# Canonical Content Dataset & Single Source of Truth for Design Samples

**Document Purpose:** Standardized dataset containing canonical profile data, active services, technical blog notes, engineering projects, hardware nodes, and interactive ASCII daemon assets. All design sample layouts (`homepage.html`, `split-panel.html`, `companion.html`, `document-flow.html`, `portfolio.html`, `homelab.html`, `public-services.html`, `sample-dashboard.html`, `sample-command-center.html`, `sample-dual-pane-explorer.html`) pull from this common material.

---

## 1. Persona & Identity (`whoami`)

| Field | Canonical Value |
| :--- | :--- |
| **Full Name** | `River Rooks` |
| **Primary Title** | `Systems Architecture & Cybersecurity` |
| **Academic / Institutional Role** | Cybersecurity student at the University of Alabama College of Engineering |
| **Specialization Areas** | Network forensics, self-hosted infrastructure, systems architecture, low-level tooling, bare-metal virtualization |
| **Physical Node Location** | Alabama, USA / `RACK-01` |
| **System Hostname Prompt** | `dev-blog@system:~$` / `agy --node-01` |
| **PGP Key Fingerprint** | `0x4A8E92F1C0B3D4E7` |
| **SSH Public Key Digest** | `SHA256:7uK+N04wP5rL/9z3Q8s1vX4dF6mK2pT8yB1wN0qZ8` |
| **Email Address** | `river@rooks.dev` (or `river@example.com`) |
| **Public Git Forge** | `https://git.rooks.dev` / `https://github.com` |
| **Matrix Chat Endpoint** | `@river:rooks.dev` |

### Biography Snippets
* **One-Line Meta:** `Cybersecurity student at UA College of Engineering focusing on network forensics, self-hosted infrastructure, and systems architecture.`
* **Extended Bio:** `Cybersecurity student and systems practitioner. Spends time architecting high-throughput homelab networks, reverse engineering IoT firmware, hardening FreeBSD/Linux hypervisors, and writing zero-allocation Unix utilities.`

### Active Tech Stack Tags
```text
[#network-forensics] [#docker-traefik] [#arch-linux] [#neovim] [#wireguard] 
[#posix-sh] [#python] [#golang] [#rust] [#proxmox] [#truenas]
```

---

## 2. Services Directory & Infrastructure Catalog

### A. Core & Network Infrastructure
| Service Name | Category | Port / Protocol | Domain / Routing | Access | Description |
| :--- | :--- | :--- | :--- | :--- | :--- |
| **Traefik Proxy (v3.1)** | `#core` | `443/tcp` (TLS) | `https://proxy.rooks.dev` | `INTERNAL / ONLINE` | Edge HTTP reverse proxy and load balancer with dynamic Docker provider discovery and ACME Let's Encrypt TLS wildcard certificates. |
| **OPNsense Firewall (v24.7)** | `#core` | `VLAN 10 / Mgmt` | Gateway IP | `PROTECTED / ACTIVE` | Hardened FreeBSD firewall routing 10GbE traffic with VLAN isolation, Suricata IDS/IPS, and Unbound DNS resolvers. |
| **AdGuard Home** | `#dns` | `53/udp`, `853/tcp` | `https://dns.rooks.dev` | `INTERNAL / PROTECTED` | Network-wide DNS sinkhole filtering trackers and ad domains across all VLANs with DNS-over-HTTPS upstream security. |
| **WireGuard Mesh** | `#vpn` | `51820/udp` | Peer Mesh | `PUBLIC / 14 PEERS` | High-performance encrypted point-to-point VPN tunnel connecting remote laptops and mobile endpoints to homelab subnet. |

