docs: Master Career Profile — single source of truth for career materials

Aggregates identity, positioning, summaries (3 lengths, EN/NO), skills taxonomy, experience,
projects (incl. verified homelab detail), achievements bank, ready-made LinkedIn/bio/cover-letter
snippets, and a voice/usage guide for generating CVs, cover letters, LinkedIn and bios.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.claude/launch.json

@@ -4,8 +4,9 @@
     {
       "name": "site",
       "runtimeExecutable": "pnpm",
-      "runtimeArgs": ["-C", "site", "dev", "--host", "--port", "4321"],
-      "port": 4321
+      "runtimeArgs": ["-C", "site", "dev", "--host"],
+      "port": 4321,
+      "autoPort": true
     }
   ]
 }

.gitignore

@@ -26,6 +26,7 @@ relay/appsettings.*.local.json
 Thumbs.db
 .vscode/
 .idea/
+.claude/settings.local.json
 
 # Mission prompt scratch files (kept locally, not part of the product)
 step1.txt

PROJECT_STATUS.md

@@ -59,19 +59,27 @@
 6. **Theme-init is an external script** (`/theme-init.js`) so the CSP can use `script-src
    'self'` with no inline hash.
 
-## Pre-launch checklist (carried from Phase 1/2 — owner action)
+## Pre-launch checklist (owner action)
 
-- [ ] **Replace the `/Linkedin` redirect target** in `site/nginx.conf` with the real LinkedIn
-      profile URL before cutover (currently a placeholder slug).
-- [ ] Screenshot capture pass on **seeded demo data** for JobTrack + InboxIntel; drop real
-      captures into the `placeholder:` media refs (`src/data/projects/*`).
-- [ ] Drop the real **outdoor headshot** into the portrait ref (replaces `placeholder:portrait`).
-- [ ] **ATS-safe CV rework** (EN/NO) — replace the PDFs at `site/public/cv/` (same URLs).
-- [ ] **Native-Norwegian review** of all NO content (launch gate).
+- [x] ~~`/Linkedin` redirect target~~ — set to `https://www.linkedin.com/in/connor-babbington`.
+- [x] ~~JobTrack seed-data screenshots~~ — real captures integrated (`/assets/projects/jobtrack/`).
+- [x] ~~Real headshot~~ — integrated (`/assets/portrait.webp`, hero + about).
+- [x] ~~ATS-safe CV rework (EN/NO)~~ — done; generator in `tools/cv/`.
+- [ ] **InboxIntel screenshots** — still placeholders (no captures provided; it is "in development").
+- [ ] **Native-Norwegian review** of all NO content, incl. the NO CV (launch gate).
 - [ ] **Legacy WordPress URL inventory** → confirm the 301/410 map in `nginx.conf`.
 - [ ] Configure CI secrets (`REGISTRY_USER`, `REGISTRY_TOKEN`) + the relay `.env` on the server.
+- [ ] Confirm the Traefik entrypoint / cert-resolver names in `deploy/.env.example` match the host.
 
-## Open questions / blocked-on-user
+## Infrastructure (verified live, July 2026)
 
-- Are the JobTrack / InboxIntel repos public? If so, add `repo` links in `src/data/projects/*`
-  (currently omitted to avoid dead links).
+Deploy target is the `mediaserver` host (Ubuntu 24.04): ~30 Docker services behind **Traefik**
+(Cloudflare-fronted, TLS, HTTP/3), with **Authentik** SSO, **CrowdSec**, **Pi-hole**, and
+self-hosted **Gitea + Actions runner** (the CI/CD target for this site). The homelab case study
+and `deploy/` now reflect this (Traefik labels, `traefik_proxy` network). WordPress still runs
+but is being decommissioned as this site replaces it — not documented as future architecture.
+
+## Resolved
+
+- JobTrack / InboxIntel repos are **private** → repo links intentionally omitted; case studies
+  describe the architecture without linking code.

deploy/.env.example

@@ -14,5 +14,7 @@ RELAY_WINDOW_SECONDS=600
 # --- Site build ---
 PUBLIC_SITE_URL=https://cesnimda.co.uk
 
-# --- Infra ---
-PROXY_NETWORK=web        # name of the existing external reverse-proxy docker network
+# --- Infra (Traefik host reverse proxy) ---
+PROXY_NETWORK=traefik_proxy       # existing external Traefik docker network
+SITE_HOST=cesnimda.co.uk          # Host rule for the Traefik routers
+TRAEFIK_ENTRYPOINT=websecure-external  # Traefik entrypoint name on the host

deploy/docker-compose.yml

@@ -1,6 +1,8 @@
-# Production stack (DOCKER_SPEC §2). Publishes no host ports — the existing host
-# reverse proxy routes cesnimda.co.uk -> site:8080 and /api/contact -> relay:8081
-# over the shared external proxy network.
+# Production stack (DOCKER_SPEC §2). Publishes no host ports — Traefik (the host's
+# existing reverse proxy) discovers these containers on the shared traefik_proxy
+# network via the labels below and routes cesnimda.co.uk to the site, and
+# cesnimda.co.uk/api/contact to the relay. Entrypoint / cert-resolver names match
+# the host Traefik convention; override via the .env values if they differ.
 
