Update project description

Signed-off-by: Tommy <contact@tommytran.io>

.devcontainer/devcontainer.json

@@ -8,7 +8,7 @@
 	"features": {
 		"ghcr.io/devcontainers/features/hugo:1": {
 			"extended": true,
-			"version": "0.119.0"
+			"version": "latest"
 		}
 	}
 

.github/dependabot.yml

@@ -4,5 +4,3 @@ updates:
     directory: "/"
     schedule:
       interval: daily
-    labels:
-      - "dependency"

cloudflare-build.sh

@@ -1,8 +1,10 @@
 #!/bin/bash
 
-#curl -L -s https://api.github.com/repos/gohugoio/hugo/releases/latest | grep "browser_download_url.*extended.*linux-amd64.tar.gz" | cut -d : -f 2,3 | sed 's/"//g' | xargs wget
+set -euo pipefail
 
-wget https://github.com/gohugoio/hugo/releases/download/v0.119.0/hugo_0.119.0_Linux-64bit.tar.gz
+curl -L -s https://api.github.com/repos/gohugoio/hugo/releases/latest | grep "browser_download_url.*extended.*linux-amd64.tar.gz" | cut -d : -f 2,3 | sed 's/"//g' | xargs wget
+
+# wget https://github.com/gohugoio/hugo/releases/download/v0.119.0/hugo_0.119.0_Linux-64bit.tar.gz
 
 tar xvf ./*.tar.gz
 chmod u+x ./hugo

config.yml

@@ -1,7 +1,7 @@
 baseURL: "https://tommytran.io"
-title: Tommy Tran - System Administrator and Technical Writer
+title: Tommy Tran - System Administrator
 theme: WonderMod
-copyright: '©Thien Tran 2021-2023'
+copyright: '©Thien Tran 2021-2024'
 enableRobotsTXT: true
 enableGitInfo: true
 
@@ -13,11 +13,11 @@ params:
   env: production # to enable google analytics, opengraph, twitter-cards and schema.
   author: Tommy
   # author: ["Me", "You"] # multiple authors
-  description: System Administrator and Technical Writer
+  description: System Administrator
   keywords: [TommyTran732]
   defaultTheme: dark # dark, light
   disableThemeToggle: false
-  images: ["/cortana.png"]
+  images: ["/avatar.png"]
   ShowReadingTime: true
   ShowPostNavLinks: true
   ShowBreadCrumbs: true
@@ -37,25 +37,18 @@ params:
 
   label:
     text: "Tommy Tran"
-    icon: "/cortana.png"
+    icon: "/avatar.png"
 
   # profile-mode
   profileMode:
     enabled: true # needs to be explicitly set
     title: Tommy Tran
     subtitle: "System Administrator and Technical Writer"
-    imageUrl: "/cortana.png"
-    buttons:
-      - name: About
-        url: about
-      - name: Contact
-        url: contact
+    imageUrl: "/avatar.png"
 
   socialIcons:
     - name: github
       url: "https://github.com/tommytran732"
-    - name: gitea
-      url: "https://git.tommytran.io/Tomster"
     - name: matrix
       url: "https://invite.arcticfoxes.net/#/@tommy:arcticfoxes.net"
     - name: telegram
@@ -104,22 +97,26 @@ markup:
 
 menu:
   main:
+    - identifier: About
+      name: About
+      url: /about/
+      weight: 10
     - identifier: Blog
       name: Blog
       url: https://privsec.dev
-      weight: 10
+      weight: 20
+    - identifier: Contact
+      name: Contact
+      url: /contact/
+      weight: 30
     - identifier: Projects
       name: Projects
       url: /projects/
-      weight: 20
-    - identifier: Packages
-      name: Packages
-      url: /packages/
-      weight: 30
+      weight: 40
     - identifier: PGP
       name: PGP
       url: tommy.asc
-      weight: 40
+      weight: 50
 
 privacy:
   disqus:

content/about.md

@@ -9,6 +9,6 @@ Hey there 👋
 
 My name is Thien, but I mostly go by "Tommy" nowadays. I am an Linux system administrator around 4 years of experience. I am familiar with most major Linux families, from Red Hat to Debian to SUSE to Arch Linux. Recently, my interest has shifted to immutable distributions such as Fedora Silverblue/CoreOS and openSUSE MicroOS.
 