### B. Compute, Virtualization & Storage
| Service Name | Category | Port / Protocol | Domain / Routing | Access | Description |
| :--- | :--- | :--- | :--- | :--- | :--- |
| **Proxmox VE (v8.2)** | `#compute` | `8006/tcp` | `https://pve.rooks.dev` | `INTERNAL / ONLINE` | Enterprise hypervisor cluster hosting Debian LXC containers and KVM virtual machines with Ceph & ZFS backend. |
| **TrueNAS SCALE** | `#storage` | `NFS / SMB / 443` | `https://nas.rooks.dev` | `INTERNAL / ONLINE` | Primary network attached storage managing 48TB ZFS RaidZ2 array, dataset snapshots, NFS exports, and scrub jobs. |
| **Forgejo Git Server** | `#dev-git` | `3000/tcp`, `2222/ssh` | `https://git.rooks.dev` | `PUBLIC / OPEN` | Lightweight self-hosted Git forge hosting infrastructure-as-code repos, Ansible playbooks, dotfiles, and CTF archives. |

### C. Public Tools & Developer Utilities
| Service Name | Category | Port / Protocol | Domain / Routing | Access | Description |
| :--- | :--- | :--- | :--- | :--- | :--- |
| **CyberChef Workbench** | `#security-tool` | `443/tcp` | `https://chef.rooks.dev` | `PUBLIC / OPEN` | Cyber Swiss Army Knife for hex decoding, Base64 operations, regex extraction, cryptographic hashing, and CTF payload analysis. |
| **Stirling PDF Studio** | `#pdf-tools` | `443/tcp` | `https://pdf.rooks.dev` | `PUBLIC / OPEN` | Self-hosted document processing suite for merging, splitting, OCR text extraction, password encryption, and PDF page manipulation. |
| **HedgeDoc Collaborative** | `#markdown` | `443/tcp` | `https://pad.rooks.dev` | `PUBLIC / OPEN` | Real-time collaborative Markdown editor for technical specs, RFC drafts, and collaborative meeting notes. |

### D. Media, Reading & Content Automation
| Service Name | Category | Port / Protocol | Domain / Routing | Access | Description |
| :--- | :--- | :--- | :--- | :--- | :--- |
| **Jellyfin Media Portal** | `#media-video` | `8096/tcp` | `https://watch.rooks.dev` | `AUTH REQUIRED` | FOSS media streaming engine leveraging Intel QuickSync GPU hardware acceleration for 4K HDR transcoding. |
| **Arr Automation Suite** | `#automation` | `8989 / 7878 / 9696` | `https://arr.rooks.dev` | `INTERNAL / RUNNING` | Automated content indexing, Prowlarr indexer management, Sonarr/Radarr pipeline, and SABnzbd queue downloader. |
| **Audiobookshelf** | `#media-audio` | `443/tcp` | `https://listen.rooks.dev` | `INVITE ONLY` | Self-hosted audiobook and podcast streaming server with continuous playback position synchronization across mobile clients. |
| **Calibre-Web Library** | `#ebooks` | `443/tcp` | `https://read.rooks.dev` | `PUBLIC READ` | E-book library catalog with e-reader OPDS feed integration and in-browser reading support. |

### E. Security, Telemetry & Communications
| Service Name | Category | Port / Protocol | Domain / Routing | Access | Description |
| :--- | :--- | :--- | :--- | :--- | :--- |
| **Vaultwarden** | `#secrets` | `443/tcp` (E2EE) | `https://vault.rooks.dev` | `2FA / AUTH` | Lightweight Rust implementation of the Bitwarden API hosting encrypted credentials, SSH keys, and TOTP tokens. |
| **Prometheus & Grafana** | `#telemetry` | `3000 / 9090` | `https://mon.rooks.dev` | `INTERNAL / SCRAPING` | Time-series metric collection with Node Exporter, Telegraf agents, and live cluster performance dashboards. |
| **Uptime Kuma** | `#status` | `3001/tcp` | `https://status.rooks.dev` | `PUBLIC / 100% HEALTH`| Synthetic HTTP, Ping, and TCP health monitor broadcasting real-time service uptime alerts to Discord webhooks. |
| **Matrix Synapse** | `#messaging` | `8448/tcp` | `https://matrix.rooks.dev` | `FEDERATED / OPEN` | Federated Matrix homeserver for encrypted messaging, public security channels, and cross-server communication. |