 services:
   site:
@@ -14,7 +16,14 @@ services:
       - /tmp
       - /var/cache/nginx
       - /var/run
-    networks: [web]
+    networks: [proxy]
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=${PROXY_NETWORK:-traefik_proxy}
+      - traefik.http.routers.resumesite.rule=Host(`${SITE_HOST:-cesnimda.co.uk}`)
+      - traefik.http.routers.resumesite.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure-external}
+      - traefik.http.routers.resumesite.tls=true
+      - traefik.http.services.resumesite.loadbalancer.server.port=8080
     logging:
       driver: json-file
       options: { max-size: '10m', max-file: '3' }
@@ -36,12 +45,20 @@ services:
       - Relay__AllowedOrigin=${RELAY_ALLOWED_ORIGIN:-https://cesnimda.co.uk}
       - Relay__RateLimitPerWindow=${RELAY_RATE_LIMIT:-5}
       - Relay__WindowSeconds=${RELAY_WINDOW_SECONDS:-600}
-    networks: [web]
+    networks: [proxy]
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=${PROXY_NETWORK:-traefik_proxy}
+      # More specific rule than the site router, so /api/contact wins.
+      - traefik.http.routers.resumerelay.rule=Host(`${SITE_HOST:-cesnimda.co.uk}`) && PathPrefix(`/api/contact`)
+      - traefik.http.routers.resumerelay.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure-external}
+      - traefik.http.routers.resumerelay.tls=true
+      - traefik.http.services.resumerelay.loadbalancer.server.port=8081
     logging:
       driver: json-file
       options: { max-size: '10m', max-file: '3' }
 
 networks:
-  web:
+  proxy:
     external: true
-    name: ${PROXY_NETWORK:-web}
+    name: ${PROXY_NETWORK:-traefik_proxy}