-Like most Linux users, I am an open source enthusiast and publish most of the projects made in my free time on [GitHub](https://github.com/tommytran732) and [my own Gitea instance](https://git.tommytran.io/tomster). I also made a couple of small contributions to various projets on GitHub as well.
+Like most Linux users, I am an open source enthusiast and publish most of the projects made in my free time on [GitHub](https://github.com/tommytran732). I also made a couple of small contributions to various projets on GitHub as well.
 
-If you are active in the privacy communities on Matrix, you may recognize me. I used to be a collaborator for [PrivacyGuides.org](https://privacyguides.org) and wrote a large portion of the site from around October 2021 - July 2022. Now, I am now working on my own website - [PrivSec.dev](https://privsec.dev) - with a couple of friends I "met" through [GrapheneOS](https://grapheneos.org). Oh, while we are on this topic, I am also a moderator in the official GrapheneOS channels as well (though not a developer or project member). Or, you may just know me as that one guy who loves throwing a hypervisor at every problem he encounters, typical of a Qubes OS user. 
+I have a collaborative blog - [PrivSec.dev](https://privsec.dev) - with a couple of friends I "met" through [GrapheneOS](https://grapheneos.org).

content/contact.md

@@ -9,25 +9,19 @@ date: 2022-09-02
 
 The best way to contact me is through Matrix. My account is [@tommy:arcticfoxes.net](https://invite.arcticfoxes.net/#/@tommy:arcticfoxes.net). If you do not have a an account, you can sign up for one on my homeserver [arcticfoxes.net](https://arcticfoxes.net). I do not ask for your email address or any personal information for registration.
 
-## SimpleX Chat
-
-My SimpleX Chat address is `https://simplex.chat/contact#/?v=1-4&smp=smp%3A%2F%2FN_McQS3F9TGoh4ER0QstUf55kGnNSd-wXfNPZ7HukcM%3D%40smp19.simplex.im%2F03zrijd3pM0hi2AG6XLiMMpxEsjEqj_5%23%2F%3Fv%3D1-2%26dh%3DMCowBQYDK2VuAyEAx3xSpEh_hRUiGatqlRxGajqIcg6H6xc9jf-2UfeJGA4%253D%26srv%3Di53bbtoqhlc365k6kxzwdp5w3cdt433s7bwh3y32rcbml2vztiyyz5id.onion`
-
-You can scan the QR code here:
-
-![SimpleX Chat](/images/simplex-chat-address.png)
-
 ## Telegram
 
 My Telegram is [TommyTran732](https://t.me/tommytran732). I do not check it as often as I do with Matrix. When contacting me, please use the [Secret Chat](https://telegram.org/faq#q-how-do-i-start-a-secret-chat) feature.
 
 ## Email
 
-If you prefer to reach out to me via email, my address is [contact@tommytran.io](mailto:contact@tommytran.io). I do not use PGP for emails. Aliases:
+If you prefer to reach out to me via email, my address is [contact@tommytran.io](mailto:contact@tommytran.io). Aliases:
 
 - [tommy@privsec.dev](mailto:tommy@privsec.dev)
 - [tommy@arcticfoxes.net](mailto:tommy@arcticfoxes.net)
 
+Please use encryption if possible. My PGP key is available [here](https://tommytran.io/tommy.asc).
+
 ## Other Accounts
 
 Discord:
@@ -44,11 +38,10 @@ Reddit:
 My Git accounts:
 - [GitHub](https://github.com/tommytran732)
 - [GitLab](https://gitlab.com/tommytran732) (inactive)
-- [Gitea](https://git.tommytran.io/tomster)
 
 Packaging:
 - [AUR](https://aur.archlinux.org/account/TommyTran732) (login required)
 - [Docker Hub](https://hub.docker.com/u/tommytran732) (inactive)
-- [Quay.io](https://quay.io/tommytran732)
+- [Quay.io](https://quay.io/tommytran732) (inactive)
 
