cmc/cleberg.net

 1#+title: uses
 2#+slug: index
 3#+options: toc:nil
 4
 5Tools powering this site and the infrastructure behind it. Each entry includes a
 6threat model justification.
 7
 8* Philosophy
 9
10- Own the hardware or you don't own the content.
11- Zero tracking. No cookies. No analytics. No exceptions.
12- Full rebuild from source on a fresh OS in under an hour.
13- One tool per job. No dependencies that rot.
14
15* Software
16
17| Technology            | What I Use            | Threat Model                                                                                        |
18|-----------------------+-----------------------+-----------------------------------------------------------------------------------------------------|
19| Registrar             | [[https://cloudflare.com][Cloudflare]]            | WHOIS privacy, low cost, integrates cleanly if you use other Cloudflare products.                   |
20| DNS                   | [[https://cloudflare.com][Cloudflare]]            | Portable DNS, secure infrastructure, and acceptable privacy.                                        |
21| Security              | [[https://cloudflare.com][Cloudflare]] + [[https://github.com/fail2ban/fail2ban][fail2ban]] | Automated auth-failure bans. Minimal Cloudflare functionality enabled.                              |
22| Routing               | [[https://ui.com/][UniFi]]                 | Local network segmentation.                                                                         |
23| Server                | [[https://cleberg.net/blog/server-build.html][Self-hosted]]           | Physical control. No hypervisor escape vector. No subpoena to a DC.                                 |
24| Operating System      | [[https://ubuntu.com][Ubuntu]] + [[https://www.apple.com/os/macos/][macOS]]        | Ubuntu: telemetry off, LTS, stable. macOS: workstation only.                                        |
25| Web Server            | [[https://nginx.org][Nginx]] + [[https://community.torproject.org/onion-services/setup/][Tor]]           | Static file serving. Tor layer for censored-network access.                                         |
26| SSL                   | [[https://certbot.eff.org][Certbot]]               | Free automated TLS. No commercial CA dependency. Ensures Cloudflare can't view unencrypted traffic. |
27| Static Site Generator | [[https://github.com/krazywarez/orgo][orgo]] + [[https://github.com/ccleberg/cleberg.net/blob/main/build.py][build.py]]       | Org-mode source compiles to plaintext HTML. Single binary, no runtime.                              |
28| Terminal              | [[https://iterm2.com/][iTerm2]]                | Functional. Inherited from macOS.                                                                   |
29| Shell                 | [[https://www.zsh.org/][Zsh]]                   | Portable, POSIX-adjacent, available on every target OS.                                             |
30| Editor                | [[https://github.com/doomemacs/doomemacs][Doom Emacs]]            | Editor and markup are the same tool. No proprietary format.                                         |
31| Markup Language       | [[https://orgmode.org][org-mode]]              | Plain text. Readable without any software. Version-control native.                                  |
32| Image Processing      | [[https://github.com/Homebrew/homebrew-core/blob/HEAD/Formula/w/webp.rb][webP (CLI)]]            | CLI-only. No GUI, no cloud, no account.                                                             |
33| Browser(s)            | [[https://www.torproject.org/][Tor]] + [[https://librewolf.net][LibreWolf]]       | Tor for anonymity-critical use. LibreWolf for hardened daily use.                                   |
34| Version Control       | [[https://git-scm.com/][Git (CLI)]]             | Decentralized. The repo is the backup.                                                              |
35| Git Host              | [[https://github.com/ccleberg][GitHub]] + [[https://sr.ht][SourceHut]]    | GitHub is the primary and SourceHut is the mirror.                                                  |
36| CI/CD                 | [[https://github.com/ccleberg/cleberg.net/blob/main/build.py][build.py]]              | A Python script and SSH. No pipeline to depend on.                                                  |
37| Email Host            | [[https://migadu.com][Migadu]]                | Straightforward usage-based provider from Switzerland.                                              |
38| Search Engine         | [[https://docs.searxng.org/][SearXNG]] (self-hosted) | Queries route through my own instance. No third-party search profile.                               |
39| Backups               | N/A                   | Nothing to back up. No user data. Source mirrored via Git.                                          |
40| Monitoring            | N/A                   | Monitoring creates logs. Logs are a liability.                                                      |
41| Analytics             | N/A                   | No interest in visitor data. Content finds its way via RSS.                                         |
42| Social Media          | N/A                   | —                                                                                                   |
43| Newsletter            | RSS Only              | No subscriber list. No email vendor. No data relationship.                                          |
44
45* Hardware
46
47Custom rack-mounted server. Physical control, no hypervisor, no vendor lock-in.
48See: [[https://cleberg.net/blog/server-build.html][server build post]].
49
50| Component     | Spec                                |
51|---------------+-------------------------------------|
52| Chassis       | Rosewill RSV-R4100U 4U Rackmount    |
53| Motherboard   | NZXT B550                           |
54| CPU           | AMD Ryzen 7 5700G                   |
55| RAM           | 64GB DDR4 (2x32GB)                  |
56| Boot Drive    | 500GB WD M.2 NVMe SSD               |
57| Storage (HDD) | 6 x 8TB WD Red Plus                 |
58| PSU           | Corsair RM850                       |
59| Cooling       | Noctua (1x120mm front, 2x80mm rear) |
60
61Physical hardware under personal control eliminates the hypervisor escape vector
62and the cloud provider subpoena vector. Full recovery from a fresh OS install:
63under one hour.
64
65Secondary: Raspberry Pi 4 for miscellaneous self-hosted services.