---

## 3. Technical Notes & Blog Articles

### Post 1: Featured Article (Full Writeup)
* **Title:** `Reverse Engineering IoT Firmware: SPI Flash Extraction`
* **File / Path:** `~/notes/iot-firmware-spi-extraction.md`
* **Publication Date:** `2026-07-20`
* **Reading Time:** `8 mins`
* **Tags:** `[#firmware]`, `[#hardware]`, `[#security]`, `[#bus-pirate]`
* **Abstract:** In security audits of embedded systems, retrieving the firmware is the critical first step. When over-the-air updates are encrypted and debug ports (UART, JTAG) are disabled in production silicon, dumping physical SPI Flash memory becomes necessary. This writeup covers extracting firmware from an 8-pin SOP SPI flash chip using a Bus Pirate and flashrom to bypass bootloader lockdowns.
* **Code Snippet (`extract_firmware.sh`):**
```bash
#!/bin/sh
# Query the SPI flash details using flashrom via Bus Pirate
flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M -r firmware_dump.bin

# Verify the integrity of the binary dump by comparing hashes
if [ $? -eq 0 ]; then
  echo "Dump successful. Running md5sum..."
  md5sum firmware_dump.bin
else
  echo "Failed to read flash memory." >&2
  exit 1
fi
```

### Post 2: Traefik Docker Architecture
* **Title:** `Building a High-Availability Traefik Router with Docker Compose`
* **File / Path:** `~/notes/ha-traefik-docker.md`
* **Publication Date:** `2026-07-15`
* **Reading Time:** `12 mins`
* **Tags:** `[#homelab]`, `[#docker-traefik]`, `[#networking]`
* **Abstract:** Architecting automated TLS wildcard certificate propagation, Docker provider label routing, zero-downtime container updates, and backend health-check failover routes.

### Post 3: Shell Portability
* **Title:** `POSIX sh vs. Bash: Portability in Modern Scripts`
* **File / Path:** `~/notes/posix-sh-vs-bash.md`
* **Publication Date:** `2026-07-10`
* **Reading Time:** `6 mins`
* **Tags:** `[#posix-sh]`, `[#shell]`, `[#unix]`
* **Abstract:** Analyzing edge-case incompatibilities, syntax overhead, eliminating bashisms, and writing fast, bulletproof bootstrapping scripts for Alpine and embedded targets conforming to IEEE Std 1003.1.

### Post 4: Low-Level CTF Exploitation
* **Title:** `CTF Write-up: Heap Exploitation in glibc 2.35`
* **File / Path:** `~/notes/ctf-heap-glibc-2-35.md`
* **Publication Date:** `2026-06-28`
* **Reading Time:** `15 mins`
* **Tags:** `[#ctf]`, `[#binary-exploitation]`, `[#security]`
* **Abstract:** Deconstructing modern glibc memory allocator defenses: tcache safe-linking pointer mangling, bypass primitives, and House of Apple file structure hijacking for arbitrary code execution.

### Post 5: Network Isolation
* **Title:** `Zero-Trust Network Isolation with WireGuard & OPNsense VLANs`
* **File / Path:** `~/notes/zero-trust-wireguard-opnsense.md`
* **Publication Date:** `2026-06-14`
* **Reading Time:** `10 mins`
* **Tags:** `[#networking]`, `[#wireguard]`, `[#security]`
* **Abstract:** Designing strict zone-based firewall rules across isolated VLANs (Management, Server DMZ, IoT, Trusted Clients) with point-to-point WireGuard cryptographic routing.

