Fix codebase audit findings: bugs, security, perf, content #3

2026-07-25T02:37:10Z

ahmza commented

2026-07-25 02:37:10 +00:00

Fixes a batch of issues found in a full codebase audit.

🔴 Bugs

Broken images on published posts: setup-wsl referenced /img/WSL/*.webp which don't exist — the images live in the page bundle. Fixed to bundle-relative paths (they now get Blowfish responsive srcset + lazy-load). Improved alt text too.
pi-docker-swarm: removed a broken reference to a missing cluster.webp (alt text literally said "fix this image").
Silently dropped content: with markup unsafe=false, <placeholder> text in prose/blockquotes (e.g. <distro>, <username>, <user>, <version>, <ip address>) was being dropped by Goldmark. Wrapped them in backticks across setup-wsl, securing-ssh, pi-docker-swarm, mc-server-on-docker. This eliminated all "Raw HTML omitted" build warnings.
archetypes/posts.md: fixed malformed { { }} template so hugo new produces valid front matter.
arrstack: renamed arrstack.md → index.md so it's a proper leaf bundle like every other post.
CMS config: fixed htpps:// → https:// typo in static/admin/config.yml.

🟠 Security

render-link.html: external target="_blank" links now get rel="noopener noreferrer" (prevents reverse tabnabbing / referrer leak).
extend-footer.html: rel='me' was trapped inside the class attribute, so Mastodon/rel-me verification silently failed. Moved to a real rel="me noopener noreferrer" + target.
static/admin/index.html: pinned Sveltia CMS to @0.172.4 via jsDelivr with a Subresource Integrity hash + crossorigin (was loading latest from unpkg with no pin/SRI — arbitrary-code risk in an admin session with repo write access).

🟡 Performance

hugo.toml: ignoreFiles for *.aseprite/*.bak — stops shipping 9 source-art files (+ a stray backup) into the built site (non-page files dropped 23 → 13).
video shortcode: preload="metadata"; image shortcode: loading="lazy" decoding="async".
sws.toml: removed the SPA page-fallback so missing paths return a real 404 (Hugo's 404.html) instead of a soft-404 homepage with HTTP 200. Better for SEO and surfaces broken links.

🔵 Content / SEO

Normalized tag casing (HomeLab/RemoteAccess/SSH/HUGO → lowercase) so they don't create duplicate tag pages; fixed prodcutivity typo; arrstack tags: [""] → [] (was creating an empty tag term page); added a description to the welcome post.
Deleted stray index.md.bak.

Verification

docker build succeeds; all "Raw HTML omitted" warnings are gone.
Confirmed in the built site: setup-wsl images resolve with responsive srcset; placeholders render as inline code; external links carry rel="noopener noreferrer"; 404.html present; no .aseprite/.bak shipped.

Note

There's a harmless pre-existing build warning that the Blowfish module lists Hugo 0.87.0/0.147.5 compatibility vs the 0.157.0 build image — not addressed here; the site builds and renders fine.