 Please by wary of anyone claiming to be me or using the handle "TommyTran732" reaching out to you. Chances are, they are an impersonator. You can always contact me via Matrix or Email for identity verification.

content/packages.md

@@ -1,23 +0,0 @@
----
-title: "Packages"
-date: 2022-09-03
----
-
-## Synapse
-![Matrix](/images/matrix.jpg)
-
-I have a [simple fork](https://github.com/tommytran732/Synapse-Docker) of [Wonderfall's hardened Synapse Docker image](https://github.com/Wonderfall/docker-synapse) with the [Mjolnir module](https://github.com/matrix-org/mjolnir/blob/main/docs/synapse_module.md) support and the default (as opposed to light) variant of the [Hardened Memory Allocator](https://github.com/GrapheneOS/hardened_malloc).
-
-You can obtain the image by pulling `ghcr.io/tommytran732/synapse` or `quay.io/tommytran732/synapse`.
-
-## Matrix.to
-
-I made an Alpine Docker container for [Matrix.to](https://matrix.to) that you obtain by pulling `ghcr.io/tommytran732/matrix.to`. The default instance has been changed from [Element.io](https://app.element.io) to [ArcticFoxes.net](https://element.arcticfoxes.net).
-
-## pamac-flatpak AUR
-
-![pamac](/images/pamac.png)
-
-I maintain the [`pamac-flatpak`](https://aur.archlinux.org/packages/pamac-flatpak), [`pamac-flatpak-gnome`](https://aur.archlinux.org/packages/pamac-flatpak-gnome), and [`libpamac-flatpak`](https://aur.archlinux.org/packages/libpamac-flatpak) AUR packages. Originally, they were forks of [`pacmac-all`](https://aur.archlinux.org/packages/pamac-all) and [`libpamac-all`](https://aur.archlinux.org/packages/libpamac-nosnap) with snapd removed. I found snapd to be quite annoying - it is yet another AUR package I don't need, requires `cgroupsv1` for confinement, does not integrate with `gnome-software`, makes lots of loopback mounts, and so on.
-
-Nowadays, they are based on the [`pamac-nosnap`](https://aur.archlinux.org/packages?O=0&K=pamac-nosnap) package with some minor changes to make the build and installation process nicer and more convenient.

content/projects.md

@@ -11,38 +11,66 @@ date: 2022-09-02
 
 We focus on in-depth system configuration, security analysis, and software/hardware recommendations. Our site is based on technical merits, not ideologies and politics.
 
+## Polarix Containers
+
+![Polarix Containers](/images/containers.jpg)
+
+[Polarix Containers](https://github.com/Polarix-Containers) is a collection of OCI containers aiming to improve security over upstream builds.
+
+Some containers are simple daily rebuilds of upstream containers. Others are remade from scratch with Alpine Linux/Red Hat UBI and unprivileged users. hardened_malloc is included in most builds.
+
 ## ArcticFoxes.net
 
 ![ArcticFoxes.net](/images/arcticfoxes.png)
 
 [ArcticFoxes.net](https://arcticfoxes.net) is a group of self hosted and federated services run by me. It consists of:
 
-- [A Matrix server](https://matrix.arcticfoxes.net) using my [hardened docker image](https://github.com/tommytran732/Synapse-Docker). I also have a [web client](https://element.arcticfoxes.net) and TURN server as accessories for the Matrix server.
-- [A Nitter instance](https://nitter.arcticfoxes.net)
-- [A OpenVPN to ONC converter](onc.arcticfoxes.net). This is a simpel fork of [thomkeh/ovpn2onc](https://github.com/thomkeh/ovpn2onc) with a dark theme.
+- [A Matrix server](https://matrix.arcticfoxes.net).
+- [A OpenVPN to ONC converter](onc.arcticfoxes.net). This is a simple fork of [thomkeh/ovpn2onc](https://github.com/thomkeh/ovpn2onc) with a dark theme.
+
+It also formerly included Nitter and Signal TLS Proxy instances.
 
