@tea.ahmza.com/ahmza/blog-ahmza-com.git
 ```

archetypes/posts.md

@@ -1,7 +1,7 @@
 ---
 title: {{ replace .TranslationBaseName "-" " " | title }}
 description: ""
-tags: [""]
+tags: []
 author: "ahmza"
 date: {{ .Date }}
 draft: true

config/_default/hugo.toml

@@ -14,6 +14,11 @@ pagination.pagerSize = 10
 buildDrafts = false
 buildFuture = false
 
+# Keep source-art and editor backup files out of the built site. Without this,
+# files inside page bundles (e.g. feature.aseprite) are copied into public/ as
+# page resources and served publicly.
+ignoreFiles = ['\.aseprite$', '\.bak$']
+
 enableEmoji = true
 
 # googleAnalytics = "G-XXXXXXXXX"

config/_default/languages.en.toml

@@ -1,5 +1,5 @@
-languageCode = "en"
-languageName = "English"
+locale = "en"
+label = "English"
 weight = 1
 title = "ahmza's ramblings"
 

config/_default/module.toml

@@ -1,3 +1,3 @@
 [[imports]]
 disable = false
-path = "github.com/nunocoracao/blowfish/v2"
+path = "github.com/nunocoracao/blowfish/v3"

content/posts/arrstack/index.md

@@ -1,7 +1,7 @@
 ---
 title: Arrstack
 description:
-tags: [""]
+tags: []
 author: "ahmza"
 date: 2025-05-09T23:44:27+01:00
 draft: true

content/posts/be-more-productive-by-being-bored/index.md

@@ -4,7 +4,7 @@ description: In the modern age we are overwhelmed with stimuli. Learn to cut out
 tags:
   - lifestyle
   - minimalism
-  - prodcutivity
+  - productivity
 author: ahmza
 date: 2024-01-02
 draft: false

content/posts/mc-server-on-docker/index.md

@@ -185,8 +185,8 @@ cd .server-data
 2. **Download a Minecraft server jar file:**
 
 - [Vanilla Minecraft Server](https://www.minecraft.net/en-us/download/server)
-		- Right-click the green link that says minecraft_server.<version>.jar and copy the link address.
-		- Download with: curl -o server.jar <link you copied here>
+		- Right-click the green link that says `minecraft_server.<version>.jar` and copy the link address.
+		- Download with: `curl -o server.jar <link you copied here>`
 - [Fabric Mod loader server](https://fabricmc.net/use/server/)
 		- Select the Minecraft version, Fabric Loader Version, and the Installer Version of your choice. I tend to go with the latest.
 		- Download with: Copy the curl command under CLI download

content/posts/mc-server-on-docker/index.md.bak

@@ -1,243 +0,0 @@
----
-title: Minecraft Server on Docker ⛏ 🐳
-date: 2022-05-24
-lastmod: 2024-07-20
-author: "ahmza"
-draft: false
-weight:
-
-tags: ["games", "docker"]
-description: "Ever wanted to build a Minecraft server in docker !! Start here"
----
-
-## **Introduction**
-
-Minecraft is a great game that becomes even more enjoyable when played with
-friends. One of the best ways to do this is by setting up a dedicated server.
-This guide will help you do just that!
-
-Setting up and running a Minecraft server does not require a lot of resources,
-but based on my experience, allocating more resources significantly enhances
-performance. Especially when you start to add mods and increase player count.
-
-## **Prerequisites**
-
-- Docker
-- Docker Compose
-
-See [Pi Cluster](/posts/pi-docker-swarm/)
-for more information about my docker setup.
-
-## **Requirements**
-_Requirements Gathered from [here](https://minecraft.fandom.com/wiki/Server/Requirements/Dedicated#Unix_.28Linux.2C_BSD.2C_macOS.29)_
