diff --git a/samples/canonical-sample-content.md b/samples/canonical-sample-content.md new file mode 100644 index 0000000..8451d21 --- /dev/null +++ b/samples/canonical-sample-content.md @@ -0,0 +1,273 @@ +# Canonical Content Dataset & Single Source of Truth for Design Samples + +**Document Purpose:** Standardized dataset containing canonical profile data, active services, technical blog notes, engineering projects, hardware nodes, and interactive ASCII daemon assets. All design sample layouts (`homepage.html`, `split-panel.html`, `companion.html`, `document-flow.html`, `portfolio.html`, `homelab.html`, `public-services.html`, `sample-dashboard.html`, `sample-command-center.html`, `sample-dual-pane-explorer.html`) pull from this common material. + +--- + +## 1. Persona & Identity (`whoami`) + +| Field | Canonical Value | +| :--- | :--- | +| **Full Name** | `River Rooks` | +| **Primary Title** | `Systems Architecture & Cybersecurity` | +| **Academic / Institutional Role** | Cybersecurity student at the University of Alabama College of Engineering | +| **Specialization Areas** | Network forensics, self-hosted infrastructure, systems architecture, low-level tooling, bare-metal virtualization | +| **Physical Node Location** | Alabama, USA / `RACK-01` | +| **System Hostname Prompt** | `dev-blog@system:~$` / `agy --node-01` | +| **PGP Key Fingerprint** | `0x4A8E92F1C0B3D4E7` | +| **SSH Public Key Digest** | `SHA256:7uK+N04wP5rL/9z3Q8s1vX4dF6mK2pT8yB1wN0qZ8` | +| **Email Address** | `river@rooks.dev` (or `river@example.com`) | +| **Public Git Forge** | `https://git.rooks.dev` / `https://github.com` | +| **Matrix Chat Endpoint** | `@river:rooks.dev` | + +### Biography Snippets +* **One-Line Meta:** `Cybersecurity student at UA College of Engineering focusing on network forensics, self-hosted infrastructure, and systems architecture.` +* **Extended Bio:** `Cybersecurity student and systems practitioner. Spends time architecting high-throughput homelab networks, reverse engineering IoT firmware, hardening FreeBSD/Linux hypervisors, and writing zero-allocation Unix utilities.` + +### Active Tech Stack Tags +```text +[#network-forensics] [#docker-traefik] [#arch-linux] [#neovim] [#wireguard] +[#posix-sh] [#python] [#golang] [#rust] [#proxmox] [#truenas] +``` + +--- + +## 2. Services Directory & Infrastructure Catalog + +### A. Core & Network Infrastructure +| Service Name | Category | Port / Protocol | Domain / Routing | Access | Description | +| :--- | :--- | :--- | :--- | :--- | :--- | +| **Traefik Proxy (v3.1)** | `#core` | `443/tcp` (TLS) | `https://proxy.rooks.dev` | `INTERNAL / ONLINE` | Edge HTTP reverse proxy and load balancer with dynamic Docker provider discovery and ACME Let's Encrypt TLS wildcard certificates. | +| **OPNsense Firewall (v24.7)** | `#core` | `VLAN 10 / Mgmt` | Gateway IP | `PROTECTED / ACTIVE` | Hardened FreeBSD firewall routing 10GbE traffic with VLAN isolation, Suricata IDS/IPS, and Unbound DNS resolvers. | +| **AdGuard Home** | `#dns` | `53/udp`, `853/tcp` | `https://dns.rooks.dev` | `INTERNAL / PROTECTED` | Network-wide DNS sinkhole filtering trackers and ad domains across all VLANs with DNS-over-HTTPS upstream security. | +| **WireGuard Mesh** | `#vpn` | `51820/udp` | Peer Mesh | `PUBLIC / 14 PEERS` | High-performance encrypted point-to-point VPN tunnel connecting remote laptops and mobile endpoints to homelab subnet. | + +### B. Compute, Virtualization & Storage +| Service Name | Category | Port / Protocol | Domain / Routing | Access | Description | +| :--- | :--- | :--- | :--- | :--- | :--- | +| **Proxmox VE (v8.2)** | `#compute` | `8006/tcp` | `https://pve.rooks.dev` | `INTERNAL / ONLINE` | Enterprise hypervisor cluster hosting Debian LXC containers and KVM virtual machines with Ceph & ZFS backend. | +| **TrueNAS SCALE** | `#storage` | `NFS / SMB / 443` | `https://nas.rooks.dev` | `INTERNAL / ONLINE` | Primary network attached storage managing 48TB ZFS RaidZ2 array, dataset snapshots, NFS exports, and scrub jobs. | +| **Forgejo Git Server** | `#dev-git` | `3000/tcp`, `2222/ssh` | `https://git.rooks.dev` | `PUBLIC / OPEN` | Lightweight self-hosted Git forge hosting infrastructure-as-code repos, Ansible playbooks, dotfiles, and CTF archives. | + +### C. Public Tools & Developer Utilities +| Service Name | Category | Port / Protocol | Domain / Routing | Access | Description | +| :--- | :--- | :--- | :--- | :--- | :--- | +| **CyberChef Workbench** | `#security-tool` | `443/tcp` | `https://chef.rooks.dev` | `PUBLIC / OPEN` | Cyber Swiss Army Knife for hex decoding, Base64 operations, regex extraction, cryptographic hashing, and CTF payload analysis. | +| **Stirling PDF Studio** | `#pdf-tools` | `443/tcp` | `https://pdf.rooks.dev` | `PUBLIC / OPEN` | Self-hosted document processing suite for merging, splitting, OCR text extraction, password encryption, and PDF page manipulation. | +| **HedgeDoc Collaborative** | `#markdown` | `443/tcp` | `https://pad.rooks.dev` | `PUBLIC / OPEN` | Real-time collaborative Markdown editor for technical specs, RFC drafts, and collaborative meeting notes. | + +### D. Media, Reading & Content Automation +| Service Name | Category | Port / Protocol | Domain / Routing | Access | Description | +| :--- | :--- | :--- | :--- | :--- | :--- | +| **Jellyfin Media Portal** | `#media-video` | `8096/tcp` | `https://watch.rooks.dev` | `AUTH REQUIRED` | FOSS media streaming engine leveraging Intel QuickSync GPU hardware acceleration for 4K HDR transcoding. | +| **Arr Automation Suite** | `#automation` | `8989 / 7878 / 9696` | `https://arr.rooks.dev` | `INTERNAL / RUNNING` | Automated content indexing, Prowlarr indexer management, Sonarr/Radarr pipeline, and SABnzbd queue downloader. | +| **Audiobookshelf** | `#media-audio` | `443/tcp` | `https://listen.rooks.dev` | `INVITE ONLY` | Self-hosted audiobook and podcast streaming server with continuous playback position synchronization across mobile clients. | +| **Calibre-Web Library** | `#ebooks` | `443/tcp` | `https://read.rooks.dev` | `PUBLIC READ` | E-book library catalog with e-reader OPDS feed integration and in-browser reading support. | + +### E. Security, Telemetry & Communications +| Service Name | Category | Port / Protocol | Domain / Routing | Access | Description | +| :--- | :--- | :--- | :--- | :--- | :--- | +| **Vaultwarden** | `#secrets` | `443/tcp` (E2EE) | `https://vault.rooks.dev` | `2FA / AUTH` | Lightweight Rust implementation of the Bitwarden API hosting encrypted credentials, SSH keys, and TOTP tokens. | +| **Prometheus & Grafana** | `#telemetry` | `3000 / 9090` | `https://mon.rooks.dev` | `INTERNAL / SCRAPING` | Time-series metric collection with Node Exporter, Telegraf agents, and live cluster performance dashboards. | +| **Uptime Kuma** | `#status` | `3001/tcp` | `https://status.rooks.dev` | `PUBLIC / 100% HEALTH`| Synthetic HTTP, Ping, and TCP health