cmc/cleberg.net

My personal web garden & blog. blog personal website https://cleberg.net

Commit b69cb680e8

b69cb680e8d6437a795c0aa50aa3309e4d9047ad

parent: 72be6e9683

Verified · cmc

cmc <hello@cleberg.net> · 2026-04-08 15:55 UTC 

update /now page

Layout: unified · split

content/now/index.org +20 −23
@@ -1,48 +1,45 @@
1#+title: now 1#+title: now
2#+slug: index 2#+slug: index
3#+options: toc:nil 3#+options: toc:nil
4#+date: [2026-01-31 Sat 10:17:09] 4#+date: [2026-04-08 Wed 10:54:00]
5#+description: Read about what I'm doing now. 5#+description: Read about what I'm doing now.
6 6
7This is a [[https://nownownow.com/about][/now]] page. 7This is a [[https://nownownow.com/about][/now]] page.
8 8
9* Work 9* Work
10 10
11- Closing out the remaining 12/31 clients and moving on to my 3/31 client. 11- Steadily working through my 3/31 client and working through planning and
12- Making /waves/ with the big wigs on automation and standardization initiatives I 12 walkthroughs for all my 9/30 and 12/31 clients.
13 will be leading nationally. 13- Launching my national Automation & AI initiative for the US today.
14 14
15* Media 15* Media
16 16
17/I play and watch way too many games, shows, and movies to list them all here. If 17/I play and watch way too many games, shows, and movies to list them all here.
18you're actually interested, email or message me to talk about media!/ 18If you're actually interested, email or message me to talk about media!/
19 19
20- Playing some games: 20- Playing some games:
21 - Cyberpunk 2077 21 - Diablo IV
22 - Descenders 22 - Rocket League
23 - Runescape 3 23 - Runescape 3
24- Watching some shows: 24- Watching some shows:
25 - Akudama Drive (2020) 25 - Fallout (2024)
26 - Gachiakuta (2025) 26 - Home Improvement (1991)
27 - Jujutsu Kaisen (2020) 27 - Ridiculousness (2011)
28 - Michiko & Hatchin (2008)
29 - Solo Leveling (2024)
30- Watched some movies: 28- Watched some movies:
31 - Get On Up (2014) 29 - The Banshees of Inisherin (2022)
32 - Leaving Las Vegas (1995) 30 - I'm Thinking of Ending Things (2020)
33 - Steve-O's Bucket List (2023) 31 - Solo Mio (2026)
34 32
35* Tech 33* Tech
36 34
37- Leaning more into Emacs + Org-Mode. 35- Launched 3 iOS apps:
38- Standardizing an iTerm + Doom Emacs configuration that works across personal 36 - [[https://apps.apple.com/us/app/daybyday-learn/id6760321939][DayByDay]]: A simple children's learning app
39 and work machines. 37 - [[https://apps.apple.com/us/app/domaindig/id6760368004][DomainDig]]: A handy DNS lookup tool with many features
38 - [[https://apps.apple.com/us/app/hutch-for-sourcehut/id6760742299][Hutch for SourceHut]]: A polished SourceHut client in native Swift
39- Continuing to optimize my website and servers.
40 40
41* Hobbies 41* Hobbies
42 42
43- Picking back up more home maintenance now that the temperatures aren't 43=Error: Time for hobbies not found=
44 negative outside.
45- Modifying my truck for better hauling, towing, and off-road and all-season
46 utility.
47 44
48View the historical [[https://git.sr.ht/~ccleberg/cleberg.net/log/main/item/content/now/index.org][log of changes]] for this page. 45View the historical [[https://git.sr.ht/~ccleberg/cleberg.net/log/main/item/content/now/index.org][log of changes]] for this page.
content/uses/index.org +39 −40
@@ -2,9 +2,8 @@
2#+slug: index 2#+slug: index
3#+options: toc:nil 3#+options: toc:nil
4 4
5Tools powering this site and the infrastructure behind it. Each entry includes 5Tools powering this site and the infrastructure behind it. Each entry includes a
6a threat model justification and an exit strategy. ~TECHNICAL DEBT~ flags items 6threat model justification.
7with no clean migration path or active sovereignty risk.
8 7
9* Philosophy 8* Philosophy
10 9
@@ -15,49 +14,49 @@ with no clean migration path or active sovereignty risk.
15 14
16* Software 15* Software
17 16
18| Technology | What I Use | Threat Model | Exit Strategy | 17| Technology | What I Use | Threat Model |
19|-----------------------+-----------------------+------------------------------------------------------------------------+--------------------------------------------------------------------------------------------------------------| 18|-----------------------+-------------------------+-----------------------------------------------------------------------------------------------------|