docs/MASTER_CAREER_PROFILE.md

@@ -0,0 +1,277 @@
+# Master Career Profile — Connor Babbington
+
+**Single source of truth** for generating CVs, cover letters, LinkedIn content, bios and
+other career materials. Everything here is factual and verified against the CV, the
+portfolio site content, the project repositories, and a live inspection of the
+infrastructure (July 2026). When generating any artifact, pull from this document and
+follow the **Voice & usage guide** at the end.
+
+Related sources: [`design/02-ux/CANONICAL_CONTENT.md`](design/02-ux/CANONICAL_CONTENT.md)
+(original CV facts) · site content in `site/src/data/` · CV generator in `tools/cv/`.
+
+---
+
+## 1. Identity & contact
+
+| Field | Value |
+|---|---|
+| Name | Connor Babbington |
+| Title (self-label) | **Systems Developer** (NO: *Systemutvikler*) |
+| Location | Tønsberg, Norway |
+| Work eligibility | Valid Norwegian residence permit |
+| E-mail | connor.babbington@cesnimda.co.uk |
+| Phone | +47 41 33 44 70 |
+| Website | https://cesnimda.co.uk |
+| LinkedIn | https://www.linkedin.com/in/connor-babbington |
+| Git (self-hosted) | https://git.cesnimda.uk/cesnimda |
+| Languages | English (native) · Norwegian (B1, actively developing) |
+| Availability | Open to remote, hybrid or on-site developer roles |
+
+## 2. Positioning
+
+**Core positioning:** a systems developer with **eight years' experience** building and
+maintaining production software for UK local government, now building and self-hosting
+full-stack products in Norway. Backend-leaning full-stack, with genuine DevOps and
+operations depth.
+
+- **Never** self-label "senior" or "mid-level". Lead with "eight years' experience" and
+  let the evidence (production systems, security decisions, operations) carry seniority.
+- Emphasis differs by audience: for Norwegian public/SME employers, foreground the
+  **public-sector systems background** and **operations/security**; for product companies,
+  foreground **full-stack delivery** and the **case studies**.
+
+**Headline options (LinkedIn / CV subtitle):**
+- `Systems Developer · .NET, full-stack & infrastructure · Tønsberg, Norway`
+- `Systems Developer — 8 years building & running production software`
+- `Backend-leaning full-stack developer (.NET, React, Docker) · self-hosting enthusiast`
+- NO: `Systemutvikler · .NET, fullstack og infrastruktur · Tønsberg`
+
+## 3. Professional summary (three lengths)
+
+**One line:**
+> Systems developer with eight years' experience building, shipping and running
+> production software.
+
+**Short (2–3 sentences):**
+> Systems developer with eight years' experience delivering internal software for UK local
+> government. Backend-leaning full-stack across C#, .NET, Python, JavaScript/TypeScript and
+> SQL, with hands-on DevOps in Docker, Linux and CI/CD. Now building and self-hosting
+> full-stack products in Norway.
+
+**Paragraph:**
+> Systems developer with eight years' experience building and maintaining production
+> software for UK local government. A backend-leaning full-stack developer across C#, .NET,
+> Python, JavaScript/TypeScript and SQL, with hands-on DevOps in Docker, Linux, CI/CD, Azure
+> DevOps and GitHub. I turn stakeholder requirements into reliable, well-tested systems and
+> support them in production — and I care about the parts users never see: tests,
+> deployments and keeping things running. Alongside professional work I design, build and
+> self-host my own products and a ~30-service home infrastructure lab, which keeps my skills
+> current and hands-on. Based in Tønsberg with a valid residence permit; native English
+> speaker with Norwegian at B1 and actively developing.
+
+**Norwegian (paragraph):**
+> Systemutvikler med åtte års erfaring med å bygge og vedlikeholde produksjonssystemer i
+> britisk offentlig sektor. Fullstack-utvikler med tyngde på backend i C#, .NET, Python,
+> JavaScript/TypeScript og SQL, med praktisk DevOps i Docker, Linux, CI/CD, Azure DevOps og
+> GitHub. Jeg omsetter behov fra brukere og interessenter til pålitelige, godt testede
+> systemer og drifter dem i produksjon. Ved siden av jobb bygger og drifter jeg egne
+> produkter og en hjemmelab med rundt tretti tjenester. Bosatt i Tønsberg med gyldig
+> oppholdstillatelse; engelsk morsmål, norsk på B1-nivå og i aktiv utvikling.
+
+## 4. Skills taxonomy
+
+Grouped for CV/LinkedIn. Every item is defensible in an interview — don't pad.
+
+**Languages:** C#, Python, JavaScript, TypeScript, SQL, Ruby (Ruby on Rails, from the
+council role). *(HTML/CSS assumed.)*
+
+**Frameworks & platforms:** .NET / ASP.NET Core, React, FastAPI, Ruby on Rails, Astro,
+Entity Framework Core, Node.js.
+
+**Data:** SQL databases, PostgreSQL, SQLite, MariaDB, Redis, EF Core.
+
+**DevOps & infrastructure:** Docker & Docker Compose, Linux (Ubuntu), CI/CD, Azure DevOps,
+GitHub, Gitea + Actions runners, Traefik, nginx, reverse proxies, Cloudflare, self-hosting,
+container orchestration.
+
+**Security & identity:** OAuth2 integrations, encrypted secrets at rest (Data Protection
+API), Authentik (SSO / forward-auth), CrowdSec (intrusion prevention), Pi-hole (DNS),
+security hardening, preview-then-confirm destructive operations.
+
+**AI / integrations:** local LLMs via Ollama, AI-assisted summarisation, Gmail API (OAuth2).
+
+**Architecture & practices:** Clean Architecture, full-stack design, REST APIs, background
+workers, testing (unit + integration), production support & troubleshooting, stakeholder
+communication, cross-functional collaboration, WCAG accessibility, SEO.
+
+**Tools:** Git, Portainer, Serilog, Polly, QuestPDF, Chart.js, Playwright, Vitest.
+
+## 5. Experience
+
+### System Developer — Warwickshire County Council, UK · 2015–2023
+*(First two years completed as an apprenticeship; progressed to full developer.)*
+- Worked on the **county-wide highways and streetlight fault-reporting system** used across
+  Warwickshire.
+- Designed, built and maintained **full-stack applications** in C#, Python, Ruby on Rails,
+  SQL and JavaScript across several projects.
+- Delivered reliable, well-tested software; resolved stability and performance issues on
+  live systems.
+- Owned **deployments and production troubleshooting**; strengthened permissions and
+  reliability.
+- Produced clean, maintainable, documented code; **guided colleagues** on best practices for
+  code and process.
+- Context for framing: UK **local government / public sector** — maps directly to Norwegian
+  *kommune/fylkeskommune* systems work.
+
+### Independent Development & Norwegian Study — Tønsberg, Norway · 2023–Present
+- Building and self-hosting full-stack products (JobTrack, InboxIntel) and operating a
+  ~30-service home infrastructure lab.
+- Developing Norwegian language skills (norskkurs) toward professional fluency.
+
+### Earlier roles (part-time, alongside the above; customer-facing)
+- Sales Representative — Royal Vapes, UK · 2017–2021
+- Bartender — The Hodcarrier, UK · 2016–2018
+- Receptionist — Nuffield Health, UK · 2014–2015
+
+*Framing:* held alongside the council role; evidence of communication skills and work ethic.
+De-emphasise on technical CVs; a single line usually suffices.
+
+## 6. Projects (portfolio)
+
+### JobTrack — full-stack job-application tracker · *Active*
+- **What:** a workspace for the whole job-application journey — pipeline, correspondence,
+  attachments, AI summaries, reminders and analytics.
+- **Stack:** React + TypeScript SPA · ASP.NET Core (.NET 9) API · SQLite (EF Core) · FastAPI +
+  Ollama local AI service · Docker Compose · installable PWA with a mobile share-target.
+- **Key decisions:** local AI (Ollama) over a cloud API for privacy and zero per-call cost;
+  **no offline PWA cache by design** (frequent deploys → stale builds are worse than offline
+  gaps); SQLite over Postgres for a single-user app.