monitor broadcasting real-time service uptime alerts to Discord webhooks. | +| **Matrix Synapse** | `#messaging` | `8448/tcp` | `https://matrix.rooks.dev` | `FEDERATED / OPEN` | Federated Matrix homeserver for encrypted messaging, public security channels, and cross-server communication. | + +--- + +## 3. Technical Notes & Blog Articles + +### Post 1: Featured Article (Full Writeup) +* **Title:** `Reverse Engineering IoT Firmware: SPI Flash Extraction` +* **File / Path:** `~/notes/iot-firmware-spi-extraction.md` +* **Publication Date:** `2026-07-20` +* **Reading Time:** `8 mins` +* **Tags:** `[#firmware]`, `[#hardware]`, `[#security]`, `[#bus-pirate]` +* **Abstract:** In security audits of embedded systems, retrieving the firmware is the critical first step. When over-the-air updates are encrypted and debug ports (UART, JTAG) are disabled in production silicon, dumping physical SPI Flash memory becomes necessary. This writeup covers extracting firmware from an 8-pin SOP SPI flash chip using a Bus Pirate and flashrom to bypass bootloader lockdowns. +* **Code Snippet (`extract_firmware.sh`):** +```bash +#!/bin/sh +# Query the SPI flash details using flashrom via Bus Pirate +flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M -r firmware_dump.bin + +# Verify the integrity of the binary dump by comparing hashes +if [ $? -eq 0 ]; then + echo "Dump successful. Running md5sum..." + md5sum firmware_dump.bin +else + echo "Failed to read flash memory." >&2 + exit 1 +fi +``` + +### Post 2: Traefik Docker Architecture +* **Title:** `Building a High-Availability Traefik Router with Docker Compose` +* **File / Path:** `~/notes/ha-traefik-docker.md` +* **Publication Date:** `2026-07-15` +* **Reading Time:** `12 mins` +* **Tags:** `[#homelab]`, `[#docker-traefik]`, `[#networking]` +* **Abstract:** Architecting automated TLS wildcard certificate propagation, Docker provider label routing, zero-downtime container updates, and backend health-check failover routes. + +### Post 3: Shell Portability +* **Title:** `POSIX sh vs. Bash: Portability in Modern Scripts` +* **File / Path:** `~/notes/posix-sh-vs-bash.md` +* **Publication Date:** `2026-07-10` +* **Reading Time:** `6 mins` +* **Tags:** `[#posix-sh]`, `[#shell]`, `[#unix]` +* **Abstract:** Analyzing edge-case incompatibilities, syntax overhead, eliminating bashisms, and writing fast, bulletproof bootstrapping scripts for Alpine and embedded targets conforming to IEEE Std 1003.1. + +### Post 4: Low-Level CTF Exploitation +* **Title:** `CTF Write-up: Heap Exploitation in glibc 2.35` +* **File / Path:** `~/notes/ctf-heap-glibc-2-35.md` +* **Publication Date:** `2026-06-28` +* **Reading Time:** `15 mins` +* **Tags:** `[#ctf]`, `[#binary-exploitation]`, `[#security]` +* **Abstract:** Deconstructing modern glibc memory allocator defenses: tcache safe-linking pointer mangling, bypass primitives, and House of Apple file structure hijacking for arbitrary code execution. + +### Post 5: Network Isolation +* **Title:** `Zero-Trust Network Isolation with WireGuard & OPNsense VLANs` +* **File / Path:** `~/notes/zero-trust-wireguard-opnsense.md` +* **Publication Date:** `2026-06-14` +* **Reading Time:** `10 mins` +* **Tags:** `[#networking]`, `[#wireguard]`, `[#security]` +* **Abstract:** Designing strict zone-based firewall rules across isolated VLANs (Management, Server DMZ, IoT, Trusted Clients) with point-to-point WireGuard cryptographic routing. + +--- + +## 