From d443f9ad6ba5a43443ef6cea47a4fb83dda75ee8 Mon Sep 17 00:00:00 2001 From: jwright Date: Tue, 25 Aug 2026 08:52:35 +1000 Subject: [PATCH] mirror second-pass close-out: retention diagram precision, evidence taxonomy, sourced Talos reboot claim, qualified failure matrix, Hub pull terminology, referrer completeness split, storage semantics, secret-rotation truth, table captions + scope + keyboard regions, all-lazy plates, en-AU, editorial reduction, extended gates --- Dockerfile | 10 +- README.md | 4 +- pilot/assemble-arc.mjs | 21 +- pilot/index.tpl.html | 8 +- pilot/mirror.js | 1 + pilot/mirror.tpl.html | 608 +++++++++++++++++++---------------------- 6 files changed, 312 insertions(+), 340 deletions(-) diff --git a/Dockerfile b/Dockerfile index e84b0b1..4702bb3 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,11 +1,11 @@ # syntax=docker/dockerfile:1 -# Static teaching site: bash assembles dist/ from the split source, then a pinned -# nginx-unprivileged serves it. No Node build — build.sh is plain bash + coreutils. +# Static teaching site: build.sh runs the node assembler (pilot/assemble-arc.mjs) to +# produce dist/, then a pinned nginx-unprivileged serves it. No package installs - the +# assembler is dependency-free node. # ---- build stage ---------------------------------------------------------- -# Reusing the digest the site image already pins: it's a bookworm-slim base that is -# verified and cached in the zot pull-through mirror, so this layer costs nothing -# extra. Only bash/sed/find/install are used here — node itself is incidental. +# A bookworm-slim node base, digest-pinned and typically served from the zot +# pull-through mirror; node runs the assembler. FROM node:22-bookworm-slim@sha256:d9f850096136edbc402debdd8729579a288aac64574ada0ff4db26b6ae58b0b2 AS build ARG BUILD_REV=dev ENV BUILD_REV=$BUILD_REV diff --git a/README.md b/README.md index 4d74547..615cf8f 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # The Teaching Lab (learn.bztmon.com) -A multi-page static technical learning site: scroll-driven teardowns of infrastructure the -author actually operates. Dark engineering-dossier aesthetic (void `#070b14`, cyan `#3fbaf5`, +A static learning site documenting infrastructure I operate in my homelab - the decisions, +the failures, and the validation still outstanding. Dark engineering-dossier aesthetic (void `#070b14`, cyan `#3fbaf5`, magenta `#e879f9`), dependency-light by design, strict security posture. ## Pages diff --git a/pilot/assemble-arc.mjs b/pilot/assemble-arc.mjs index 8d0e619..6469cf1 100644 --- a/pilot/assemble-arc.mjs +++ b/pilot/assemble-arc.mjs @@ -141,7 +141,7 @@ const OG_IMG = SITE + heroUrls["__HERO_GITOPS__"]; // shared document shell: every page on the site gets the same head discipline const shell = ({ title, desc, path, ogImg, scripts, bodyHtml }) => ` - + @@ -178,7 +178,7 @@ const html = shell({ }); // ---- The Mirror (chapter 02): fingerprint its plates + its app script ------- -const MIRROR_DESC = "A pull-through container registry taken apart: why a lab runs its own mirror, the chicken-and-egg loops inside it, and the scars that taught each rule."; +const MIRROR_DESC = "How a zot pull-through registry behaves under Talos and containerd: upstream routing, digest preservation, garbage collection, authentication rollout, failure modes, and the lab evidence behind each decision."; let mirror = readFileSync(join(ROOT, "pilot/mirror.tpl.html"), "utf8"); const mirrorPlates = {}; for (const n of ["20", "21", "22", "23", "24", "25"]) { @@ -186,10 +186,10 @@ for (const n of ["20", "21", "22", "23", "24", "25"]) { mirrorPlates[n] = url; const dims = jpegSize(buf); if (!dims) throw new Error(`mirror plate ${n}: JPEG dimensions unreadable`); - // plate 20 is the page's first image (near the fold) -> eager/LCP; the rest lazy. - const load = n === "20" ? "eager" : "lazy"; + // every plate sits below the fold (fact panel + contents precede the first scene), + // so all six lazy-load; intrinsic dims come from the actual bytes. mirror = mirror.replace(`__M${n}__`, - `${url}" width="${dims.w}" height="${dims.h}" decoding="async" loading="${load}`); + `${url}" width="${dims.w}" height="${dims.h}" decoding="async" loading="lazy`); } const mirrorJs = readFileSync(join(ROOT, "pilot/mirror.js")); const mirrorJsName = `mirror.${fp(mirrorJs)}.js`; @@ -240,6 +240,11 @@ for (const [pg, doc] of [["cluster", html], ["mirror", mirrorHtml], ["index", di // target the assertive phrasings and internal production jargon, not the topic words. const mirrorBanned = [ [/never leaves the building/i, "retired absolute cache claim"], + [/SAY IT/, "removed rhetorical block resurfaced"], + [/HOMELAB CLAUSE/, "removed label resurfaced"], + [/Nothing on v2\.1\.17\/18 protects/, "over-broad retention annotation resurfaced"], + [/100 manifest requests per six hours/, "imprecise Hub limit phrasing"], + [/a tag is a suggestion, a digest is a fact/i, "retired slogan"], [/up to twelve|twelve tries|12 attempts/i, "stale retry arithmetic (correct figure: sixteen)"], [/plate-level/i, "internal production note leaked to readers"], [/· motion:/i, "art-direction caption leaked to readers"], @@ -249,6 +254,9 @@ const mirrorBanned = [ for (const [re, msg] of mirrorBanned) if (re.test(mirrorHtml)) fail.push("mirror: " + msg); const mirrorRequired = [ ["zotregistry.dev", "primary zot references missing"], + ["docs.docker.com/docker-hub/usage/pulls", "Docker Hub pulls reference missing"], + ["v1alpha1", "Talos auth-reboot source link missing"], + ["deleteUntagged", "blanket untagged lever discussion missing"], ["keepUntagged", "version-gated retention discussion missing"], ["/livez", "real health endpoints missing"], ['id="refs"', "references section missing"], @@ -257,6 +265,9 @@ const mirrorRequired = [ ]; for (const [needle, msg] of mirrorRequired) if (!mirrorHtml.includes(needle)) fail.push("mirror: " + msg); must((mirrorHtml.match(/width="1600" height="872"/g) || []).length === 6, "mirror: expected six correctly-dimensioned plates"); +must((mirrorHtml.match(/loading="lazy"/g) || []).length === 6, "mirror: expected all six plates lazy-loaded"); +must((mirrorHtml.match(/(?!<)/.test(mirrorHtml.replace(//g, "")), "mirror: th without scope=col"); must(!/100vw/.test(mirrorHtml), "mirror: viewport-width unit reintroduces scrollbar overflow"); must(!mirrorHtml.includes("gsap"), "mirror: unexpected animation library reference"); diff --git a/pilot/index.tpl.html b/pilot/index.tpl.html index 850e26a..4e54e8a 100644 --- a/pilot/index.tpl.html +++ b/pilot/index.tpl.html @@ -61,13 +61,13 @@ footer a{color:var(--cyan)} - + Chapter 02 · Dossier 005