+- **Security/production:** optional Google sign-in (ID tokens), per-owner record scoping,
+  validated file uploads with ownership checks, advisory-only AI, scheduled JSON/CSV exports.
+- **Talking points:** product thinking end-to-end; a deliberate anti-feature with reasoning;
+  integration depth (Gmail OAuth2).
+
+### InboxIntel — Gmail analytics & safe bulk cleanup · *In development*
+- **What:** Gmail analytics, cleanup and unsubscribe management with a draggable dashboard.
+- **Stack:** .NET 8 · Clean Architecture (Domain → Application → Infrastructure → Api) ·
+  PostgreSQL (EF Core + Npgsql) · React 18 + Vite + Chart.js · hosted background sync worker ·
+  Serilog · FluentValidation · Polly · Gmail API.
+- **Key decisions:** four-project Clean Architecture with an enforced dependency rule;
+  **OAuth refresh tokens encrypted at rest** (ASP.NET Data Protection API / AES, never
+  logged); **every destructive action is preview-then-confirm**; advisory-only AI.
+- **Security/production:** Gmail read/modify scopes only (no send); Polly retry/backoff;
+  unit tests (query parser, unsubscribe extraction) + integration tests asserting authz.
+- **Talking points:** architecture discipline; safe-by-design destructive operations.
+
+### Self-hosted infrastructure lab · *Active*
+- **What:** an Ubuntu 24.04 server running **~30 Docker services** behind a single reverse
+  proxy — the deploy target for the portfolio site itself.
+- **Platform:** **Traefik** (TLS, HTTP/3, Cloudflare-fronted, separate internal/external
+  entrypoints) · **Authentik** SSO as forward-auth in front of internal tools · **CrowdSec**
+  intrusion prevention · **Pi-hole** DNS filtering.
+- **CI/CD & data:** self-hosted **Gitea + Actions runner** (git.cesnimda.uk) building and
+  deploying this site; PostgreSQL, MariaDB, Redis; Portainer + Dozzle for management/logs.
+- **Security posture:** Docker socket exposed only via a hardened socket-proxy; each app on
+  its own isolated Docker network.
+- **Also runs:** application containers (JobTrack) and a media stack (Jellyfin + *arr).
+- **Talking points:** real operations and security experience, not just deployment; network
+  segmentation; SSO/IPS/DNS in a home setting; runs its own CI/CD.
+
+### The portfolio site itself (cesnimda.co.uk)
+- Astro 5 static, bilingual (EN/NO), Tailwind 4 over design tokens, CSS-first motion, a
+  slug-map i18n contract, a small .NET 9 contact relay, WCAG AA accessibility, Lighthouse
+  budgets, and full CI — self-hosted in Docker behind Traefik. A work sample in its own right.
+
+## 7. Education
+
+- **Extended Diploma — NVQ Level 3 in ICT**, Warwickshire College, UK · 2012–2015.
+  Professional education in IT: programming, systems administration and IT support.
+
+## 8. Achievement / evidence library (bullet bank)
+
+Reusable, outcome-oriented bullets for CVs and cover letters:
+- Delivered and maintained internal software used across a UK county council for eight years.
+- Contributed to a **county-wide highways/streetlight fault-reporting system**.
+- Replaced spreadsheet-heavy and manual workflows with reliable internal systems.
+- Built full-stack applications in five languages (C#, Python, Ruby on Rails, SQL, JS),
+  adapting across frameworks as projects changed.
+- Owned deployments and production troubleshooting on live systems.
+- Designed and shipped two full-stack products end-to-end (product, backend, frontend, ops,
+  security).
+- Made and documented real engineering trade-offs (local vs cloud AI; deliberate anti-feature;
+  Clean Architecture; encrypted secrets at rest).
+- Operate a ~30-service self-hosted infrastructure with SSO, intrusion prevention and CI/CD.
+- Built an accessible (WCAG AA), performant, bilingual site with automated testing and CI.
+
+## 9. Working style & soft skills
+
+Problem solving · troubleshooting · system improvement · stakeholder communication ·
+production support · cross-functional collaboration · mentoring/guiding colleagues ·
+comfortable with both structured and open-ended tasks · effective independently and in a
+team · takes initiative · dependable and detail-oriented.
+
+## 10. Interests
+
+PC and board games (strategic thinking, problem solving), cooking, and continually learning
+new skills. Keep to one line on formal documents.
+
+## 11. Ready-made assets
+
+**Elevator pitch (spoken, ~20s):**
+> I'm a systems developer with eight years building and running production software for UK
+> local government — backend-leaning full-stack in .NET, plus real DevOps. I moved to Norway
+> and I've been shipping my own full-stack products and running a fairly serious home
+> infrastructure lab. I'm looking for a developer role where I can build things and help keep
+> them running.
+
+**LinkedIn headline:**
+> Systems Developer · .NET, full-stack & infrastructure · 8 years · Tønsberg, Norway
+
+**LinkedIn "About":**
+> Systems developer with eight years' experience building and maintaining production software
+> for UK local government. Backend-leaning full-stack across C#, .NET, Python, JavaScript/
+> TypeScript and SQL, with hands-on DevOps in Docker, Linux and CI/CD. I like turning real
+> requirements into reliable, well-tested systems — and I care about the parts users never
+> see: tests, deployments and keeping things running.
+>
+> Outside work I design, build and self-host my own products (a full-stack job-application
+> tracker and a Gmail analytics tool) and run a ~30-service home infrastructure lab with
+> Traefik, single sign-on, intrusion prevention and self-hosted CI/CD. Based in Tønsberg with
+> a valid residence permit; native English, Norwegian at B1 and improving. Open to remote,
+> hybrid or on-site developer roles.
+
+**Short bio (third person, ~40 words):**
+> Connor Babbington is a systems developer with eight years' experience building production
+> software for UK local government. Backend-leaning full-stack in .NET with real DevOps
+> depth, he now builds and self-hosts his own products from Tønsberg, Norway.
+
+**Cover-letter opener (template):**
+> I'm a systems developer with eight years' experience delivering and running production
+> software, and I'm writing about the [ROLE] position at [COMPANY]. [ONE SENTENCE connecting a
+> specific project/skill to their need.] I turn requirements into reliable, well-tested
+> systems and I'm comfortable owning them in production.
+
+## 12. Voice & usage guide
+
+**Tone:** plain-spoken, evidence-led, understated. Calibrated for the Norwegian market —
+avoid grandiosity (no "rockstar/ninja/guru", no "senior" unless a specific role warrants it).
+Let concrete facts carry weight.
+
+**When generating an artifact:**
+- **CV:** use §3 short summary + §4 skills + §5 experience + §6 projects (2 lines each) + §7
+  education. Keep to one page; ATS-safe single column; the generator in `tools/cv/` already
+  encodes this. Positioning = "eight years", never "mid-level".
+- **Cover letter:** open with §11 template; pick 2–3 bullets from §8 that match the job;
+  close on availability + permit + location fit.
+- **LinkedIn:** headline + About from §11; Experience from §5; Skills from §4.
+- **Bio:** pick the length from §11 (or §3).
+- **Norwegian materials:** use the native NO summary in §3; have a fluent speaker review
+  before sending (the NO here is solid but not yet native-reviewed).
+
+**Facts to never overstate:** don't claim "senior"; don't invent user numbers (say
+"county-wide"); InboxIntel is "in development"; project repos are **private** (describe, don't
+link); Norwegian is **B1**.
+
+**Maintenance:** update this document when facts change (new role, project, certification,
+language level), then regenerate downstream materials from it. Keep it the single source of
+truth — edit here first, propagate outward.

