Colophon · Anthony Zita

built with

site: Astro 7, rendered to static HTML at build time. No framework runs in your browser.
scripts: TypeScript: the terminal, the keys, the finder, the transitions. Each one small, all of it optional.
type: JetBrains Mono, served from this site.
code: Prism, from a Markdown plugin that draws the code panes.
previews: Link preview cards drawn at build time with Satori and resvg.
tests: Playwright in a real browser, and a build step that checks every page against the security rules.
hosting: A Dell OptiPlex Micro at home in Las Vegas, running Ubuntu Server and Caddy. You reach it through a Cloudflare Tunnel, so no ports are open to the internet.
build: Commit 3db6707 on main, built Oct 28, 2026. The footer says how long ago.

security

Every page is served with the headers below. The checks under them ran in your browser when this page loaded: it asked the server for the page again and read what came back.

curl -sI anthonyzita.com/colophon/configured

content-security-policy: frame-ancestors 'none'; base-uri 'none'; form-action 'none'; object-src 'none'; require-trusted-types-for 'script'; trusted-types 'none'
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-frame-options: DENY
referrer-policy: same-origin
permissions-policy: accelerometer=(), autoplay=(), bluetooth=(), browsing-topics=(), camera=(), display-capture=(), encrypted-media=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), xr-spatial-tracking=()
cross-origin-opener-policy: same-origin
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: same-origin

# checked live when the page loads

content-security-policy
Nothing loads or runs unless it's on the list, and the list starts empty: default-src 'none'. Scripts and styles are this site's own files, plus two short inline ones allowed by their exact hash.
trusted types
The browser refuses to turn text into HTML, which closes off the usual way cross-site scripting gets in. The site never does that, and this makes sure it never can.
frame-ancestors
No other site can show this one in a frame, so it can't be dressed up as part of something else (clickjacking).
strict-transport-security
Browsers only ever connect over HTTPS, for every subdomain, and the domain is eligible for the browsers' built-in HTTPS-only list.
cross-origin isolation
The page runs in its own process, apart from other sites' windows and resources (COOP + COEP), which shuts out Spectre-style side channels.
x-content-type-options
Browsers take each file for what the server says it is, and don't guess a script out of something else.
referrer-policy
Following a link from here to another site tells it nothing about the page you came from.
permissions-policy
Camera, microphone, location, USB and the rest are switched off outright. Nothing here would ever ask.
cross-origin-resource-policy
Other sites can't load this site's files into their own pages.
third-party requests
Fonts, scripts and images all come from this site. No analytics, no CDN, no embeds: visiting sends nothing anywhere else.
cookies
None. The few preferences the site remembers stay in your browser (see privacy, below).

The same checks run from the terminal at the bottom of any page: type headers. Found a problem?security.txt says how to report it.

privacy

No cookies, no analytics, no ads, and nothing loaded from another site — the checks above show the last two. The server keeps no access logs; Cloudflare, in front of it, sees requests pass through, as any CDN does. The site remembers a few choices, in your browser only, and never sends them anywhere:

theme: the theme you picked
shell: bash or PowerShell
crt: the old-monitor effect
keys: keyboard shortcuts, if you turned them off
os: that you've seen the boot screen
lastVisit: when you last came by, for the "last login" line on the home page
booted: that the intro played this visit (this one and the next two are gone when you close the tab)
visit: that this visit has started
lastLogin: your previous visit, held still while this one goes on

accessibility

Everything works from the keyboard. The single-key shortcuts can be turned off: keys off.
If your system asks for reduced motion, nothing moves: no boot, no typing, no redraws.
The terminal decoration — the sticky command, the exit statuses, the preview pane — is hidden from screen readers, where it would only be noise. The content is plain HTML.
In light mode, the site starts in the light theme, paper, until you pick one.

design

A terminal, but a modern one: the ideas come from the tools people work in today, not from old green screens.

tmux: the status line: windows, theme, shell, clock
starship: the prompt: exit status and how long the page took
fzf: the finder (/ or ctrl k) and the preview pane
fish: the grey suggestions in the prompt
Warp: the command that sticks under the status line
less: how far through a page you are
bat: code panes, with the file name in the border
imgcat: figures that draw in as you scroll
tree: the outline next to long pages
man: the resume

in your terminal

The site works in a real terminal too:

curl anthonyzita.com/card

      ▄▄▄       Anthony Zita    █████      Principal Technologist   ██▀ ▀██     Cloud, Infrastructure, Identity, and Security  ██▄▄▄▄▄██    Las Vegas, Nevada  ██▀▀▀▀▀██  ██     ██    Entra ID · Azure · AD · PKI · IGA · Intune · IaC · Rancher  ▀▀     ▀▀    In IT since 2014   ~ $ ls https://anthonyzita.com/  writing/      long-form notes from the work  projects/     things I build on my own time  milestones/   the career record  uses/         the gear and tools I rely on  resume/       the short version, as a man page   linkedin      https://www.linkedin.com/in/anthonyzita/