 Most of the configurations and deployment files are available on [GitHub](https://github.com/ArcticFoxes-net).
 
-## Pterodactyl Script
+## Linux Setup Scripts
 
-![Pterodactyl](/images/pterodactyl.png)
+![Glitched Tux](/images/glitched-tux.jpg)
 
-The [Pterodactyl Script](https://github.com/tommytran732/Pterodactyl-Script) is a bash script I wrote to automate the fairly tedious installation process of the popuar Pterodactyl control panel. It comes with automatic SSL certificate generation using Certbot, MariaDB SSL, basic firewall configuration, Fail2ban, and optional phpMyAdmin support. With this script, a 30-40 minutes task for a seasoned system administrator could be completed in under 5 minutes. This is my most popular project to date, with over 150 stars on GitHub.
+These are setup [scripts I run on my Linux systems](https://github.com/TommyTran732/Linux-Setup-Scripts), and serve as the basis for my other setups. You can adapt them to deploy yours. 
 
-## Arch Install Script
-
-![Arch Linux](/images/archlinux.jpg)
-
-The Arch Setup Script is a script that I wrote to automate my Arch Linux installation which mimics openSUSE's setup with BTRFS and Snapper. At the time, there was no other installer that does this nicely because they all use the same flat layout as recommended in the Arch Wiki. The downside of using this layout is that snapper rollback does not work properly and the user has to get into the Arch ISO to manually rollback their system. This could be solved by using the openSUSE's layout for BTRFS, and I forked Easy Arch to do just that.
-
-Over time, I have been adding more security/privacy related settings by default (such as randomized MAC address, IPv6 Privacy, Apparmor, Kernel module blacklist, encrypted /boot). The project is still actively developed, and many of the changes I made are merged upstream as well.
+Features include, but are not limited to:
+- Removal of unnecessary packages
+- Hardened boot parameters
+- Hardened sysctl settings
+- Kernel module blacklist from [secureblue](https://github.com/secureblue/secureblue)
+- Mac Address randomization for desktop installations
+- SSH client and server hardening
+- Installation of Hardened Malloc on Red Hat systems
+- Installation and configuration of Microsoft Edge policies for desktop installations
+- NTS setup
+- Firewall setup
 
 ## Fedora CoreOS Ignition Files
 
 ![Fedora CoreOS](/images/fedora-coreos.png)
 
-These are sample [Butane/Ingition configuration files](https://github.com/tommytran732/Fedora-CoreOS-Ignition) that you can adapt to quickly deploy a Fedora CoreOS server with the containers of your choice.
+These are sample [Butane/Ingition configuration files](https://github.com/tommytran732/Fedora-CoreOS-Ignition) that you can adapt to quickly deploy a Fedora CoreOS server with the containers of your choice. They share the same hardening as the Linux Setup Scripts.
 
-Out of the box, you will have a set of hardened boot parameters, sysctl settings, along with a set of kernel module blacklist from Whonix's [security-misc](https://github.com/Kicksecure/security-misc/blob/master/etc/modprobe.d/30_security-misc.conf). The configurations will also give you a basic setup with Firewalld, Fail2ban, seboolean, and NTS to tighten down security.
+On Fedora CoreOS, I have also included systemd services to:
+- Install and update gVisor at boot
+- Update containers in a Docker Compose stack once a week.
 
-I use these same configurations on my production servers.
+## Arch Setup Script
+![Arch Linux](/images/archlinux.jpg)
+
+The [Arch Setup Script](https://github.com/TommyTran732/Arch-Setup-Script) is a script that I wrote to automate my Arch Linux installation which mimics openSUSE's setup with BTRFS and Snapper. At the time, there was no other installer that does this nicely because they all use the same flat layout as recommended in the Arch Wiki. The downside of using this layout is that snapper rollback does not work properly and the user has to get into the Arch ISO to manually rollback their system. This could be solved by using the openSUSE's layout for BTRFS, and I forked Easy Arch to do just that.
+
+Over time, I have been adding more security/privacy related settings. Most of them are ported from the Linux Setup Scripts repo.
+
+## Microsoft Egde Policies
+
+![Microsoft Edge](/images/microsoft-edge.png)
+
+These are Microsoft Edge enterprise for the most secure web browsing experience. 
+
+You can read through them [here](https://github.com/TommyTran732/Microsoft-Edge-Policies).