The Mirror →

-

Outcome — a pull-through container registry taken apart: why a - lab runs its own mirror, the four chicken-and-egg loops hiding inside it, and the scars that - taught each rule - told with the receipts.

+

Outcome — how a zot pull-through registry behaves under Talos and + containerd: upstream routing, digest preservation, garbage collection, authentication + rollout and failure modes, with the lab evidence behind each decision.

 diff --git a/pilot/mirror.js b/pilot/mirror.js index af81736..cef44cc 100644 --- a/pilot/mirror.js +++ b/pilot/mirror.js @@ -29,6 +29,7 @@ if (hit) visible[hit[0]] = e.isIntersecting; }); if (visible.s23) startPulse(); // (re)arm the breather when its scene returns + onScroll(); // anchor jumps and observer-only transitions update without a scroll event }, { rootMargin: "10% 0px" }); watched.forEach(function (w) { io.observe(w[1]); }); diff --git a/pilot/mirror.tpl.html b/pilot/mirror.tpl.html index 0a49287..cee7294 100644 --- a/pilot/mirror.tpl.html +++ b/pilot/mirror.tpl.html @@ -37,9 +37,7 @@ .scene img{width:100%;height:auto;display:block;border-radius:.4rem} .scene .cap{font-family:var(--mono);font-size:.74rem;color:var(--ink-dim); letter-spacing:.1em;text-align:center;margin-top:.7rem;padding:0 1rem} - .sayit{border-left:3px solid var(--magenta);margin:2rem 0;padding:.4rem 0 .4rem 1.1rem; - font-size:1.26rem;font-weight:650;line-height:1.35;color:#fff} - .sayit .k{display:block;font-family:var(--mono);font-size:.7rem;letter-spacing:.2em;color:var(--magenta);margin-bottom:.3rem;font-weight:500} + [tabindex="0"]:focus-visible{outline:2px solid var(--cyan);outline-offset:3px} .note{background:var(--card);border:1px solid var(--line);border-left:3px solid var(--cyan); border-radius:.45rem;padding:1rem 1.2rem;margin:1.6rem 0;font-size:.98rem} .note .k{font-family:var(--mono);font-size:.72rem;letter-spacing:.18em;color:var(--cyan)} @@ -114,11 +112,10 @@

← The Teaching Lab

Dossier / 005 · operations

The Mirror

-

Outcome — a pull-through OCI registry taken apart: why this - lab runs its own mirror, what the deployed version actually guarantees, the retention trap - that quietly evicts digest-pinned content, and how each lesson translates into production - platform engineering. Claims are labelled: observed here, documented upstream, or not yet - verified.

+

Outcome — a pull-through OCI registry taken apart: what + the deployed version guarantees, the retention behaviour that evicts digest-pinned + content, and how each lesson translates to production. Claims carry evidence labels + throughout.

@@ -129,9 +126,16 @@
Storage
50Gi local PVC; dedupe on, GC on (1h delay / 24h interval); no retention config
Auth state
anonymous read enabled; per-node pull credentials staged, not yet enforced
Fallback
origin fallback ON (platform default; deliberately not disabled)
-
Validated
2026-08-25 (live config read + upstream doc/source verification)
-
Open items
digest-entry retention (needs v2.1.19+), auth canary negative test, upstream namespace prefixes, disconnected-serve drill
+
Reviewed
2026-08-25: live cluster configuration read; upstream docs and v2.1.17 source checked; live runtime tests listed separately in the open register
+
Open items
pull-aware digest-entry retention (needs v2.1.19+; blanket alternatives are capacity-heavy), auth canary negative test, upstream namespace prefixes, disconnected-serve drill
+

+ Evidence labels used below: lab reproduced here with a dated receipt · + config present in the inspected config · + source established from the deployed version's source · + docs stated in version-appropriate documentation · + reported described in an unresolved upstream issue · + proposed not deployed · open not yet run