-
# Probe SPI flash chip and dump 16MB image
-flashrom -p ch341a_spi -r firmware_dump.bin -V
-# Verify checksums across consecutive reads
-sha256sum dump1.bin dump2.bin
+
# System initialization and node health check
+./cluster.sh --verify-nodes
+curl -s https://api.local/healthz | jq .status
- {{ heroText or "A fast, zero-bloat digital workshop detailing hardware reverse engineering, low-level POSIX environments, self-hosted infrastructure, and kernel security research. Designed for dense information retrieval." }}
+ {{ heroText or "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation." }}
- In-depth security post-mortems, CTF write-ups, shell portability benchmarks, and bare-metal homelab architecture guides.
+ Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam.
@@ -98,16 +98,16 @@ title: "River Rooks | Homelab Gateway"
- RACK-01 (Proxmox Primary)
- ONLINE • LOAD: 0.24
+ NODE-01 (Primary Cluster)
+ ONLINE • LOAD: 0.18
- NODE-02 (Storage TrueNAS)
+ NODE-02 (Storage Array)
ONLINE • POOL: 98% HEALTH
- OPN-01 (Routing Gateway)
- ONLINE • WIREGUARD ACTIVE
+ GATEWAY-01 (Edge Ingress)
+ ONLINE • ROUTING ACTIVE
diff --git a/src/posts/2026-07-15-high-availability-traefik-router.md b/src/posts/2026-07-15-high-availability-traefik-router.md
deleted file mode 100644
index fd84acc..0000000
--- a/src/posts/2026-07-15-high-availability-traefik-router.md
+++ /dev/null
@@ -1,77 +0,0 @@
----
-layout: layouts/post.njk
-title: "High-Availability Traefik Router with Docker Compose"
-date: 2026-07-15
-tags:
- - homelab
- - networking
- - docker
-excerpt: "Architecting a redundant reverse-proxy setup with automated Let's Encrypt wildcard DNS challenge routing and zero-downtime container swaps."
-readingTime: "12 MIN READ"
-featured: false
-difficulty: "ADVANCED"
----
-
-## 1.0 Topology Overview
-
-Operating production services on bare-metal home clusters demands strict ingress routing, SSL termination, and health checking. Rather than managing manual Nginx upstream definitions, Traefik dynamically listens to Docker socket events and generates routing graphs automatically.
-
-```text
-[Internet / WireGuard Mesh]
- |
- [Edge Router]
- |
- +--------+--------+
- | |
-[Traefik 01] [Traefik 02] (Keepalived VIP)
- | |
- +--------+--------+
- |
- [Internal Overlay]
- |
- +-------+-------+
- | | |
- [App1] [App2] [App3]
-```
-
-## 2.0 Docker Compose Infrastructure
-
-The core proxy layer is configured with strict network isolation, healthchecks, and non-root execution:
-
-```yaml
-version: '3.8'
-
-services:
- traefik:
- image: traefik:v3.1
- container_name: edge_router
- restart: unless-stopped
- security_opt:
- - no-new-privileges:true
- ports:
- - "80:80"
- - "443:443"
- environment:
- - CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}
- volumes:
- - /etc/localtime:/etc/localtime:ro
- - /var/run/docker.sock:/var/run/docker.sock:ro
- - ./traefik.yml:/traefik.yml:ro
- - ./acme.json:/acme.json
- networks:
- - proxy_net
-
-networks:
- proxy_net:
- external: true
-```
-
-## 3.0 Verification & Failover Testing
-
-Run the health check endpoint using `curl` to verify response headers:
-
-```sh
-curl -Iv https://router.rooks.internal/ping
-```
-
-All requests route through mutual TLS with zero dropped connections during container redeploys.
diff --git a/src/posts/2026-07-15-infrastructure-notes-template.md b/src/posts/2026-07-15-infrastructure-notes-template.md
new file mode 100644
index 0000000..434f34c
--- /dev/null
+++ b/src/posts/2026-07-15-infrastructure-notes-template.md
@@ -0,0 +1,52 @@
+---
+layout: layouts/post.njk
+title: "Infrastructure Notes & Systems Deployment Guide"
+date: 2026-07-15
+tags:
+ - homelab
+ - networking
+ - templates
+excerpt: "Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident."
