Tech Stack

A colophon: how this site is built and why. It is a plain static site: hand-written HTML, one build step, no framework, no tracking. The whole thing is small enough to read in a few minutes on GitHub.

The stack

Weight: a cold visit to this site's home page pulls under 100 KB uncompressed, images and font included. That is a budget the build enforces, not an aspiration: exceed it and the build fails. The home page is listed on 512kb.club’s green team and is a member of the 250kb.club.
Markup: hand-written HTML. No framework, no client-side rendering.
Styles: Tailwind CSS, compiled to a single minified stylesheet at build time. Only the classes actually used are shipped, and the file name carries a hash of its contents so a new deploy can never be served with an old stylesheet.
Type: Public Sans (SIL Open Font License), self-hosted, subset to Latin and trimmed to the weights in use, then versioned, preloaded, and cached for a year. No font CDN.
Icons: none. The design is typographic; the only image on the site is the profile photo, and the page makes no third-party requests when it loads.
Scripts: three small vanilla-JS files: the theme control, a contact address assembled in the browser to cut scraping, and site search. No bundler, no analytics, no cookies.
Search: an index built from these pages at deploy time and matched in your browser; the query never leaves it. No search library: the corpus is about 31 KB and the index about 41 KB, fetched only when you first open search. A WebAssembly search engine would also have meant loosening the CSP below to allow wasm-unsafe-eval.

Hosting & build

Cloudflare Pages is the primary host and Netlify is a second, independent one. Both rebuild from the same repository on every push: compile the CSS, then serve the static output from their own CDN edges. The build is a single command; there is nothing to run server-side.

Redundancy

Availability is treated as two separate problems: keeping the site reachable, and keeping its source recoverable. Each is solved independently:

Reachable: four independent serving hosts from one source, so a single provider outage doesn't take the site down.
Reachable, again: beyond the web hosts, the same build is served over Tor and I2P from a server I run, over IPFS from this site's own nodes, permanently on Arweave, as a Nostr nsite, and over Gemini, gopher, SSH, telnet and anonymous FTP, and as a BitTorrent download that names this origin as a webseed, so it works with no peers and gets faster with them. A 4EVERLAND host serves each release from IPFS. Different networks, different failure modes.
Resolvable: the domain's DNS is answered by two authoritative providers, Cloudflare and deSEC, under multi-signer DNSSEC. Each signs the zone with its own keys and serves both public keys, and the registry anchors both chains, so answers validate no matter which provider a resolver happens to ask. The zone is declared once, as code, and applied to each provider; a timer compares them and complains when they drift. Losing a DNS provider no longer takes the name down.
Holdable: each release attaches the whole site as one ZIM file, which opens offline in Kiwix. The mirrors answer "can I still reach it"; this answers "can I hold it".
Watched: every serving surface is compared against the signed manifest on a schedule, and the primary is re-checked hourly from two separate networks, so a mirror that goes stale or a page that gets rewritten in transit raises an alarm instead of waiting to be noticed. The machine that runs the automation is itself watched from another, on the reasoning that a monitor which can fail silently is half a monitor.
Current: the site's IPFS hash changes on every push, so the other nodes follow a pointer rather than keep a copy of one build. One machine builds, pins, publishes the IPNS name and writes the resulting hash both to a file it serves and to the DNSLink record; the others read that hash on a timer and pin whatever it names. None of them resolves the IPNS name directly, which sounds like the obvious way to do it: IPNS records are published with a year of validity, so a resolver can hand back a months-old record that is still perfectly valid.
Recoverable: the repository is mirrored to Codeberg, Gitea, GitLab, and SourceHut alongside GitHub and kept in sync automatically. No single code host is a point of failure. It is also published hostlessly to Radicle, which replicates it peer-to-peer between nodes, and to Nostr via GRASP, where signed events are the authority and git servers are interchangeable relays, so it survives every forge at once. On AT Protocol it lives on a Tangled knot with a DID of its own, addressable through the atmosphere rather than through an account on any one forge. Software Heritage holds a permanent archival copy.
Preserved: the site is snapshotted by the Internet Archive's Wayback Machine after every deploy, and separately by archive.today, outside every host above. Two archives under two operators, because one archive is one point of failure like anything else.
Verifiable: every build ships a manifest of file hashes; each release's manifest is signed with the same Nostr key this domain attests at /.well-known/nostr.json and anchored in Bitcoin with OpenTimestamps. Any mirror can be checked against it.

The full list of hosts, forges, and archives lives on the mirrors page.

Privacy & security

A Content-Security-Policy built on default-src 'self', with script-src 'self' - no third-party code runs on this site, on any page. Three pages do read outside data: the two POAP pages and the Tezos gallery pull images, video and chain data from named endpoints, and the policy lists every one of them by name rather than allowing a wildcard.
Security headers on every response: MIME-sniffing off, framing denied, a strict referrer policy, camera / microphone / geolocation disabled, and browsers held to HTTPS for a year (HSTS).
No analytics, no cookies, no third-party embeds, no external fonts or CDNs. Nothing to consent to because nothing is collected.
A .well-known/security.txt (RFC 9116) publishes a contact for reporting vulnerabilities.

Identity & payments

A few .well-known endpoints serve live lookups: Nostr NIP-05 name verification, a Lightning LNURL-pay address, and a Keybase proof. All three are served with the right headers on every host, so they keep working no matter which mirror answers.

Design

Monochrome and minimal, in Public Sans. The theme button in the header cycles through three states (follow your system, force light, force dark), and your choice is remembered. The mark itself is the way home.