How this site works

$ cat goal

I wanted a portfolio that loads fast, is easy to keep up to date, and that I can publish without worrying I've leaked something from my lab.

$ cat design

All the text on the site (project cards, notes, certs, bio) lives in one data file. A small build script I wrote reads that file and fills it into plain HTML pages. Cloudflare Pages then serves those pages straight from my GitHub repo. When I push, the site updates.

$ cat decisions

I skipped frameworks and static site generators. I wanted to understand every file that ships, and a short script I wrote myself is easier to audit than a framework's dependencies.

I commit the built pages instead of building them on Cloudflare. What's in the repo is exactly what's live.

Fonts are hosted on the site itself, and the security policy only allows the site to load its own files. Nothing calls out to third parties.

$ cat gotchas

After the first deploy, browsers kept showing the old stylesheet. The build now adds a version tag to the CSS and JS links, so each change forces a fresh download.

Security headers only apply once the site is deployed. They don't show up in a local preview, so I check them on the live site.

$ cat verify

The build fails if a private IP address shows up in any page. That check exists because my source notes are full of them. The live site scores A+ on securityheaders.com.

$ cat lessons

A boring stack is easy to secure. The leak check has already earned its place: writing about a homelab means constantly scrubbing internal details.