Colophon
How this site is built, versioned, deployed, and why it loads nothing from anywhere else.
A site that argues sovereignty must be verifiable had better be verifiable itself. So here is exactly what it is.
- source
- github.com/kallioli/kevinallioli.com
- commit
7d2c9564378ce1dfdb2c32ef053ef1e0040135ff- generator
- Hugo 0.165.0 extended
- stylesheet
main.73696a8a7ba91c279dd62215e8204e579aca95d37f408866410ff8886b216e12.css- script-src
sha256-JWkP4OLql65Ng9NZyYicPsZKLizhJHgax5PUBv4hED4=
Build
Generated by Hugo extended, pinned in the repository’s
.hugo-version file and read by the same toolchain locally and in CI. No
latest: a floating version makes a build irreproducible, which is the
exact thing this site holds against everyone else.
No third-party theme. Every template lives in this repository. No Node, no
npm, no bundler: Hugo Pipes transpiles, minifies and fingerprints the
stylesheet. Asset URLs carry their own digest, which makes them immutable
and cacheable for a year without revalidation, the same way the Open Image
Cloud registry serves image paths.
What the browser downloads
One HTML page, one stylesheet, four preloaded font files, and two more only if the page contains italics or a bold serif heading. Nothing else, and nothing from another domain.
The fonts are IBM Plex, under the SIL Open
Font License, served from this domain as woff2 subset to extended Latin.
Six faces total 132 KB. No Google Fonts: asking a third party for a font
tells that third party about every one of your visits.
No analytics, no tracking pixel, no external CDN, no consent banner, because there is nothing to consent to.
JavaScript
One function, inline in the <head>, that reads a theme preference from
localStorage, applies it before first paint, and reveals the toggle
button. With JavaScript off the button stays hidden and the theme follows
prefers-color-scheme. No article page runs anything else.
The SHA-256 of that script is printed above, and it is the same value as
the script-src directive in the Content-Security-Policy header. It is
computed at build time: the script cannot change without the policy
changing with it.
Headers
_headers is generated from a template, not written by hand. The content
security policy reduces to default-src 'self' plus the script digest
above, alongside HSTS, nosniff, Referrer-Policy: strict-origin-when-cross-origin, frame-ancestors 'none' and a
Permissions-Policy that declines nearly every browser API, since the site
uses none of them.
Hosting and deployment
The repository is on GitHub. Every push to main runs an action that
installs the pinned Hugo version, checks its digest, builds the site,
verifies that the CSP hash matches the script actually served, then
publishes with wrangler to Cloudflare Workers Static Assets. The API
token lives in the repository secrets and appears nowhere in the code.
There is no Worker script in front of the site, deliberately: the headers
in _headers are applied by the asset server, but not to a response
produced by Worker code. A Worker placed in front, even a three-line one,
would silently strip the security policy from every page. The redirect from
www is therefore a zone rule, which runs before Workers anyway.
The commit hash shown above is injected at build time. It identifies the exact state of the repository that produced the page you are reading.
Licence
Text under CC BY 4.0. The template and stylesheet code is MIT. IBM Plex is under SIL OFL 1.1.