docs/spec/ARCHITECTURE.md

@@ -7,7 +7,7 @@ System architecture for the bilingual portfolio. Companion detail specs: ROUTING
 
 ```
                         ┌──────────────────────────── Connor's server ───────────────────────────┐
- Browser ── HTTPS ──►   │  nginx (existing reverse proxy, TLS)                                   │
+ Browser ── HTTPS ──►   │  Traefik (existing host reverse proxy, TLS; Cloudflare-fronted)        │
                         │    ├── cesnimda.co.uk/            → [site] nginx container (static)    │
                         │    ├── cesnimda.co.uk/api/contact → [contact-relay] .NET 9 container   │
                         │    └── git.cesnimda.uk            → Gitea (existing)                   │

docs/spec/DEPLOYMENT_SPEC.md

@@ -33,7 +33,7 @@ push / PR to main
 
 1. Pre-launch: staging fully verified (both locales, CV downloads, form → real mailbox, redirects incl. `/Linkedin`, 410 map, OG previews via LinkedIn/Slack debuggers, Search Console fetch).
 2. URL inventory + redirect/410 map finalised (SEO_SPEC §6).
-3. Cutover = repoint host nginx server-block from WP to the `site` container (single reload; WP left running dark for 2 weeks as instant rollback).
+3. Cutover = move the `cesnimda.co.uk` Traefik Host router from the WordPress container to the `site` container (a label change + `compose up -d`; WP left running dark for 2 weeks as instant rollback).
 4. Post-launch checklist: submit sitemaps, watch Search Console coverage + relay logs for form spam patterns, then decommission WP + its PHP/MySQL surface (attack-surface win worth noting on the colophon).
 
 ## 4. Operational guardrails

docs/spec/DOCKER_SPEC.md

@@ -31,7 +31,7 @@ deploy/
   .env.example                  # documented variables, no real values
 ```
 
-- Prod compose joins the server's existing reverse-proxy network; the host nginx (existing, TLS-terminating) routes `cesnimda.co.uk` → `site:8080` and `cesnimda.co.uk/api/contact` → `contact-relay:8081`. The stack publishes **no host ports** itself.
+- Prod compose joins the server's existing Traefik network (`traefik_proxy`); the host Traefik (existing, TLS-terminating, Cloudflare-fronted) discovers the containers via labels and routes `cesnimda.co.uk` → `site:8080` and `cesnimda.co.uk/api/contact` → `relay:8081` (the relay's `PathPrefix` rule outranks the site's `Host` rule). The stack publishes **no host ports** itself.
 - `restart: unless-stopped`, log rotation via compose logging options, images referenced by registry tag + digest.
 - Optional third service slot (`analytics`, self-hosted Umami/Plausible) reserved in the compose file as a commented profile — decision deferred.
 

site/.prettierignore

@@ -1,6 +1,7 @@
 dist/
 .astro/
 node_modules/
+.pnpm-store/
 pnpm-lock.yaml
 public/
 *.pdf

site/nginx.conf

@@ -27,9 +27,9 @@ server {
     gzip_proxied any;
     gzip_types text/plain text/css application/javascript application/json image/svg+xml application/xml application/xml+rss;
 
-    # --- Preserved LinkedIn redirect (printed on the CVs). Replace slug before cutover. ---
+    # --- Preserved LinkedIn redirect (printed on the CVs). ---
     location = /Linkedin {
-        return 301 https://www.linkedin.com/in/REPLACE-WITH-REAL-SLUG/;
+        return 301 https://www.linkedin.com/in/connor-babbington;
     }
 
     # --- Legacy WordPress URLs -> 410 Gone (crawler cleanup) ---

site/src/components/pages/ColophonPage.astro

@@ -34,7 +34,7 @@ const copy = {
       ],
       [
         'Self-hosted',
-        'Built and deployed from my own Gitea instance to Docker behind nginx. The contact form is a small stateless .NET service — even that is part of my own stack.',
+        'Built and deployed from my own Gitea instance to Docker behind Traefik. The contact form is a small stateless .NET service — even that is part of my own stack.',
       ],
       [
         'No tracking',
@@ -59,7 +59,7 @@ const copy = {
       ],
       [
         'Egendriftet',
-        'Bygget og rullet ut fra min egen Gitea-instans til Docker bak nginx. Kontaktskjemaet er en liten tilstandsløs .NET-tjeneste — også den er en del av min egen stack.',
+        'Bygget og rullet ut fra min egen Gitea-instans til Docker bak Traefik. Kontaktskjemaet er en liten tilstandsløs .NET-tjeneste — også den er en del av min egen stack.',
       ],
       [
         'Ingen sporing',

site/src/components/ui/SplitCvButton.astro

@@ -30,9 +30,9 @@ const currentLabel = locale === 'en' ? d.cv.english : d.cv.norsk;
     {d.cv.download}
     {!compact && <span class="text-mono-label ml-2 font-mono opacity-70">EN/NO</span>}
   </a>
-  <details class="cv-menu">
+  <details class="cv-menu flex">
     <summary
-      class="border-accent-ink/20 bg-accent text-accent-ink flex cursor-pointer list-none items-center rounded-r-sm border-l px-2 transition-[filter] duration-[--dur-quick] hover:brightness-105"
+      class="border-accent-ink/20 bg-accent text-accent-ink flex h-full cursor-pointer list-none items-center rounded-r-sm border-l px-2 transition-[filter] duration-[--dur-quick] hover:brightness-105"
       aria-label={d.cv.download}
     >
       <svg width="14" height="14" viewBox="0 0 24 24" fill="none" aria-hidden="true">

