The line between public and private
Every tool on this site exists twice. The public edition explains what it does through walkthroughs, diagrams and measured results. The embedded edition, the one in daily use, sits behind an owner sign in.
That line is enforced, not just promised:
- Private content never enters the repository. It lives in a database and object storage at the edge, and is edited from the private console.
- The build checks itself. After every build, a guard script fails the build if a private route was rendered into public files, if a secrets file could be served, if a public page links to a source repository, or if any text from the private seed folder appears in a public asset.
- The content schema refuses repository links, so a source link cannot be added to a public page by accident.
Sign in
There is one account, the owner’s. Sign in is by passkey first (Windows Hello, Touch ID or a phone), with a password and an authenticator app code as the fallback. Sign up is switched off: the owner account was created once, through a route that only works while there are no users and a one time token matches. Sessions can be listed and revoked, and every sign in attempt is logged.
The stack
- Astro, rendering public pages to static HTML at build time and private pages on demand.
- Cloudflare Workers serving both from the edge, with D1 for data, R2 for private files and KV for caching.
- Preact for the few interactive pieces, such as the command palette (press Ctrl K or ⌘K). Everything else ships no JavaScript.
- Turnstile in front of every form, instead of a puzzle.
Standards it is held to
- Tests run inside the same runtime as production, and end to end tests run against the production build on desktop and mobile.
- Strict security headers, including a content security policy, on every response.
- No tracking cookies and no third party fonts. Analytics, where used, are cookieless.
- Chart colours are checked for colour blindness and contrast before they ship.
- Every number on the site is real and sourced from the project it describes.
The mark
The logo is the founder’s own design: the name set in IBM Plex Sans with two letters picked out in aqua, above a fine rule with a small knot at its centre, and the strapline Automate detours. Mag Uidhir takes its name from the founder’s surname.
Type throughout is IBM Plex Sans, with IBM Plex Mono for small labels, both served from this site.