---

## 4. Engineering Projects & System Modules

### Module 1: Custom POSIX Shell Parser
* **Path / Identifier:** `/dev/posix-shell-parser`
* **Version:** `v1.2.0`
* **Primary Language:** `Lua`
* **Tags:** `[#lua]`, `[#ast-parser]`, `[#compilers]`
* **Summary:** A lightweight Lexer and AST parser written in Lua for parsing POSIX-compliant shell scripts. Optimized to avoid runtime heap allocations during tokenization, enabling real-time syntax coloring inside terminal buffers.
* **Code Snippet (`lexer.lua`):**
```lua
local function tokenize(src)
  local tokens = {}
  for pos, char in ipairs(src) do
    if char == ";" or char == "|" then
      table.insert(tokens, { type = "OPERATOR", value = char })
    end
  end
  return tokens
end
```

### Module 2: WireGuard Mesh Topology Builder
* **Path / Identifier:** `/dev/wireguard-mesh`
* **Version:** `v0.8.4`
* **Primary Language:** `Python` / `POSIX sh`
* **Tags:** `[#networking]`, `[#wireguard]`, `[#automation]`
* **Summary:** Automated configuration generator that computes public/private key matrices and generates atomic configuration files for full-mesh WireGuard overlay networks spanning cloud VMs and homelab servers.

### Module 3: Zero-Allocation Logger (Go)
* **Path / Identifier:** `/dev/zero-alloc-logger`
* **Version:** `v2.1.1`
* **Primary Language:** `Go`
* **Tags:** `[#go]`, `[#performance]`, `[#systems]`
* **Summary:** A high-throughput structured JSON logger utilizing `sync.Pool` memory recycling to eliminate GC pause overhead during disk I/O (>500,000 log events/second).

### Module 4: Embedded Kernel Boot Strap
* **Path / Identifier:** `/dev/kernel-bootstrap`
* **Version:** `v0.1.0`
* **Primary Language:** `ARM Cortex Assembly` / `C`
* **Tags:** `[#arm-cortex]`, `[#assembly]`, `[#embedded]`
* **Summary:** Bare-metal boot sector and initial C runtime setup for ARM Cortex-M microcontrollers. Configures vector table offset registers, performs memory section copying, and initializes early UART debugging output.

### Module 5: Traefik Cloudflare Dynamic DNS Daemon
* **Path / Identifier:** `/dev/ddns-daemon`
* **Version:** `v1.0.2`
* **Primary Language:** `Python` / `Docker SDK`
* **Tags:** `[#docker]`, `[#traefik]`, `[#cloudflare]`
* **Summary:** Background controller daemon monitoring Docker container state transitions and synchronizing container label subdomains with Cloudflare DNS A/AAAA records.

---

## 5. Physical Hardware Nodes & Telemetry

```text
+-------------------+      10GbE SFP+      +-------------------+
|   gw-node01.lan   | <==================> |   pve-node02.lan  |
|  OPNsense 24.7    |                      |  Proxmox VE 8.2   |
| Intel N100 (4C/4T)|                      | AMD 5900X (12C/24T|
+-------------------+                      +-------------------+
         ||                                         ||
         || 10GbE Trunk                             || 10GbE NFS/SMB
         \/                                         \/
+--------------------------------------------------------------+
|                        nas-node03.lan                        |
|             TrueNAS SCALE (48TB RaidZ2 Pool)                 |
|             Intel Core i5-12400 (6C/12T) / 64GB ECC          |
+--------------------------------------------------------------+
```

| Hostname | Role / Operating System | Hardware Specifications | Nominal Load |
| :--- | :--- | :--- | :--- |
| **`gw-node01.lan`** | Edge Gateway / OPNsense 24.7 | Intel N100 (4C/4T), 16GB DDR5, 4x 2.5GbE I226-V | CPU: 18% \| RAM: 32% |
| **`pve-node02.lan`** | Hypervisor / Proxmox VE 8.2 | AMD Ryzen 9 5900X (12C/24T), 128GB ECC DDR4, 2x 2TB NVMe | CPU: 42% \| RAM: 68% |
| **`nas-node03.lan`** | Storage / TrueNAS SCALE | Intel Core i5-12400 (6C/12T), 64GB ECC, 6x 16TB Enterprise SAS | CPU: 14% \| RAM: 82% (ZFS ARC) |