static/.well-known/security.txt

@@ -2,15 +2,15 @@
 Hash: SHA256
 
 Contact: https://matrix.to/#/@tommy:arcticfoxes.net
-Contact: https://simplex.chat/contact#/?v=1-4&smp=smp%3A%2F%2FN_McQS3F9TGoh4ER0QstUf55kGnNSd-wXfNPZ7HukcM%3D%40smp19.simplex.im%2F03zrijd3pM0hi2AG6XLiMMpxEsjEqj_5%23%2F%3Fv%3D1-2%26dh%3DMCowBQYDK2VuAyEAx3xSpEh_hRUiGatqlRxGajqIcg6H6xc9jf-2UfeJGA4%253D%26srv%3Di53bbtoqhlc365k6kxzwdp5w3cdt433s7bwh3y32rcbml2vztiyyz5id.onion
 Contact: mailto:contact@tommytran.io
-Expires: 2024-11-05T00:00:00.000Z
+Expires: 2028-01-01T00:00:00.000Z
+Encryption: https://tommytran.io/tommy.asc
 Preferred-Languages: en-US, vi-VN
-Canonical: https://tommytran.io/security.txt
+Canonical: https://tommytran.io/.well-known/security.txt
 -----BEGIN PGP SIGNATURE-----
 
-iHUEARYIAB0WIQT2xV5SweW8phRp+2fTDewmjT/rFwUCZUdsbQAKCRDTDewmjT/r
-F/p+AQCX8BhWbTttVGZ8J7AAda7VBQEX06dowEHKCInIy65k9gEA8Q7zpP0gOb7h
-JT39PRZj+cHFX7u9aYTABEmk1EwNogA=
-=nxMV
+iHUEARYIAB0WIQR7t0D0xuMPQ9QHbwNVXJAqNOyWjwUCZ0W8GAAKCRBVXJAqNOyW
+j5OuAP9KIR8b6U8o0/4brFKsr+PPJeIdbWuisrvh0uaEMB+OpQD/do5IxxZtGEEC
+9wc7VsMFgjhjYX0xDSAfnHaYsw8Cuw4=
+=5kZo
 -----END PGP SIGNATURE-----

static/_headers

@@ -1,11 +1,11 @@
 /*
   Strict-Transport-Security : max-age=63072000; includeSubDomains; preload
-  Content-Security-Policy : default-src 'none'; connect-src 'self'; img-src 'self'; script-src 'self'; style-src 'self'; form-action 'none'; frame-ancestors 'none'; upgrade-insecure-requests; block-all-mixed-content; base-uri 'none'
+  Content-Security-Policy : default-src 'none'; connect-src 'self'; img-src 'self'; script-src 'self'; style-src 'self'; base-uri 'none'; block-all-mixed-content; form-action 'none'; frame-ancestors 'none'; upgrade-insecure-requests
   X-Content-Type-Options : nosniff
   Referrer-Policy : no-referrer
   X-Frame-Options : DENY
   X-XSS-Protection : 0
-  Permissions-Policy : accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), browsing-topics=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), sync-xhr=(), xr-spatial-tracking=()
+  Permissions-Policy : accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), bluetooth=(), browsing-topics=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), speaker-selection=(), usb=(), sync-xhr=(), xr-spatial-tracking=()
   Cross-Origin-Resource-Policy : same-origin
   Cross-Origin-Embedder-Policy : require-corp
   # Cross-Origin-Opener-Policy : same-origin

