homepage.git, branch mainPersonal website (Quarto, terminal-first)http://git.jayrup.me/c/homepage.git/atom?h=main2026-10-23T16:11:38Znav: add Research to every page, align the home curl block2026-10-23T16:11:38ZVoid Agentvoid@jayrup.hermes2026-10-23T16:11:38Zurn:sha1:21dac45383b02f6a77ad0eb73bdf642face8d1a0
The nav is hand-copied into each page, so adding Research only to the pages
that were being edited left readers losing the link as soon as they entered an
article (6 of 9 pages lacked it). All nine now carry an identical line.
Home page: RESEARCH: had one space more than its neighbours and sat a column
out of the curl block.
Note: /research itself is still uncommitted (research/ is untracked), so
deploying this alone would publish nine links to a 404. Ship the research page
in the same push.
nginx: keep an explicit .txt location so /robots.txt works for curl2026-10-22T22:15:41ZVoid Agentvoid@jayrup.hermes2026-10-22T22:15:41Zurn:sha1:c7a31a36f25f659e9ad7fa745a104fa993420f46
Dropping the .txt location made the curl/wget suffix map apply to every
request, so /robots.txt was looked up as /robots.txt.txt and 404'd. Keep the
location, but without add_header, so mime.types and charset cover the type
and the server-level security headers are still inherited.
deploy: detect a detached nginx.conf bind mount instead of trusting reload2026-10-22T22:13:43ZVoid Agentvoid@jayrup.hermes2026-10-22T22:13:43Zurn:sha1:0eea672450447fc678f8073307a2e9139dd85616
The single-file mount pins the inode present when the container started. A
rename-based write leaves the container serving stale bytes while nginx -t
validates them, which is exactly how the previous deploy reported success
with an unchanged config. Compare the host and in-container checksums after
the reload and restart the container to re-resolve the path on mismatch.
deploy: write nginx.conf in place so the container's bind mount sees it2026-10-22T22:12:30ZVoid Agentvoid@jayrup.hermes2026-10-22T22:12:30Zurn:sha1:1e58fcb98fd17dbec3a2b477d3737b83101a18b5
nginx.conf is mounted as a single file. rsync renames a temp over the
destination, which replaces the inode, so the container kept reading the old
inode: nginx -t validated the old bytes, reload was a no-op, and the deploy
reported success while the live config was unchanged. Stage to
nginx.conf.new, copy in place with cat so the mounted inode keeps its
identity, then test and reload. Rollback copies in place too, for the same
reason.
nginx: serve public_key to curl cleanly, restore lost security headers2026-10-22T22:11:10ZVoid Agentvoid@jayrup.hermes2026-10-22T22:11:10Zurn:sha1:70dffce202a8cc1d15473bbc2750bdf29a54b0fb
`curl https://jayrup.me/public_key` is the documented way to get this key
onto a VPS, so both the file and the config serving it need to be exact.
Key file: drop the trailing space, one trailing newline. A key with no
trailing newline makes `curl ... >> ~/.ssh/authorized_keys` glue itself onto
the previous line and silently break every later key in the file.
nginx:
- `/assets/public_key` ignored $final_suffix, so curl got 404 while browsers
got 200. Route both through the suffix-aware try_files.
- add_header does not merge across levels: the asset, PDF and .txt locations
each declared one, so they inherited none of the security headers. The
asset location now repeats them; the PDF and .txt locations no longer
declare any (default_type / mime.types + charset do the job), so they
inherit again.
- `add_header Content-Type application/pdf` appended a second Content-Type
instead of setting it. Use default_type.
- `expires 30d` plus an explicit Cache-Control emitted two Cache-Control
headers. Use one explicit header.
- add `charset utf-8` so text/plain (what curl gets) is not served
charset-less while the content contains non-ASCII.
deploy: ship nginx.conf alongside public/. It is bind-mounted into the
container, so it never travelled with the rsync'd tree — the live config was
from May and predated the hardening committed in 0ee667a. Test with
`nginx -t` before reloading and restore the previous config on failure.
deploy: fix build-dir git calls, capture SHA, drop dead mkdir2026-10-22T22:00:39ZVoid Agentvoid@jayrup.hermes2026-10-22T22:00:39Zurn:sha1:b81fa0b2040e5b1b97806ffbf242948e74c4ef88
deploy.sh cd'd into the mktemp build dir before calling git, so
`git archive HEAD` failed with 'not a git repository' and the whole
deploy aborted. Resolve REPO from the script location and pass -C to
every git call, and write the archive to an absolute path since -C also
makes --output relative to the repo.
The deploy marker also ran `git rev-parse` from the temp dir; because it
sat inside a command substitution, set -e did not catch it and
last-deploy.txt silently recorded an empty commit. Capture SHA up front.
Also drop `mkdir -p public/cv`, left over from when the CV was copied
into a directory that nothing reads.
deploy: ship public_key.txt so curl UA can fetch the key2026-09-22T14:46:22Zhermeshermes@voidlaptop2026-09-22T14:46:22Zurn:sha1:e71d3f17e33ab93e652bfadb7d97d56b1c672c87links: drop GitHub, point everything at git.jayrup.me (homepage contact, CV header + dissertation entry, PDF link annotations)2026-09-20T14:19:18ZVoid Agentvoid@jayrup.hermes2026-09-20T14:19:18Zurn:sha1:f8fca9518e2d92cba2dbcd3ab71ebc00f2e22dc6links: point dissertation + site repos at git.jayrup.me (self-hosted cgit)2026-09-20T14:08:28ZVoid Agentvoid@jayrup.hermes2026-09-20T14:08:28Zurn:sha1:1dcecb80aa5855a7cd8d578104f29b3a93622a13fix: title frontmatter, terminal resume, project list sync, nginx hardening, and styles2026-09-02T10:00:42ZCaptainJack2491jayrupnakawala@gmail.com2026-09-02T10:00:42Zurn:sha1:0ee667ac6cb2493e4f9ddaa5b69f595071aca936