4. Engineering Projects & System Modules + +### Module 1: Custom POSIX Shell Parser +* **Path / Identifier:** `/dev/posix-shell-parser` +* **Version:** `v1.2.0` +* **Primary Language:** `Lua` +* **Tags:** `[#lua]`, `[#ast-parser]`, `[#compilers]` +* **Summary:** A lightweight Lexer and AST parser written in Lua for parsing POSIX-compliant shell scripts. Optimized to avoid runtime heap allocations during tokenization, enabling real-time syntax coloring inside terminal buffers. +* **Code Snippet (`lexer.lua`):** +```lua +local function tokenize(src) + local tokens = {} + for pos, char in ipairs(src) do + if char == ";" or char == "|" then + table.insert(tokens, { type = "OPERATOR", value = char }) + end + end + return tokens +end +``` + +### Module 2: WireGuard Mesh Topology Builder +* **Path / Identifier:** `/dev/wireguard-mesh` +* **Version:** `v0.8.4` +* **Primary Language:** `Python` / `POSIX sh` +* **Tags:** `[#networking]`, `[#wireguard]`, `[#automation]` +* **Summary:** Automated configuration generator that computes public/private key matrices and generates atomic configuration files for full-mesh WireGuard overlay networks spanning cloud VMs and homelab servers. + +### Module 3: Zero-Allocation Logger (Go) +* **Path / Identifier:** `/dev/zero-alloc-logger` +* **Version:** `v2.1.1` +* **Primary Language:** `Go` +* **Tags:** `[#go]`, `[#performance]`, `[#systems]` +* **Summary:** A high-throughput structured JSON logger utilizing `sync.Pool` memory recycling to eliminate GC pause overhead during disk I/O (>500,000 log events/second). + +### Module 4: Embedded Kernel Boot Strap +* **Path / Identifier:** `/dev/kernel-bootstrap` +* **Version:** `v0.1.0` +* **Primary Language:** `ARM Cortex Assembly` / `C` +* **Tags:** `[#arm-cortex]`, `[#assembly]`, `[#embedded]` +* **Summary:** Bare-metal boot sector and initial C runtime setup for ARM Cortex-M microcontrollers. Configures vector table offset registers, performs memory section copying, and initializes early UART debugging output. + +### Module 5: Traefik Cloudflare Dynamic DNS Daemon +* **Path / Identifier:** `/dev/ddns-daemon` +* **Version:** `v1.0.2` +* **Primary Language:** `Python` / `Docker SDK` +* **Tags:** `[#docker]`, `[#traefik]`, `[#cloudflare]` +* **Summary:** Background controller daemon monitoring Docker container state transitions and synchronizing container label subdomains with Cloudflare DNS A/AAAA records. + +--- + +## 5. Physical Hardware Nodes & Telemetry + +```text ++-------------------+ 10GbE SFP+ +-------------------+ +| gw-node01.lan | <==================> | pve-node02.lan | +| OPNsense 24.7 | | Proxmox VE 8.2 | +| Intel N100 (4C/4T)| | AMD 5900X (12C/24T| ++-------------------+ +-------------------+ + || || + || 10GbE Trunk || 10GbE NFS/SMB + \/ \/ ++--------------------------------------------------------------+ +| nas-node03.lan | +| TrueNAS SCALE (48TB RaidZ2 Pool) | +| Intel Core i5-12400 (6C/12T) / 64GB ECC | ++--------------------------------------------------------------+ +``` + +| Hostname | Role / Operating System | Hardware Specifications | Nominal Load | +| :--- | :--- | :--- | :--- | +| **`gw-node01.lan`** | Edge Gateway / OPNsense 24.7 | Intel N100 (4C/4T), 16GB DDR5, 4x 2.5GbE I226-V | CPU: 18% \| RAM: 32% | +| **`pve-node02.lan`** | Hypervisor / Proxmox VE 8.2 | AMD Ryzen 9 5900X (12C/24T), 128GB ECC DDR4, 2x 2TB NVMe | CPU: 42% \| RAM: 68% | +| **`nas-node03.lan`** | Storage / TrueNAS SCALE | Intel Core i5-12400 (6C/12T), 64GB ECC, 6x 16TB Enterprise SAS | CPU: 14% \| RAM: 82% (ZFS ARC) | + +--- + +## 6. ASCII Mascot & Daemon Artframes (`sys-daemon`) + +### Frame 1: Idle / Scanning +```text + .