-
-### **Minimum (1-5 Players)**
-
-- Intel Pentium 4 or AMD Athlon based CPU
-- 512 MB RAM
-- 2 GB Storage space
-
-### **Recommended (10-15 Players)**
-
-- Intel Core or AMD K8 based CPU
-- 3 GB RAM
-- 16 GB Storage Space
-
-### **Optimal (20+ Players)**
-
-- Intel i5/i7 or AMD Ryzen 5/7 Based CPU
-- 6 GB RAM
-- 35 GB Storage Space
-
-**My opinion**:
-
-I personally went with the **optimal** settings as I wanted to run mods as well
-as have the capacity for ~10 players. This gives the server breathing room.
-
-However if you will be runing no mods or a few light weight mods and only a few
-players then there really is no need to go higher than 3-4 GB.
-
-## **Building the Container**
-
-Lets get started on building the Minecraft server
-
-1. **Create a directory for the Minecraft server files**:
-```bash
-# Make the folder
-mkdir minecraft-server
-# Enter the folder
-cd minecraft-server
-```
-
-2. **Create an environment file for the Docker Container**:
-- The _.env_ file allows us to specify variables used in the build process.
-```bash
-# Create a .env file
-touch .env
-# Open in a text editor
-vim .env
-# Enter the following variables
-CONTAINER_NAME=minecraft-server
-SERVER_MEM=4096 #change this to your desired value (in MB)
-SERVER_JAR=<downloaded-server-file>.jar # Minecraft server jar file. Change this later
-```
-
-3. **Create the _docker-compose.yml_ file**:
-```bash
-# Create the file
-touch docker-compose.yml`
-# Open in a text editor
-vim docker-compose.yml
-```
-- _docker-compose.yml_ is the spec of our Minecraft server.
-  - Build a docker image using context . and pass some ARGS.
-  - Attach volume .server-data, where Minecraft's files will be stored.
-  - Open network ports to  access to the Docker container
-  - Give the docker container a name
-  - The container will always restart unless we tell it to stop.
-
-```yaml
-services:
-  minecraft-server:
-    build:
-      context: .
-      args:
-        SERVER_MEM: ${SERVER_MEM}
-        SERVER_JAR: ${SERVER_JAR}
-    volumes:
-      - .server-data:/server
-    ports:
-      - 25565:25565 # Game
-      - 25575:25575 # RCON
-    container_name: ${CONTAINER_NAME}
-    restart: unless-stopped
-
-volumes:
-  server-data:
-```
-
-4. **Create the _Dockerfile_ file**:
-
-- requested in docker-compose.yml build stage as context .
-- The _Dockerfile_ is the spec for software running inside the container
-
-```bash
-# Create the file
-touch Dockerfile
-# Open the file in a text editor
-vim Dockerfile
-```
-- We use the [eclipse-temurin:21](https://hub.docker.com/_/eclipse-temurin) image to provide the java JRE
-  - Use the required java version for the version of Minecraft you are running
-- Collect the ARGs from the .env file
-- Set the environment variables
-- Set the working directory to /server which on our local system is .server-data
-- Run the minecraft server jar with the ENV variables
-
-```Dockerfile
-FROM eclipse-temurin:21
-
-ARG SERVER_MEM
-ARG SERVER_JAR
-
-ENV SERVER_MEM=${SERVER_MEM}
-ENV SERVER_JAR=${SERVER_JAR}
-
-WORKDIR /server
-
-CMD echo "Minecraft Server is starting\n" && java -Xms128M -Xmx${SERVER_MEM}M -jar ${SERVER_JAR} nogui
-```
-
-## **Setup the Server files**
-
-We’re almost there, just a few steps to go.
-