site/src/data/profile.ts

@@ -19,7 +19,7 @@ export const profile: Profile = {
     no: { path: '/cv/connor-babbington-cv-no.pdf', sizeKb: 8, updated: '2026-07' },
   },
   photo: {
-    src: 'placeholder:portrait',
+    src: '/assets/portrait.webp',
     alt: {
       en: 'Connor Babbington, smiling, outdoors',
       no: 'Connor Babbington, smilende, utendørs',

site/src/data/projects/homelab.ts

@@ -1,6 +1,10 @@
 import type { Project } from '@lib/schema';
 
-/* Homelab — capability page (lighter template): no TL;DR/decisions/gallery rendered. */
+/*
+  Homelab — capability page (lighter template): no TL;DR/decisions/gallery rendered.
+  Content reflects the real setup inspected on the host (Ubuntu 24.04, ~30 Docker
+  services behind Traefik with Authentik SSO, CrowdSec, Pi-hole, Gitea CI).
+*/
 export const homelab: Project = {
   id: 'homelab',
   name: 'Self-hosted infrastructure lab',
@@ -10,88 +14,100 @@ export const homelab: Project = {
   stack: [
     { name: 'Ubuntu' },
     { name: 'Docker' },
-    { name: 'nginx' },
-    { name: 'Gitea' },
-    { name: 'Monitoring' },
-    { name: 'Backups' },
+    { name: 'Traefik' },
+    { name: 'Authentik' },
+    { name: 'CrowdSec' },
+    { name: 'Gitea CI' },
   ],
   links: [],
   diagram: {
-    viewBox: '0 0 1120 300',
+    viewBox: '0 0 1120 310',
     title: { en: 'Homelab topology', no: 'Hjemmelab-topologi' },
     desc: {
-      en: 'Inbound traffic reaches an nginx reverse proxy terminating TLS, which routes to self-hosted services: Gitea, application containers and a monitoring stack.',
-      no: 'Innkommende trafikk når en nginx reverse proxy som terminerer TLS, og rutes videre til egendriftede tjenester: Gitea, applikasjonscontainere og en overvåkingsstack.',
+      en: 'Traffic arrives through Cloudflare to a Traefik reverse proxy that terminates TLS and applies Authentik single sign-on, then routes to self-hosted services: Gitea and its CI runner, application containers, and a media stack.',
+      no: 'Trafikk kommer via Cloudflare til en Traefik reverse proxy som terminerer TLS og bruker Authentik single sign-on, og rutes videre til egendriftede tjenester: Gitea med CI-runner, applikasjonscontainere og en mediastack.',
     },
     nodes: [
       {
-        id: 'internet',
+        id: 'cloudflare',
         x: 40,
-        y: 116,
-        w: 160,
-        h: 72,
+        y: 124,
+        w: 170,
+        h: 68,
         kind: 'external',
-        label: 'Internet',
-        sub: { en: 'HTTPS', no: 'HTTPS' },
+        label: 'Cloudflare',
+        sub: { en: 'DNS · edge · WAF', no: 'DNS · edge · WAF' },
       },
       {
-        id: 'proxy',
-        x: 280,
-        y: 116,
-        w: 190,
-        h: 72,
+        id: 'traefik',
+        x: 290,
+        y: 124,
+        w: 180,
+        h: 68,
         kind: 'primary',
-        label: 'nginx',
+        label: 'Traefik',
         sub: { en: 'reverse proxy · TLS', no: 'reverse proxy · TLS' },
       },
+      {
+        id: 'authentik',
+        x: 290,
+        y: 232,
+        w: 180,
+        h: 56,
+        kind: 'internal',
+        label: 'Authentik',
+        sub: { en: 'SSO · forward-auth', no: 'SSO · forward-auth' },
+      },
       {
         id: 'gitea',
         x: 560,
-        y: 40,
-        w: 190,
+        y: 44,
+        w: 210,
         h: 60,
         kind: 'internal',
-        label: 'Gitea',
-        sub: { en: 'git.cesnimda.uk', no: 'git.cesnimda.uk' },
+        label: 'Gitea + runner',
+        sub: { en: 'git.cesnimda.uk · CI/CD', no: 'git.cesnimda.uk · CI/CD' },
       },
       {
         id: 'apps',
         x: 560,
-        y: 120,
-        w: 190,
+        y: 128,
+        w: 210,
         h: 60,
         kind: 'internal',
-        label: 'App services',
-        sub: { en: 'Docker containers', no: 'Docker-containere' },
+        label: 'App containers',
+        sub: { en: 'JobTrack · this site', no: 'JobTrack · denne siden' },
       },
       {
-        id: 'monitor',
+        id: 'media',
         x: 560,
-        y: 200,
-        w: 190,
+        y: 212,
+        w: 210,
         h: 60,
         kind: 'internal',
-        label: 'Monitoring',
-        sub: { en: 'uptime · logs', no: 'oppetid · logger' },
+        label: 'Media stack',
+        sub: { en: 'Jellyfin · *arr', no: 'Jellyfin · *arr' },
       },
     ],
     edges: [
-      { d: 'M200 152 H280', kind: 'flow' },
-      { d: 'M470 140 L560 70', kind: 'flow' },
-      { d: 'M470 152 H560', kind: 'flow' },
-      { d: 'M470 164 L560 230', kind: 'flow' },
+      { d: 'M210 158 H290', kind: 'flow' },
+      { d: 'M380 192 V232', kind: 'flow', label: 'auth', labelX: 400, labelY: 218 },
+      { d: 'M470 150 L560 74', kind: 'flow' },
+      { d: 'M470 158 H560', kind: 'flow' },
+      { d: 'M470 166 L560 242', kind: 'flow' },
     ],
   },
   media: [],
   content: {
     en: {
-      valueProp: 'Where I run, break and fix real infrastructure — not just deploy it.',
+      valueProp:
+        'Where I run, break and fix real infrastructure — around thirty containerised services behind a single reverse proxy.',
       cardTeaser:
-        'Ubuntu · Docker services · reverse proxy · auth · monitoring · Gitea (this site’s own git remote).',
+        'Ubuntu + Docker · Traefik · Authentik SSO · CrowdSec · Gitea CI — ~30 self-hosted services, and the deploy target for this site.',
       tldr: {
-        what: 'A self-hosted home lab running production-style services.',
-        why: 'To keep operations skills hands-on.',
-        stack: 'Ubuntu · Docker · nginx · Gitea · monitoring.',
+        what: 'A self-hosted home server running ~30 production-style services.',
+        why: 'To keep operations and security skills hands-on.',
+        stack: 'Ubuntu · Docker · Traefik · Authentik · CrowdSec · Gitea.',
         role: 'Operator.',
       },
       sections: [
@@ -102,7 +118,7 @@ export const homelab: Project = {
           blocks: [
             {
               type: 'p',
-              text: 'A home lab running Ubuntu and Docker-based services behind an nginx reverse proxy, with authentication, monitoring and backups. It’s where I get ongoing, hands-on practice with deployment, troubleshooting and real-world operations — including the self-hosted Gitea instance that this very site is built and deployed from.',