+readingTime: "4 MIN READ"
+featured: false
+difficulty: "BEGINNER"
+---
+
+## 1.0 Topology Overview
+
+Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua:
+
+```text
+[Gateway Ingress]
+ |
+ [Edge Router]
+ |
+ +-----+-----+
+ | |
+[Node 01] [Node 02]
+```
+
+## 2.0 Deployment Configuration
+
+Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat:
+
+```yaml
+version: '3.8'
+
+services:
+ app:
+ image: service:latest
+ restart: unless-stopped
+ ports:
+ - "8080:80"
+```
+
+## 3.0 Verification Testing
+
+Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur:
+
+```sh
+curl -s http://localhost:8080/health
+```
+
+Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
diff --git a/src/posts/2026-07-20-reverse-engineering-iot-firmware.md b/src/posts/2026-07-20-reverse-engineering-iot-firmware.md
deleted file mode 100644
index ec0c000..0000000
--- a/src/posts/2026-07-20-reverse-engineering-iot-firmware.md
+++ /dev/null
@@ -1,98 +0,0 @@
----
-layout: layouts/post.njk
-title: "Reverse Engineering IoT Firmware: SPI Flash Extraction"
-date: 2026-07-20
-tags:
- - firmware
- - hardware
- - security
- - bus-pirate
-excerpt: "Physical hardware exploitation and firmware dump walkthrough via direct SPI flash memory extraction on an IoT gateway using Bus Pirate and flashrom."
-readingTime: "8 MIN READ"
-featured: true
-difficulty: "INTERMEDIATE"
----
-
-## 1.0 Executive Summary
-
-In security audits of embedded systems, retrieving the firmware image is the critical foundational step. When manufacturers encrypt over-the-air (OTA) updates and blow electronic fuses to permanently disable silicon debug ports (such as `UART` serial consoles and `JTAG/SWD` test pads), physical memory extraction directly off the circuit board becomes mandatory.
-
-This writeup details the complete process of extracting a binary image from an 8-pin SOP SPI flash chip (Winbond W25Q64JV, 8MB) using a **Dangerous Prototypes Bus Pirate v4** hardware bridge and the open-source `flashrom` utility.
-
-
-
[!NOTE] Target Board Isolation
-
Always de-solder the SPI flash chip or clamp using an SOP8 test clip with the host microcontroller's reset line (/RESET) driven low to prevent the main SoC from contending on the SPI bus.
-
-
-## 2.0 Hardware Pinout & Bus Pirate Setup
-
-The target is an 8-pin Small Outline Package (SOP-8). Pin 1 is easily identified by the circular depression in the epoxy mold. Connect the Bus Pirate flying leads directly according to the standard SPI protocol mapping:
-
-### 2.1 SOP8 Pinout Matrix
-
-| SOP8 Pin # | Signal Name | Bus Pirate Lead | Electrical Purpose |
-| :--- | :--- | :--- | :--- |
-| **1** | `/CS` | CS (White) | Chip Select (Active Low) |
-| **2** | `DO (MISO)` | MISO (Black) | Serial Data Output from Flash |
-| **3** | `/WP` | +3.3V (VPU) | Write Protect (Tied High to Disable) |
-| **4** | `GND` | GND (Brown) | System Ground Reference |
-| **5** | `DI (MOSI)` | MOSI (Grey) | Serial Data Input to Flash |
-| **6** | `CLK` | CLK (Purple) | Serial Clock Driven by Master |
-| **7** | `/HOLD` | +3.3V (VPU) | Hold / Suspend Input (Tied High) |
-| **8** | `VCC` | +3.3V (Red) | Supply Voltage (Nominal 3.3V DC) |
-
-
-
[!WARNING] Electrical Voltage Rating
-
Verify whether your target chip is a 3.3V part (e.g., W25Q64FV) or a 1.8V part (e.g., W25Q64FW). Supplying 3.3V logic to a 1.8V chip will permanently destroy the silicon junction gates.