---

## 6. ASCII Mascot & Daemon Artframes (`sys-daemon`)

### Frame 1: Idle / Scanning
```text
      .-----------------.
     /  ^     ^     ^  /|
    /  (_)   (_)   (_) / |
   /__________________/  |
   |  ___        ___  |  |
   | [o_o]      [o_o] |  |
   |  `-'        `-'  |  |
   |      ______      |  |
   |     /      \     |  /
   |     |  --  |     | /
   |      \____/      |/
   `------------------'
```

### Frame 2: Active / Alert
```text
      .-----------------.
     /  ^     ^     ^  /|
     /  (_)   (_)   (_) / |
   /__________________/  |
   |  ___        ___  |  |
   | [-_-]      [-_-] |  |
   |  `-'        `-'  |  |
   |      ______      |  |
   |     /      \     |  /
   |     |  O   |     | /
   |      \____/      |/
   `------------------'
```

### Frame 3: Scroll-Tracker Cat Daemon
```text
    /\___/\
   ( o   o )  sys-daemon
   (  =^=  )  [TRACKING]
    (---)
```

---

## 7. Sample Pages Material Mapping Matrix

This matrix specifies which components and data entries from this canonical document are presented in each sample layout:

| Sample File | Layout Style | Persona / Bio | Services Included | Notes / Articles | Project Modules | Nodes & Telemetry | Mascot / Daemon |
| :--- | :--- | :---: | :---: | :---: | :---: | :---: | :---: |
| [`index.html`](file:///home/venus/code/blog/index.html) | Root Minimalist Business Card | Full whoami | — | — | Active Stack Tags | Terminal stdout | — |
| [`samples/homepage.html`](file:///home/venus/code/blog/samples/homepage.html) | Sample 1: Developer Homepage | Profile header | — | Post 1 (Full) + Archive Index (2,3,4) | — | — | — |
| [`samples/split-panel.html`](file:///home/venus/code/blog/samples/split-panel.html) | Sample 2: Split Panel Feed | — | — | — | Modules 1–5 | Status row | Frame 1/2 Animated |
| [`samples/companion.html`](file:///home/venus/code/blog/samples/companion.html) | Sample 3: Companion Layout | — | — | — | Modules 1–5 | Terminal card | Frame 3 Cat Daemon |
| [`samples/document-flow.html`](file:///home/venus/code/blog/samples/document-flow.html) | Sample 4: Continuous Document Flow | Header banner | — | Post 1 Snippets | Modules 1–5 in detail | — | Frame 3 Scroll Tracker |
| [`samples/portfolio.html`](file:///home/venus/code/blog/samples/portfolio.html) | Sample 5: Portfolio Card | Full whoami | — | — | Active Stack Tags | Terminal stdout | — |
| [`samples/homelab.html`](file:///home/venus/code/blog/samples/homelab.html) | Sample 6: Homelab Lander | Header banner | All Core & Compute (12 services) | — | — | Nodes 1–3 + ASCII Topology | Terminal logs |
| [`samples/public-services.html`](file:///home/venus/code/blog/samples/public-services.html) | Sample 7: Public Portal | Header banner | All Public Utilities (9 services) | — | — | Keys & PGP box | — |
| [`samples/sample-dashboard.html`](file:///home/venus/code/blog/samples/sample-dashboard.html) | Sample 8: 3-Tile Workspace | Center tile bio | Left tile services | Right tile archive | Center tile projects | Status bar | Vim command bar |
| [`samples/sample-command-center.html`](file:///home/venus/code/blog/samples/sample-command-center.html) | Sample 9: Tabbed Command Center | Tab 3 (Resume) | Tab 1 (Services) | Tab 2 (Blog Notes) | Tab 3 (Projects) | Tab 1 (Nodes) | Status dots |
| [`samples/sample-dual-pane-explorer.html`](file:///home/venus/code/blog/samples/sample-dual-pane-explorer.html) | Sample 10: Helix Tree Explorer | Sidebar links | Services subtree | Notes subtree | Modules subtree | Status bar | Sidebar companion |