-----------------. + / ^ ^ ^ /| + / (_) (_) (_) / | + /__________________/ | + | ___ ___ | | + | [o_o] [o_o] | | + | `-' `-' | | + | ______ | | + | / \ | / + | | -- | | / + | \____/ |/ + `------------------' +``` + +### Frame 2: Active / Alert +```text + .-----------------. + / ^ ^ ^ /| + / (_) (_) (_) / | + /__________________/ | + | ___ ___ | | + | [-_-] [-_-] | | + | `-' `-' | | + | ______ | | + | / \ | / + | | O | | / + | \____/ |/ + `------------------' +``` + +### Frame 3: Scroll-Tracker Cat Daemon +```text + /\___/\ + ( o o ) sys-daemon + ( =^= ) [TRACKING] + (---) +``` + +--- + +## 7. Sample Pages Material Mapping Matrix + +This matrix specifies which components and data entries from this canonical document are presented in each sample layout: + +| Sample File | Layout Style | Persona / Bio | Services Included | Notes / Articles | Project Modules | Nodes & Telemetry | Mascot / Daemon | +| :--- | :--- | :---: | :---: | :---: | :---: | :---: | :---: | +| [`index.html`](file:///home/venus/code/blog/index.html) | Root Minimalist Business Card | Full whoami | — | — | Active Stack Tags | Terminal stdout | — | +| [`samples/homepage.html`](file:///home/venus/code/blog/samples/homepage.html) | Sample 1: Developer Homepage | Profile header | — | Post 1 (Full) + Archive Index (2,3,4) | — | — | — | +| [`samples/split-panel.html`](file:///home/venus/code/blog/samples/split-panel.html) | Sample 2: Split Panel Feed | — | — | — | Modules 1–5 | Status row | Frame 1/2 Animated | +| [`samples/companion.html`](file:///home/venus/code/blog/samples/companion.html) | Sample 3: Companion Layout | — | — | — | Modules 1–5 | Terminal card | Frame 3 Cat Daemon | +| [`samples/document-flow.html`](file:///home/venus/code/blog/samples/document-flow.html) | Sample 4: Continuous Document Flow | Header banner | — | Post 1 Snippets | Modules 1–5 in detail | — | Frame 3 Scroll Tracker | +| [`samples/portfolio.html`](file:///home/venus/code/blog/samples/portfolio.html) | Sample 5: Portfolio Card | Full whoami | — | — | Active Stack Tags | Terminal stdout | — | +| [`samples/homelab.html`](file:///home/venus/code/blog/samples/homelab.html) | Sample 6: Homelab Lander | Header banner | All Core & Compute (12 services) | — | — | Nodes 1–3 + ASCII Topology | Terminal logs | +| [`samples/public-services.html`](file:///home/venus/code/blog/samples/public-services.html) | Sample 7: Public Portal | Header banner | All Public Utilities (9 services) | — | — | Keys & PGP box | — | +| [`samples/sample-dashboard.html`](file:///home/venus/code/blog/samples/sample-dashboard.html) | Sample 8: 3-Tile Workspace | Center tile bio | Left tile services | Right tile archive | Center tile projects | Status bar | Vim command bar | +| [`samples/sample-command-center.html`](file:///home/venus/code/blog/samples/sample-command-center.html) | Sample 9: Tabbed Command Center | Tab 3 (Resume) | Tab 1 (Services) | Tab 2 (Blog Notes) | Tab 3 (Projects) | Tab 1 (Nodes) | Status dots | +| [`samples/sample-dual-pane-explorer.html`](file:///home/venus/code/blog/samples/sample-dual-pane-explorer.html) | Sample 10: Helix Tree Explorer | Sidebar links | Services subtree | Notes subtree | Modules subtree | Status bar | Sidebar companion |