-
-
-## 3.0 SPI Extraction via flashrom
-
-Plug the Bus Pirate into your analysis workstation via USB. It registers as `/dev/ttyUSB0`. Query the chip ID register using the `0x9F` JEDEC Read ID command:
-
-```sh
-#!/bin/sh
-# Query the SPI flash details using flashrom via Bus Pirate
-flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M -r firmware_dump1.bin
-
-# Repeat extraction to create a secondary dump for comparison
-flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M -r firmware_dump2.bin
-
-# Verify the integrity of the binary dumps by diffing
-cmp firmware_dump1.bin firmware_dump2.bin
-if [ $? -eq 0 ]; then
- echo "[+] SPI Dumps match identically! Proceeding to hashing..."
- md5sum firmware_dump1.bin
- sha256sum firmware_dump1.bin
-else
- echo "[-] Bit flip or voltage sag detected! Re-run extraction." >&2
- exit 1
-fi
-```
-
-Press
Ctrl +
C if the bus fails to synchronize. Once complete, inspect the initial bytes with `hexdump`:
-
-```text
-0000000: 2705 1956 7062 8251 60a4 2130 0041 5262 '..Vpb.Q`.!0.ARb
-0000010: 6873 7173 0000 0004 0000 0000 0000 1000 hsqs............
-0000020: 0002 0001 0000 0000 636f 6e66 6967 2e64 ........config.d
-```
-
-Notice the magic bytes `6873 7173` (ASCII representation: **`hsqs`**) at offset `0x000010`. This confirms the presence of a SquashFS compressed root filesystem!
-
-## 4.0 Binary Verification & Hashes
-
-Before proceeding with automated deconstruction using `binwalk -Me`, record cryptographic hashes in your lab notebook:
-
-- **Dump Size:** `8,388,608 bytes` (8192 KiB)
-- **MD5:** `d41d8cd98f00b204e9800998ecf8427e`
-- **SHA-256:** `a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e`
-
-## 5.0 Audit Checklist
-
-Ensure all forensics hygiene steps have been recorded:
-
-- [x] Visual optical inspection and pinout diagram documented
-- [x] Clean dual flashrom dumps matching via bitwise `cmp`
-- [x] SquashFS magic header identified at offset `0x10`
-- [ ] Filesystem extraction and hardcoded credentials analysis (Part 2)
diff --git a/src/posts/2026-07-20-sample-technical-dispatch.md b/src/posts/2026-07-20-sample-technical-dispatch.md
new file mode 100644
index 0000000..ee47b48
--- /dev/null
+++ b/src/posts/2026-07-20-sample-technical-dispatch.md
@@ -0,0 +1,78 @@
+---
+layout: layouts/post.njk
+title: "Sample Technical Dispatch: Systems Architecture & Implementation"
+date: 2026-07-20
+tags:
+ - systems
+ - architecture
+ - templates
+excerpt: "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam."
+readingTime: "6 MIN READ"
+featured: true
+difficulty: "INTERMEDIATE"
+---
+
+## 1.0 Executive Summary
+
+Lorem ipsum dolor sit amet, consectetur adipiscing elit. Integer nec odio. Praesent libero. Sed cursus ante dapibus diam. Sed nisi. Nulla quis sem at nibh elementum imperdiet. Duis sagittis ipsum. Praesent mauris. Fusce nec tellus sed augue semper porta. Mauris massa. Vestibulum lacinia arcu eget nulla.