+              text: 'An Ubuntu 24.04 server running around thirty Docker services behind a Traefik reverse proxy, with single sign-on, an intrusion-prevention layer, DNS filtering and a full CI/CD setup. It’s where I get ongoing, hands-on practice with deployment, security and real-world operations — including the self-hosted Gitea instance and runner that build and deploy this very portfolio.',
             },
           ],
         },
@@ -114,10 +130,11 @@ export const homelab: Project = {
             {
               type: 'ul',
               items: [
-                'nginx reverse proxy terminating TLS in front of every service.',
-                'Docker Compose stacks for applications, each isolated on its own network.',
-                'Authentication in front of internal tools; monitoring for uptime and logs.',
-                'Self-hosted Gitea with CI runners — the deployment target for this portfolio.',
+                'Traefik terminates TLS and routes every service, fronted by Cloudflare, with separate internal and external entrypoints and HTTP/3.',
+                'Authentik provides single sign-on as a Traefik forward-auth middleware in front of internal tools; CrowdSec adds intrusion prevention and Pi-hole handles DNS filtering.',
+                'Gitea and a Gitea Actions runner give me self-hosted git and CI/CD — the build-and-deploy target for this site.',
+                'The Docker socket is exposed to Traefik only through a hardened socket-proxy, and each application runs on its own isolated Docker network.',
+                'Portainer and Dozzle handle container management and logs; alongside these run application, media and utility stacks.',
               ],
             },
           ],
@@ -129,7 +146,7 @@ export const homelab: Project = {
           blocks: [
             {
               type: 'p',
-              text: 'Tightening backup verification and adding more automated health checks and alerting across the stack.',
+              text: 'Retiring the legacy WordPress site now that this portfolio replaces it, then tightening backup verification and expanding automated health checks and alerting across the stack.',
             },
           ],
         },
@@ -137,13 +154,13 @@ export const homelab: Project = {
     },
     no: {
       valueProp:
-        'Der jeg drifter, ødelegger og fikser ekte infrastruktur — ikke bare ruller den ut.',
+        'Der jeg drifter, ødelegger og fikser ekte infrastruktur — rundt tretti containeriserte tjenester bak én reverse proxy.',
       cardTeaser:
-        'Ubuntu · Docker-tjenester · reverse proxy · auth · overvåking · Gitea (git-remoten til denne siden).',
+        'Ubuntu + Docker · Traefik · Authentik SSO · CrowdSec · Gitea CI — ~30 egendriftede tjenester, og utrullingsmålet for denne siden.',
       tldr: {
-        what: 'En egendriftet hjemmelab som kjører produksjonslignende tjenester.',
-        why: 'For å holde driftsferdighetene praktiske.',
-        stack: 'Ubuntu · Docker · nginx · Gitea · overvåking.',
+        what: 'En egendriftet hjemmeserver med ~30 produksjonslignende tjenester.',
+        why: 'For å holde drifts- og sikkerhetsferdighetene praktiske.',
+        stack: 'Ubuntu · Docker · Traefik · Authentik · CrowdSec · Gitea.',
         role: 'Operatør.',
       },
       sections: [
@@ -154,7 +171,7 @@ export const homelab: Project = {
           blocks: [
             {
               type: 'p',
-              text: 'En hjemmelab som kjører Ubuntu og Docker-baserte tjenester bak en nginx reverse proxy, med autentisering, overvåking og sikkerhetskopier. Det er her jeg får løpende, praktisk øving på utrulling, feilsøking og ekte drift — inkludert den egendriftede Gitea-instansen som denne siden bygges og rulles ut fra.',
+              text: 'En Ubuntu 24.04-server som kjører rundt tretti Docker-tjenester bak en Traefik reverse proxy, med single sign-on, et lag for inntrengingsvern, DNS-filtrering og full CI/CD. Det er her jeg får løpende, praktisk øving på utrulling, sikkerhet og ekte drift — inkludert den egendriftede Gitea-instansen og runneren som bygger og ruller ut denne porteføljen.',
             },
           ],
         },
@@ -166,10 +183,11 @@ export const homelab: Project = {
             {
               type: 'ul',
               items: [
-                'nginx reverse proxy som terminerer TLS foran hver tjeneste.',
-                'Docker Compose-stacker for applikasjoner, hver isolert på eget nettverk.',
-                'Autentisering foran interne verktøy; overvåking av oppetid og logger.',
-                'Egendriftet Gitea med CI-runnere — utrullingsmålet for denne porteføljen.',
+                'Traefik terminerer TLS og ruter alle tjenester, med Cloudflare foran, egne interne og eksterne entrypoints og HTTP/3.',
+                'Authentik gir single sign-on som en Traefik forward-auth-middleware foran interne verktøy; CrowdSec legger til inntrengingsvern og Pi-hole håndterer DNS-filtrering.',
+                'Gitea og en Gitea Actions-runner gir egendriftet git og CI/CD — bygge- og utrullingsmålet for denne siden.',
+                'Docker-socketen eksponeres kun til Traefik gjennom en herdet socket-proxy, og hver applikasjon kjører på sitt eget isolerte Docker-nettverk.',
+                'Portainer og Dozzle håndterer containere og logger; ved siden av kjører applikasjons-, media- og verktøystacker.',
               ],
             },
           ],
@@ -181,7 +199,7 @@ export const homelab: Project = {
           blocks: [
             {
               type: 'p',
-              text: 'Strammere verifisering av sikkerhetskopier og flere automatiske helsesjekker og varsling på tvers av stacken.',
+              text: 'Legge ned den gamle WordPress-siden nå som denne porteføljen erstatter den, og deretter stramme inn verifisering av sikkerhetskopier og utvide automatiske helsesjekker og varsling på tvers av stacken.',
             },
           ],
         },