-When you try to start the container, you might encounter the following error:
-```bash
-Minecraft Server is starting
-
-Error: Unable to access jarfile server.jar
-```
-This happens because we haven't downloaded the server jar file yet. Let's do
-that now
-
-1. **Create a folder in the minecraft-server folder called .server-data**:
-
-```bash
-mkdir .server-data
-cd .server-data
-```
-
-2. **Download a Minecraft server jar file**:
-  - [Vanilla Minecraft Server](https://www.minecraft.net/en-us/download/server)
-    - Right click the green link that says minecraft_server.<version>.jar and copy the link address
-    - Download with: `curl -o server.jar <link you copied here>`
-  - [Fabric Mod loader server](https://fabricmc.net/use/server/)
-    - Select the Minecraft version, Fabric Loader Version and the Installer Version of your choice. I tend to go with the latest.
-    - Download with: `Copy the curl command under CLI download`
-
-3. **Go back to the root minecraft-server folder**
-
-```bash
-cd ..
-```
-
-4. **Edit SERVER_JAR in .env with the name of the .jar you just downloaded**:
-```bash
-# Open in a text editor
-vim .env
-# Enter the following variables
-CONTAINER_NAME=minecraft-server
-SERVER_MEM=4096
-SERVER_JAR=<downloaded-server-file>.jar # Change this to the name of the .jar you downloaded
-```
-
-5. **Run the container to generate necessary files like 'eula.txt'**:
-```bash
-docker compose up
-```
-you will see something like this:
-```bash
-minecraft-server  | Starting net.minecraft.server.Main
-minecraft-server  | [18:05:50] [ServerMain/INFO]: You need to agree to the EULA in order to run the server. Go to eula.txt for more info.
-minecraft-server exited with code 0
-```
-
-6. **Accept the EULA**:
-
-```bash
-# edit eula.txt in a text editor
-vim .server-data/eula.txt
-# change `eula=false` to `eula=true`
-eula=true
-```
-
-7. **Make any additional changes you want**:
-- Notable files:
-  - **server.properties** - Configure server name, game mode, world type etc…
-  - **ops.json** - server operators (can be set in-game)
-  - **whitelist.json** - players allowed to join the server (can be set in-game)
-
-## Run the Minecraft Server
-
-1. **Run the container in detached mode**:
-```bash
-# The -d flag allows the container to run in detached mode, i.e., in the background
-docker compose up -d
-```
-
-```bash
-# monitor the logs as the server starts. Use CTRL+C to exit
-docker logs minecraft-server --follow
-# If you see the following lines, your server is up and running:
-     [18:17:01] [Server thread/INFO]: Time elapsed: 25529 ms
-     [18:17:01] [Server thread/INFO]: Done (34.571s)! For help, type "help"
-```
-
-## **Conclusion**
-
-Congratulations! You've successfully set up a Minecraft server. Now it's time
-to play!
-
-There are many exciting possibilities from here, such as installing mods or
-creating scripts to manage the server. Enjoy your Minecraft adventures!

content/posts/pi-docker-swarm/index.md

@@ -39,8 +39,6 @@ a **bare metal server that sucks a lot of power to a low power solution.**
 - 4 x PoE hats
 - 1 x 5 port PoE Switch
 
-![Cluster(fix this image)](/img/pi-docker-swarm/cluster.webp)
-
 ### **Point Of This post**
 
 After following this post you will have setup _Docker swarm_ on a cluster of Pis
@@ -329,7 +327,7 @@ vim hosts
 ```
 
