kryssar.se
Menu

Vision: kryssar.se Public Sync Workflow

Overview

This design proposes an automated pipeline to synchronize the Homelab Experience Chronicle with the public-facing kryssar.se website. The goal is to transform the internal lab documentation into a public security research portfolio, hosted on the Loopia webhotel via SSH.

To ensure safety and resource efficiency, the workflow will include a dedicated "Scrubbing" layer and will be managed by n8n on a controlled cadence.

Core Objectives

  1. Portfolio Integration: Merge the internal SAGA battle chronicle with the main kryssar.se personal site.
  2. Automated Scrubbing: Utilize local LLMs (dolphin3-cyber-8b) to automatically redact internal IPs, cleartext credentials, and personal identifiers before publication.
  3. Managed Cadence: Use n8n to trigger updates on a slow cadence (e.g., weekly or manual "Release" button) to prevent excessive deployments to the Loopia webhotel.
  4. SSH Deployment: Leverage Loopia's SSH access for secure, operator-approved file transfers of the Astro-built public_html/ artifact.

Workflow Architecture (n8n)

1. Ingestion & Filtering

  • Source: The internal Hugo experience-site source.
  • Filter: Select only content tagged with #public-research or sessions explicitly marked for portfolio inclusion.

2. The Scrubbing Layer (AI-Driven)

  • The workflow loops through selected Markdown files and sends them to the LM Studio Redaction Proxy.
  • System Prompt: "You are a public relations and security filter. Sanitize this report for a public portfolio. Replace all 10.10.x.x and 192.168.x.x IPs with generic descriptions (e.g., [Target-DC], [Perimeter-Linux]). Remove any username/password artifacts. Maintain technical depth while ensuring operational security."
  • Delta Gate: Before invoking LM Studio, run a scripted manifest check that records each source file path, source SHA-256, redaction policy version, sanitized output SHA-256, approval status, approval timestamp, and reviewer. Files whose source hash and policy version match an approved manifest entry should be copied from the cached sanitized output instead of reprocessed. Files with changed content, missing approvals, changed policy version, or changed sanitizer code must be re-censored and sent back through manual review before upload.

3. Build Phase

  • The workflow triggers the Astro validation gate for the public site:
    cd public-information/kryssar.se && npm run validate
  • This build renders public_html/, regenerates public-safe git-history data, redacts generated output, validates required routes, and runs public leak/link checks.

4. Deployment (Loopia SSH)

  • Uses the guarded shell wrapper to preview the exact transfer before any live action:
    cd public_sync_workflow
LOOPIA_SSH_USER=<user> ./run_public_sync.sh --dry-run-loopia
  • Live publish requires a separate operator approval variable after reviewing the dry-run:
    LOOPIA_SSH_USER=<user> PUBLIC_SYNC_APPROVE_LOOPIA=1 ./run_public_sync.sh --publish-loopia

Security & Operational Gaps

  • Passphrase Gate: Loopia SSH keys must be managed via an n8n SSH credential (decrypted at runtime) or a headless service key to avoid interactive passphrase prompts.
  • Manual Review Node: The n8n workflow should include an Approval Gate where the operator can view a diff of the scrubbed content before it hits the live internet.
  • Approval Cache Integrity: The redaction manifest must be treated as a safety boundary. Any change to redaction prompts, deterministic regex rules, sanitizer script version, or public-content allowlist should invalidate affected entries and force review rather than trusting stale approvals.

Backlog Tasks

  1. [ ] Repo Merge: Merge the current Hugo site source with the kryssar.se legacy content.
  2. [ ] Scrubbing Script: Implement the redact-for-public.py helper using the Dolphin3 model.
  3. [ ] Redaction Delta Cache: Implement a manifest-backed hash gate so previously approved unchanged files skip LM Studio redaction and reuse cached sanitized output.
  4. [x] Deployment Workflow: Update the shell workflow with Astro validation, Loopia dry-run, and PUBLIC_SYNC_APPROVE_LOOPIA=1 publish gating.
  5. [x] Config Pruning: Retire the old public-build assumption; Astro is the public compiler and the abandoned prototype path remains guarded.

Created by Gemini CLI — 2026-05-22