static/tommy.asc

@@ -1,17 +1,17 @@
 -----BEGIN PGP PUBLIC KEY BLOCK-----
 
-mDMEZUdTmhYJKwYBBAHaRw8BAQdAhXJo1MA3p2d9ei2CS3jrGXSodpJ6srUyRtRW
-m1vBhrS0IVRoaWVuIFRyYW4gPGNvbnRhY3RAdG9tbXl0cmFuLmlvPoiWBBMWCAA+
-FiEE9sVeUsHlvKYUaftn0w3sJo0/6xcFAmVHU5oCGwMFCQHhM4AFCwkIBwIGFQoJ
-CAsCBBYCAwECHgECF4AACgkQ0w3sJo0/6xevWAD7BXv7f/OyLJ+tTkENbxZX2TIF
-TaN2UaGtR4bTuTyD6yUBALlEmA6rvjyFd9ntzFeDo6y9tbXS8OHSxLF4TUQdI5AM
-uDgEZUdTmhIKKwYBBAGXVQEFAQEHQLz2RFSlF5ZHWqqMkk5PSquvhWqWFKHApVxQ
-IB8+rrEuAwEIB4h+BBgWCAAmFiEE9sVeUsHlvKYUaftn0w3sJo0/6xcFAmVHU5oC
-GwwFCQHhM4AACgkQ0w3sJo0/6xedZQD8CmMzBWgtsthI/uAxBt3tEj/ntKavJlek
-cTXhGIjp6KMA/3IcpK5QMB4uFKQEa+tK0Yi1Yf7KvqsgRkHRCVlkJ1UMuDMEZUdT
-6RYJKwYBBAHaRw8BAQdAqXDEKTuNK66FccXmi07n/QhHXA8JzrkNrOkKu3MS0wOI
-fgQYFggAJhYhBPbFXlLB5bymFGn7Z9MN7CaNP+sXBQJlR1PpAhsgBQkB4TOAAAoJ
-ENMN7CaNP+sXKNQA/2HM+tJuK1ND6sEYH3efBPvvwzNZMEpNf9m227vALzliAQDk
-wXjHV3t6muFwV4xIMnSt1rrSa3phD8Te2YNVmjuRBA==
-=lSVd
+mDMEZYip3xYJKwYBBAHaRw8BAQdAg8efRKSxYv02Xhl7VLCb71duExzKT/U437P8
+bpwhvhG0IVRoaWVuIFRyYW4gPGNvbnRhY3RAdG9tbXl0cmFuLmlvPoiWBBMWCAA+
+FiEEe7dA9MbjD0PUB28DVVyQKjTslo8FAmWIqd8CGwMFCQWjmoAFCwkIBwIGFQoJ
+CAsCBBYCAwECHgECF4AACgkQVVyQKjTslo//6AEAvt58ku/TwB6zIOfvQYa0cYoj
+gTdFAou/w3l1yiK6v5YA/09cBI0bWka4HJPuWtACM8WoCzyX9HMQCJhrWz4mNZgD
+uDgEZYip3xIKKwYBBAGXVQEFAQEHQHZ640EjKVi0SEjM6K+3EgUnoOpcTquxhw9H
+G7heqfEJAwEIB4h+BBgWCAAmFiEEe7dA9MbjD0PUB28DVVyQKjTslo8FAmWIqd8C
+GwwFCQWjmoAACgkQVVyQKjTslo8lVwEAtLwM2qecldECFY1Efk6xrcsJr/pF93vb
+eBRI1nCA8ywA/0GCG58Qn26aAqsiBv39F8LQ2RojMiydAppWJwnmYBoJuDMEZYiq
+aBYJKwYBBAHaRw8BAQdAdSiTCWSCHOVJyT3whkXm+3enb6jorU36HWykQGcETVOI
+fgQYFggAJhYhBHu3QPTG4w9D1AdvA1VckCo07JaPBQJliKpoAhsgBQkFo5qAAAoJ
+EFVckCo07JaPH2AA/RUAT4KmKXDhru00NOrjvD6G65PSzhkcSGuZDK17xjLTAP9h
+gvsQ6ieu4OfN2DVCJMC9na5RtxyRB71vsMzBYyTQCQ==
+=XImG
 -----END PGP PUBLIC KEY BLOCK-----