 - **_[piCluster]_** - specifies a group of hosts
-- **_<ip address>_** - change these to the Pis IP addresses
+- **_`<ip address>`_** - change these to the Pis IP addresses
 
 **create the Pi Intercommunication keys**
 

content/posts/securing-ssh/index.md

@@ -2,9 +2,9 @@
 title: Securing SSH 🤖
 description: Ever wanted to make your SSH connections more secure. Read this
 tags:
-  - HomeLab
-  - RemoteAccess
-  - SSH
+  - homelab
+  - remoteaccess
+  - ssh
 author: ahmza
 date: 2021-12-07
 draft: false
@@ -146,7 +146,7 @@ fine 😊
 - Max Auth Tries 5
 - PasswordAuthentication no
 - PermitEmptyPasswords no
-- AllowUsers <user>
+- AllowUsers `<user>`
 - ClientAliveInterval 180
 
 ``` bash

content/posts/setup-a-hugo-site/index.md

@@ -3,7 +3,7 @@ title: Setup a HUGO Site
 description: Always wanted to setup a static website. Look no further !! In this post we go over the basics of setting up a HUGO site
 tags:
   - blog
-  - HUGO
+  - hugo
   - web
   - development
 author: ahmza

content/posts/setup-wsl/index.md

@@ -36,7 +36,7 @@ wsl --install
 Go to the Microsoft store and search for a Linux distribution. I prefer
 to use the "Ubuntu" distribution.
 
-![Microsoft Store](/img/WSL/ubuntu.webp)
+![Ubuntu in the Microsoft Store](ubuntu.webp)
 
 Once installed, go ahead and run the distribution, after it finishes setting
 itself up it will ask you for a username and password. These credentials are
@@ -51,7 +51,7 @@ I use the windows terminal app to run the Ubuntu distribution, it makes
 customising the environment a lot easier. To download it head over to the
 Microsoft store and search for Windows Terminal and download it.
 
-![Microsoft Store](/img/WSL/winterm.webp)
+![Windows Terminal in the Microsoft Store](winterm.webp)
 
 When you login to WSL it will not default to your home directory. To fix that go
 to the Windows Terminal Settings look for Ubuntu or your distributions name and
@@ -61,11 +61,11 @@ change the Starting directory to
 \\wsl$\<distro>\home\<username>
 ```
 
-> Be sure to change "<distro>" to your distributions name
+> Be sure to change `<distro>` to your distributions name
 
-> Be sure to change "<username>" to your username
+> Be sure to change `<username>` to your username
 
-![winterm-settings](/img/WSL/winterm-settings.webp)
+![Windows Terminal settings](winterm-settings.webp)
 
 ## **Conclusion**
 

content/posts/welcome/index.md

@@ -1,5 +1,6 @@
 ---
 title: Welcome
+description: The mandatory hello world post — a quick intro to who I am and what this blog is about.
 tags:
   - blog
   - misc

docs/caddy-reverse-proxy.md

@@ -99,14 +99,31 @@ committed [`Caddyfile`](../Caddyfile) at the repo root; copy it to the
   i.e. a **blank page**.
 - **`encode zstd gzip`** — compression happens here (SWS has it disabled).
 - **`header { ... }`** — security headers (SWS has them disabled).
-- **`trusted_proxies static <Cloudflare ranges>`** + **`client_ip_headers
+- **`trusted_proxies cloudflare { ... }`** + **`client_ip_headers
   Cf-Connecting-Ip X-Forwarded-For`** — so the real visitor IP is used for
   logging/matchers, but only when the request genuinely comes from Cloudflare
-  (prevents header spoofing from any other source). The ranges come from
-  <https://www.cloudflare.com/ips-v4/> and <https://www.cloudflare.com/ips-v6/>;
-  keep them in sync when Cloudflare updates them. If `caddy-cf` is rebuilt with
-  the `caddy-cloudflare-ip` plugin, the static list can be replaced with
-  `trusted_proxies cloudflare`.
+  (prevents header spoofing from any other source). The `cloudflare` IP source
+  ([WeidiDeng/caddy-cloudflare-ip](https://github.com/WeidiDeng/caddy-cloudflare-ip),
+  baked into the `caddy-cf` image) auto-fetches the ranges from
+  <https://www.cloudflare.com/ips-v4/> and <https://www.cloudflare.com/ips-v6/>
+  and refreshes them on the configured `interval`, so there is no static list to
+  maintain:
+
+  ```caddy
+  trusted_proxies cloudflare {
+  	interval 12h
+  	timeout 15s
+  }
+  ```
+
+  `client_ip_headers` lists which header holds the real visitor IP:
+  `Cf-Connecting-Ip` is Cloudflare's single authoritative end-user IP, with
+  `X-Forwarded-For` as the fallback. It is only trusted for requests coming from
+  the `trusted_proxies` above.
+
+  > If you ever run without the `caddy-cloudflare-ip` plugin, you can instead
+  > pin the static ranges with `trusted_proxies static <ip/cidr ...>` copied
+  > from the Cloudflare IP pages, but then you must keep them in sync manually.
 
 Deploy and reload:
 

go.mod

@@ -2,4 +2,4 @@ module github.com/ahmzaa/blog-ahmza-com
 
 go 1.24.3
 
-require github.com/nunocoracao/blowfish/v2 v2.86.0 // indirect
+require github.com/nunocoracao/blowfish/v3 v3.4.0

go.sum

@@ -0,0 +1,2 @@
+github.com/nunocoracao/blowfish/v3 v3.4.0 h1:Fv7mS97lagllTGzHA2V1H6+N5fuQd3DuWmOQlFFV4Aw=
+github.com/nunocoracao/blowfish/v3 v3.4.0/go.mod h1:8lJwR95VgcyWDhjKvUJMdOQXogrmhYSxkWh4ogSJfCg=

layouts/_default/_markup/render-link.html

@@ -1 +1 @@
-<a href="{{ .Destination | safeURL }}"{{ with .Title}} title="{{ . }}"{{ end }}{{ if strings.HasPrefix .Destination "http" }} target="_blank"{{ end }}>{{ .Text | safeHTML }}</a>
+<a href="{{ .Destination | safeURL }}"{{ with .Title}} title="{{ . }}"{{ end }}{{ if strings.HasPrefix .Destination "http" }} target="_blank" rel="noopener noreferrer"{{ end }}>{{ .Text | safeHTML }}</a>

layouts/partials/extend-footer.html

@@ -1,6 +1,8 @@
 <br>
 <div class="flex items-center gap-x-5">
-	<a class="text-sm text-neutral-500 dark:text-neutral-400 rel='me'" href="https://mastodon.social/@ahmza">Mastodon</a>
-	<a class="text-sm text-neutral-500 dark:text-neutral-400 rel='me'" href="https://github.com/ahmzaa">Github</a>
-	<a class="text-sm text-neutral-500 dark:text-neutral-400 rel='me'" href="https://www.linkedin.com/in/ahmza/">Linkedin</a>
+	<a class="text-sm text-neutral-500 dark:text-neutral-400" rel="me noopener noreferrer" target="_blank" href="https://mastodon.social/@ahmza">Mastodon</a>
+	<a class="text-sm text-neutral-500 dark:text-neutral-400" rel="me noopener noreferrer" target="_blank" href="https://www.linkedin.com/in/ahmza/">Linkedin</a>
+	<a class="text-sm text-neutral-500 dark:text-neutral-400" rel="me noopener noreferrer" target="_blank" href="https://github.com/ahmzaa">Github</a>
+	<a class="text-sm text-neutral-500 dark:text-neutral-400" rel="me noopener noreferrer" target="_blank" href="https://gitlab.com/ahmza">Gitlab</a>
+	<a class="text-sm text-neutral-500 dark:text-neutral-400" rel="me noopener noreferrer" target="_blank" href="https://tea.ahmza.com/ahmza">Gitea</a>
 </div>

layouts/shortcodes/image.html

@@ -1 +1 @@
-<img src="{{ .Get "url"}}" alt="{{ .Get "alt"}}" style="display:block;margin-left:auto;margin-right:auto;width:50%;height:auto;padding:10px;">
+<img src="{{ .Get "url"}}" alt="{{ .Get "alt"}}" loading="lazy" decoding="async" style="display:block;margin-left:auto;margin-right:auto;width:50%;height:auto;padding:10px;">

layouts/shortcodes/video.html

@@ -1,4 +1,4 @@
-<video autoplay loop muted playsinline aria-label='{{ .Get "label"}}' style="display:block;margin-left:auto;margin-right:auto;width:50%;height:auto;padding:10px;">
+<video autoplay loop muted playsinline preload="metadata" aria-label='{{ .Get "label"}}' style="display:block;margin-left:auto;margin-right:auto;width:50%;height:auto;padding:10px;">
     {{ with .Get "mp4" }}<source src="{{ . }}" type="video/mp4">{{ end }}
     {{ with .Get "webm" }}<source src="{{ . }}" type="video/webm">{{ end }}
 </video>

static/admin/config.yml

@@ -1,69 +0,0 @@
-## Commit messages
-backend:
-  name: github
-  repo: ahmzaa/blog-ahmza-com
-  branch: main
-  squash_merges: true
-  base_url: https://sveltia-cms-auth.hamzaahmed12328.workers.dev
-  use_graphql: true
-  commit_messages:
-    create: Create {{collection}} "{{slug}}"
-    update: Update {{collection}} "{{slug}}"
-    delete: Delete {{collection}} "{{slug}}"
-    uploadMedia: Upload "{{path}}"
-    deleteMedia: Delete "{{path}}"
-    openAuthoring: '{{message}}'
-
-## Publish mode
-publish_mode: editorial_workflow # Allowed Values: simple, editorial_workflow
-
-## Media and Public folders
-#Media
-media_folder: "assets/uploaded/img"
-public_folder: "/uploaded/img"
-
-## SiteTitle
-site_url: htpps://blog.ahmza.com
-display_url: blog.ahmza.com
-logo_url: https://blog.ahmza.com/logo.webp
-
-## Collections
-collections:
-  - name: posts
-    identifier_field: name
-    label: posts
-    label_singular: post
-    icon: article
-    description: sites main content, blog posts
-    folder: "content/posts"
-    path: "{{slug}}/index"
-    media_folder: ""
-    public_folder: ""
-    create: true
-    slug: '{{slug}}'
-    fields:
-      - {label: "Title", name: "title", widget: "string"}
-      - {label: "Featured Image", name: "featureimage", widget: "image"}
-      - {label: "Featured Image Caption", name: "featureimagecaption", widget: "string"}
-      - {label: "Publish Date", name: "date", widget: "datetime", default: "{{now}}", date_format: "YYYY-MM-DD"}
-      - {label: "Last Modified", name: "lastmod", widget: "datetime", default: "{{now}}", date_format: "YYYY-MM-DD"}
-      - {label: "Author", name: "author", widget: "string", default: "ahmza"}
-      - {label: "Draft", name: "draft", widget: "boolean", default: "false"}
-      - {label: "Tags", name: "tags", widget: "list"}
-      - {label: "Description", name: "description", widget: "string"}
-      - {label: "Body", name: "body", widget: "markdown"}
-    extension: md
-    sortable_fields: ['title', 'date', 'lastmod', 'tags']
-    view_filters:
-      - label: "ahmza's posts"
-        field: author
-        pattern: 'ahmza'
-      - label: Drafts
-        field: draft
-        pattern: true
-    view_groups:
-      - label: Year
-        field: date
-        pattern: \d{4}
-      - label: Drafts
-        field: draft

static/admin/index.html

@@ -1,14 +0,0 @@
-<!DOCTYPE html>
-<html>
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <meta name="robots" content="noindex" />
-    <title>Content Manager</title>
-    <!-- Include the script that enables Netlify Identity on this page. -->
-  </head>
-  <body>
-    <!-- Include the script that builds the page and powers Decap CMS -->
-    <script src="https://unpkg.com/@sveltia/cms/dist/sveltia-cms.js"></script>
-  </body>
-</html>

sws.toml

@@ -31,9 +31,10 @@ cache-control-headers = true
 
 #### Routing
 
-# SPA-style fallback: serve index.html when a path is not found on disk,
-# mirroring the previous nginx `try_files $uri $uri/ /index.html`.
-page-fallback = "/public/index.html"
+# No SPA-style page fallback: this is a static Hugo site, not a single-page app.
+# Missing paths should return Hugo's generated 404.html with a real 404 status
+# (SWS serves /public/404.html automatically) rather than masking broken links
+# with a 200 homepage response, which harms SEO (soft 404s).
 
 #### Security