site/src/data/projects/jobtrack.ts

@@ -85,42 +85,42 @@ export const jobtrack: Project = {
   },
   media: [
     {
-      src: 'placeholder:jobtrack-table',
+      src: '/assets/projects/jobtrack/applications.webp',
       width: 1600,
-      height: 1000,
+      height: 768,
       alt: {
-        en: 'JobTrack applications table with status filters and search',
-        no: 'JobTrack-søknadstabell med statusfiltre og søk',
+        en: 'JobTrack applications table showing companies, roles, statuses and follow-up flags',
+        no: 'JobTrack-søknadstabell med selskaper, roller, statuser og oppfølgingsmarkører',
       },
       caption: {
-        en: 'Applications table — pipeline at a glance',
-        no: 'Søknadstabell — hele pipelinen samlet',
+        en: 'Applications table — the whole pipeline at a glance, with per-row next actions',
+        no: 'Søknadstabell — hele pipelinen samlet, med neste handling per rad',
       },
     },
     {
-      src: 'placeholder:jobtrack-details',
+      src: '/assets/projects/jobtrack/dashboard.webp',
       width: 1600,
-      height: 1000,
+      height: 759,
       alt: {
-        en: 'Job details dialog combining summary, notes, correspondence and attachments',
-        no: 'Jobbdetaljer med sammendrag, notater, korrespondanse og vedlegg',
+        en: 'JobTrack dashboard with application trends, response rates and skill tags',
+        no: 'JobTrack-dashbord med søknadstrender, svarrater og ferdighetstagger',
       },
       caption: {
-        en: 'Job details — everything about one application in one place',
-        no: 'Jobbdetaljer — alt om én søknad på ett sted',
+        en: 'Dashboard — trends, response rates and pipeline health',
+        no: 'Dashbord — trender, svarrater og pipeline-helse',
       },
     },
     {
-      src: 'placeholder:jobtrack-gmail',
+      src: '/assets/projects/jobtrack/reminders.webp',
       width: 1600,
-      height: 1000,
+      height: 758,
       alt: {
-        en: 'Gmail import view with smart query filters and thread import',
-        no: 'Gmail-import med smarte søkefiltre og trådimport',
+        en: 'JobTrack reminders view surfacing applications that need follow-up',
+        no: 'JobTrack-påminnelser som løfter fram søknader som trenger oppfølging',
       },
       caption: {
-        en: 'Gmail import — pull correspondence straight onto the application',
-        no: 'Gmail-import — hent korrespondanse rett inn på søknaden',
+        en: 'Reminders — applications that need attention, driven by follow-up rules',
+        no: 'Påminnelser — søknader som trenger oppfølging, styrt av regler',
       },
     },
   ],

tests/playwright.config.ts

@@ -11,13 +11,13 @@ export default defineConfig({
   retries: process.env.CI ? 1 : 0,
   reporter: process.env.CI ? [['list'], ['html', { open: 'never' }]] : 'list',
   use: {
-    baseURL: 'http://localhost:4321',
+    baseURL: 'http://localhost:4399',
     trace: 'on-first-retry',
   },
   projects: [{ name: 'chromium', use: { ...devices['Desktop Chrome'] } }],
   webServer: {
-    command: 'pnpm -C ../site build && pnpm -C ../site preview --port 4321 --host',
-    url: 'http://localhost:4321/',
+    command: 'pnpm -C ../site build && pnpm -C ../site preview --port 4399 --host',
+    url: 'http://localhost:4399/',
     timeout: 180_000,
     reuseExistingServer: !process.env.CI,
   },