20| Registrar | [[https://njal.la][Njalla]] | Registers domains on your behalf. No WHOIS identity exposure. | Any registrar accepting anonymous payment. Portable. | 19| Registrar | [[https://njal.la][Njalla]] | Registers domains on your behalf. No WHOIS identity exposure. |
21| DNS | [[https://njal.la][Njalla]] | Same as above. DNS records are portable on day one. | Self-hosted BIND or any other provider. | 20| DNS | [[https://cloudflare.com][Cloudflare]] | Portable DNS, secure infrastructure, and acceptable privacy. |
22| Security | [[https://github.com/fail2ban/fail2ban][fail2ban]] | Automated auth-failure bans. No cloud WAF. No data leaving machine. | nftables rate limiting or self-hosted crowdsec. | 21| Security | [[https://cloudflare.com][Cloudflare]] + [[https://github.com/fail2ban/fail2ban][fail2ban]] | Automated auth-failure bans. Minimal Cloudflare functionality enabled. |
23| Routing | [[https://ui.com/][UniFi]] | Local network segmentation. Controller must run self-hosted. | ~TECHNICAL DEBT~ - cloud dependencies by default. OpenWrt on compatible HW. | 22| Routing | [[https://ui.com/][UniFi]] | Local network segmentation. |
24| Server | [[https://cleberg.net/blog/server-build.html][Self-hosted]] | Physical control. No hypervisor escape vector. No subpoena to a DC. | N/A. This is the exit strategy. | 23| Server | [[https://cleberg.net/blog/server-build.html][Self-hosted]] | Physical control. No hypervisor escape vector. No subpoena to a DC. |
25| Operating System | [[https://ubuntu.com][Ubuntu]] + [[https://www.apple.com/os/macos/][macOS]] | Ubuntu: telemetry off, LTS, stable. macOS: workstation only. | Ubuntu → Debian. macOS → ~TECHNICAL DEBT~. Target: NixOS/Fedora on ThinkPad or Framework. | 24| Operating System | [[https://ubuntu.com][Ubuntu]] + [[https://www.apple.com/os/macos/][macOS]] | Ubuntu: telemetry off, LTS, stable. macOS: workstation only. |
26| Web Server | [[https://nginx.org][Nginx]] + [[https://community.torproject.org/onion-services/setup/][Tor]] | Static file serving. Tor layer for censored-network access. | Caddy or lighttpd. Tor is already the exit layer. | 25| Web Server | [[https://nginx.org][Nginx]] + [[https://community.torproject.org/onion-services/setup/][Tor]] | Static file serving. Tor layer for censored-network access. |
27| SSL | [[https://certbot.eff.org][Certbot]] | Free automated TLS. No commercial CA dependency. | acme.sh. Same protocol, no Python dependency. | 26| SSL | [[https://certbot.eff.org][Certbot]] | Free automated TLS. No commercial CA dependency. Ensures Cloudflare can't view unencrypted traffic. |
28| Static Site Generator | [[https://github.com/emacs-love/weblorg][Weblorg]] + [[https://git.sr.ht/~ccleberg/cleberg.net/tree/main/item/build.py][build.py]] | Org-mode source compiles to plaintext HTML. No JS build chain. | Pandoc + shell script. Source files survive any generator change. | 27| Static Site Generator | [[https://github.com/emacs-love/weblorg][Weblorg]] + [[https://git.sr.ht/~ccleberg/cleberg.net/tree/main/item/build.py][build.py]] | Org-mode source compiles to plaintext HTML via native Lisp. |
29| Terminal | [[https://iterm2.com/][iTerm2]] | Functional. Inherited from macOS. | ~TECHNICAL DEBT~ - macOS-only. Target: foot or Alacritty on Linux. | 28| Terminal | [[https://iterm2.com/][iTerm2]] | Functional. Inherited from macOS. |
30| Shell | [[https://www.zsh.org/][Zsh]] | Portable, POSIX-adjacent, available on every target OS. | bash or fish. Config is plain text. | 29| Shell | [[https://www.zsh.org/][Zsh]] | Portable, POSIX-adjacent, available on every target OS. |
31| Editor | [[https://github.com/doomemacs/doomemacs][Doom Emacs]] | Editor and markup are the same tool. No proprietary format. | Vanilla Emacs + org-mode. Doom is a config layer only. | 30| Editor | [[https://github.com/doomemacs/doomemacs][Doom Emacs]] | Editor and markup are the same tool. No proprietary format. |
32| Markup Language | [[https://orgmode.org][org-mode]] | Plain text. Readable without any software. Version-control native. | N/A. Org files are the source of truth. | 31| Markup Language | [[https://orgmode.org][org-mode]] | Plain text. Readable without any software. Version-control native. |
33| Image Processing | [[https://github.com/Homebrew/homebrew-core/blob/HEAD/Formula/w/webp.rb][webP (CLI)]] | CLI-only. No GUI, no cloud, no account. | ImageMagick or cwebp. Trivial swap. | 32| Image Processing | [[https://github.com/Homebrew/homebrew-core/blob/HEAD/Formula/w/webp.rb][webP (CLI)]] | CLI-only. No GUI, no cloud, no account. |