Fixes a batch of issues found in a full codebase audit. ## 🔴 Bugs - **Broken images on published posts**: `setup-wsl` referenced `/img/WSL/*.webp` which don't exist — the images live in the page bundle. Fixed to bundle-relative paths (they now get Blowfish responsive `srcset` + lazy-load). Improved alt text too. - **`pi-docker-swarm`**: removed a broken reference to a missing `cluster.webp` (alt text literally said "fix this image"). - **Silently dropped content**: with `markup unsafe=false`, `<placeholder>` text in prose/blockquotes (e.g. `<distro>`, `<username>`, `<user>`, `<version>`, `<ip address>`) was being dropped by Goldmark. Wrapped them in backticks across `setup-wsl`, `securing-ssh`, `pi-docker-swarm`, `mc-server-on-docker`. This eliminated all "Raw HTML omitted" build warnings. - **`archetypes/posts.md`**: fixed malformed `{ { }}` template so `hugo new` produces valid front matter. - **`arrstack`**: renamed `arrstack.md` → `index.md` so it's a proper leaf bundle like every other post. - **CMS config**: fixed `htpps://` → `https://` typo in `static/admin/config.yml`. ## 🟠 Security - `render-link.html`: external `target="_blank"` links now get `rel="noopener noreferrer"` (prevents reverse tabnabbing / referrer leak). - `extend-footer.html`: `rel='me'` was trapped **inside the `class` attribute**, so Mastodon/rel-me verification silently failed. Moved to a real `rel="me noopener noreferrer"` + `target`. - `static/admin/index.html`: pinned Sveltia CMS to `@0.172.4` via jsDelivr with a Subresource Integrity hash + `crossorigin` (was loading `latest` from unpkg with no pin/SRI — arbitrary-code risk in an admin session with repo write access). ## 🟡 Performance - `hugo.toml`: `ignoreFiles` for `*.aseprite`/`*.bak` — stops shipping 9 source-art files (+ a stray backup) into the built site (non-page files dropped 23 → 13). - `video` shortcode: `preload="metadata"`; `image` shortcode: `loading="lazy" decoding="async"`. - `sws.toml`: removed the SPA `page-fallback` so missing paths return a real **404** (Hugo's `404.html`) instead of a soft-404 homepage with HTTP 200. Better for SEO and surfaces broken links. ## 🔵 Content / SEO - Normalized tag casing (`HomeLab`/`RemoteAccess`/`SSH`/`HUGO` → lowercase) so they don't create duplicate tag pages; fixed `prodcutivity` typo; `arrstack` `tags: [""]` → `[]` (was creating an empty tag term page); added a `description` to the `welcome` post. - Deleted stray `index.md.bak`. ## Verification - `docker build` succeeds; **all "Raw HTML omitted" warnings are gone**. - Confirmed in the built site: setup-wsl images resolve with responsive `srcset`; placeholders render as inline code; external links carry `rel="noopener noreferrer"`; `404.html` present; no `.aseprite`/`.bak` shipped. ## Note There's a harmless pre-existing build warning that the Blowfish module lists Hugo `0.87.0/0.147.5` compatibility vs the `0.157.0` build image — not addressed here; the site builds and renders fine.

ahmza added 1 commit 2026-07-25 02:37:10 +00:00

Fix audit findings: bugs, security, perf, content f402556380

Bugs:
- setup-wsl: fix broken /img/WSL/* image paths (now bundle-relative;
  images were broken on the published post) + better alt text
- pi-docker-swarm: remove broken missing cluster.webp reference
- archetypes/posts.md: fix malformed {{ }} template so 'hugo new' works
- rename arrstack/arrstack.md -> index.md so it's a proper leaf bundle
- static/admin/config.yml: fix 'htpps' -> 'https' site_url typo
- fix silently-dropped <placeholder> text (unsafe=false dropped them):
  wrap <distro>/<username>/<user>/<version>/<ip address> etc in backticks
  across setup-wsl, securing-ssh, pi-docker-swarm, mc-server-on-docker

Security:
- render-link.html: add rel=noopener noreferrer to external target=_blank
- extend-footer.html: fix rel='me' trapped in class attr (broke Mastodon
  verification); add proper rel/target
- static/admin/index.html: pin Sveltia CMS to 0.172.4 via jsDelivr + SRI

Performance:
- hugo.toml: ignoreFiles for *.aseprite/*.bak (stop shipping source art;
  non-page files 23 -> 13)
- video shortcode: preload=metadata; image shortcode: loading=lazy decoding=async
- sws.toml: drop SPA page-fallback so missing paths return real 404 (404.html)

Content/SEO:
- normalize tag casing (HomeLab/RemoteAccess/SSH/HUGO -> lowercase),
  fix 'prodcutivity' typo, arrstack tags:[""] -> [], add welcome description
- delete stray index.md.bak

ahmza merged commit f927bc191c into main

2026-07-25 02:38:13 +00:00

ahmza referenced this pull request

2026-07-25 04:08:41 +00:00

Use dynamic cloudflare trusted_proxies IP source #5

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: ahmza/blog-ahmza-com#3