+
+Curabitur sodales ligula in libero. Sed dignissim lacinia nunc. Curabitur tortor. Pellentesque nibh. Aenean quam. In scelerisque sem at dolor. Maecenas mattis. Sed convallis tristique sem. Proin ut ligula vel nunc egestas porttitor. Morbi lectus risus, iaculis vel, suscipit quis, luctus non, massa.
+
+
+
[!NOTE] Operational Directives
+
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Integer nec odio. Praesent libero. Sed cursus ante dapibus diam.
+
+
+## 2.0 System Parameters & Specifications
+
+Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos himenaeos. Nam nec ante. Sed lacinia, urna non tincidunt mattis, tortor neque adipiscing diam, a cursus ipsum ante quis turpis:
+
+### 2.1 Interface Configuration Matrix
+
+| Parameter ID | Signal Name | Protocol Bus | Expected Value |
+| :--- | :--- | :--- | :--- |
+| **0x01** | `SYS_CLOCK` | SPI Primary | 100 MHz |
+| **0x02** | `DATA_IN` | Serial Bus | Bidirectional |
+| **0x03** | `CONTROL_REG` | I2C Header | 0x3F Active |
+| **0x04** | `GROUND_REF` | Chassis GND | 0.0V Nominal |
+
+
+
[!WARNING] Configuration Voltage Boundary
+
Sed nisi. Nulla quis sem at nibh elementum imperdiet. Duis sagittis ipsum. Praesent mauris. Fusce nec tellus sed augue semper porta.
+
+
+## 3.0 Execution Workflow
+
+Nulla quis sem at nibh elementum imperdiet. Duis sagittis ipsum. Praesent mauris. Fusce nec tellus sed augue semper porta:
+
+```sh
+#!/bin/sh
+# Sample deployment and verification routine
+set -eu
+
+echo "[+] Initializing subsystem..."
+check_environment() {
+ test -f /etc/config.json && echo "Config verified."
+}
+
+check_environment
+```
+
+Press
Ctrl +
C to interrupt operations safely at any point.
+
+## 4.0 Telemetry & Verification
+
+Fusce nec tellus sed augue semper porta. Mauris massa. Vestibulum lacinia arcu eget nulla:
+
+- **Metric A:** `1,048,576 ops/sec`
+- **Metric B:** `SHA256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
+- **Latency:** `< 2.5ms` nominal
+
+## 5.0 Audit Checklist
+
+Lorem ipsum dolor sit amet, consectetur adipiscing elit:
+
+- [x] Baseline architectural parameters verified
+- [x] Initial configuration and unit tests passed
+- [x] System telemetry within expected boundaries
+- [ ] Production deployment and final review
diff --git a/test/site-config.test.js b/test/site-config.test.js
index f48b6fd..6223618 100644
--- a/test/site-config.test.js
+++ b/test/site-config.test.js
@@ -38,8 +38,8 @@ test("Site Config: correctly parses SITE_DOMAIN and derives service subdomains",
assert.equal(site.url, "https://testcluster.internal");
// Verify dynamic subdomains
- const gitService = site.services.find((s) => s.name === "Forgejo Git");
- assert.ok(gitService, "Forgejo Git service exists");
+ const gitService = site.services.find((s) => s.name === "Gitea");
+ assert.ok(gitService, "Gitea service exists");
assert.equal(gitService.url, "https://git.testcluster.internal");
assert.equal(gitService.tag, "git.testcluster.internal:2222");
@@ -48,8 +48,8 @@ test("Site Config: correctly parses SITE_DOMAIN and derives service subdomains",
assert.equal(chefService.url, "https://chef.testcluster.internal");
// Verify navigation Git Forge URL
- const navGit = site.nav.find((n) => n.label === "Git Forge");
- assert.ok(navGit, "Nav Git Forge link exists");
+ const navGit = site.nav.find((n) => n.label === "Gitea");
+ assert.ok(navGit, "Nav Gitea link exists");
assert.equal(navGit.url, "https://git.testcluster.internal");
});