34| Browser(s) | [[https://www.torproject.org/][Tor]] + [[https://librewolf.net/][LibreWolf]] | Tor for anonymity-critical use. LibreWolf for hardened daily use. | N/A. Safari dropped - proprietary and redundant. | 33| Browser(s) | [[https://www.torproject.org/][Tor]] + [[https://www.apple.com/safari/][Safari]] | Tor for anonymity-critical use. Safari for hardened daily use. |
35| Version Control | [[https://git-scm.com/][Git (CLI)]] | Decentralized. The repo is the backup. | N/A. Content is portable to any host. | 34| Version Control | [[https://git-scm.com/][Git (CLI)]] | Decentralized. The repo is the backup. |
36| Git Host | [[https://github.com/ccleberg][GitHub]] | Public mirror only. | ~TECHNICAL DEBT~ - Microsoft-owned. Target: self-hosted Forgejo. One-line remote URL change. | 35| Git Host | [[https://sr.ht][SourceHut]] + [[https://github.com/ccleberg][GitHub]] | SourceHut is the primary and GitHub is the mirror. |
37| CI/CD | [[https://git.sr.ht/~ccleberg/cleberg.net/tree/main/item/build.py][build.py]] + [[https://www.openssh.org/][OpenSSH]] | A Python script and SSH. No CI runner, no stored secrets, no webhooks. | A shell script. Python is not load-bearing here. | 36| CI/CD | [[https://git.sr.ht/~ccleberg/cleberg.net/tree/main/item/build.py][build.py]] + [[https://builds.sr.ht][builds.sr.ht]] | A Python script and SSH. builds.sr.ht for convenience, but not required. |
38| Email Host | [[https://soverin.com/][Soverin]] | Privacy-focused provider. Better than Gmail. | ~TECHNICAL DEBT~ - not self-hosted. Target: Postfix + Dovecot + Rspamd, or maddy. MX records portable day one. | 37| Email Host | [[https://soverin.com/][Soverin]] | Privacy-focused provider. |
39| Search Engine | [[https://docs.searxng.org/][SearXNG]] (self-hosted) | Queries route through own instance. No third-party search profile. | Any other self-hosted SearXNG instance. | 38| Search Engine | [[https://docs.searxng.org/][SearXNG]] (self-hosted) | Queries route through my own instance. No third-party search profile. |
40| Backups | N/A | Nothing to back up. No user data. Source mirrored via Git. | Intentional. If this changes: restic to a local target. | 39| Backups | N/A | Nothing to back up. No user data. Source mirrored via Git. |
41| Monitoring | N/A | Monitoring creates logs. Logs are a liability. | Intentional. | 40| Monitoring | N/A | Monitoring creates logs. Logs are a liability. |
42| Analytics | N/A | No interest in visitor data. Content finds its way via RSS. | Intentional. | 41| Analytics | N/A | No interest in visitor data. Content finds its way via RSS. |
43| Social Media | N/A | — | Intentional. | 42| Social Media | N/A | — |
44| Newsletter | RSS Only | No subscriber list. No email vendor. No data relationship. | N/A. | 43| Newsletter | RSS Only | No subscriber list. No email vendor. No data relationship. |
45 44
46* Hardware 45* Hardware
47 46
48Custom rack-mounted server. Physical control, no hypervisor, no vendor lock-in. 47Custom rack-mounted server. Physical control, no hypervisor, no vendor lock-in.
49See: [[https://cleberg.net/blog/server-build.html][server build post]]. 48See: [[https://cleberg.net/blog/server-build.html][server build post]].
50 49
51| Component | Spec | Threat Model / Notes | 50| Component | Spec |
52|---------------+----------------------------------------------------+------------------------------------------------------------| 51|---------------+-------------------------------------|
53| Chassis | Rosewill RSV-R4100U 4U Rackmount | — | 52| Chassis | Rosewill RSV-R4100U 4U Rackmount |
54| Motherboard | NZXT B550 | — | 53| Motherboard | NZXT B550 |
55| CPU | AMD Ryzen 7 5700G | Onboard GPU eliminates need for discrete card in the rack. | 54| CPU | AMD Ryzen 7 5700G |
56| RAM | 64GB DDR4 (2x32GB) | — | 55| RAM | 64GB DDR4 (2x32GB) |
57| Boot Drive | 500GB WD M.2 NVMe SSD | — | 56| Boot Drive | 500GB WD M.2 NVMe SSD |
58| Storage (HDD) | 1x10TB WD White, 1x8TB WD White, 2x8TB WD Red Plus | — | 57| Storage (HDD) | 6 x 8TB WD Red Plus |
59| PSU | Corsair RM850 | — | 58| PSU | Corsair RM850 |
60| Cooling | Noctua (1x120mm front, 2x80mm rear) | — | 59| Cooling | Noctua (1x120mm front, 2x80mm rear) |
61 60
62Physical hardware under personal control eliminates the hypervisor escape vector 61Physical hardware under personal control eliminates the hypervisor escape vector
63and the cloud provider subpoena vector. Full recovery from a fresh OS install: 62and the cloud provider subpoena vector. Full recovery from a fresh OS install: