Deploy Notes 11.03.2026

Random Thoughts from a Restless Mind

Category: Deploy Notes

Tags: Accumulated Knowledge Personal Home Page Process Security They Said It! View Source

Published On: November 3, 2026

💧 The Droplets

First week on the new schedule: server maintenance moved to Sunday, packaging to Monday, and the deploys themselves to Tuesday. Spreading the release ritual across three days instead of cramming it into one has already made each piece less hectic, so this is the cadence for the foreseeable future. The version numbers followed suit — CalVer now counts Tuesdays instead of Sundays, so v2026.11.1 is this week’s tag across the board.

Both boxes (LEMP 1 and the newer LEMP 2) got their packages updated and reboots applied on Sunday. The one real change on LEMP 1 was a larger nginx request limit, which the blog image uploads below needed.

🏠 Personal Home Page — v2026.11.1

Blog posts can finally have images, uploaded straight from the admin. Every upload is re-encoded on the server into a JPEG capped at 1600px, with its EXIF orientation applied and all metadata (GPS, camera, serial number, dates) stripped, and saved under a random filename — so neither the original file nor its name ever reaches the public. The image shows at the top of the post and doubles as the social preview card. The old Google Drive image field sticks around as a legacy fallback for the handful of posts still using it.

The privacy page was also brought in line with the current consent and data-retention behavior on They Said It! and Accumulated Knowledge. Behind the scenes, I dropped roave/security-advisories from all the Symfony projects — its new PHP version conflict misreads Ubuntu’s backported PHP and would have broken installs on the server. Composer’s own advisory blocking plus the composer audit step in CI cover the same ground. A symfony/mime patch for CVE-2026-45070 rode along on every project this week, too.

🎬 They Said It! — v2026.11.1 — theysaidit.app

A quiet week: the site’s copy now speaks as one person throughout (no more “we” or “our” on the contact, about, error, and maintenance pages), plus the same dependency cleanup and security patch as everything else.

🧙 Accumulated Knowledge — v2026.11.1 — accumulatedknowledge.app

This one also had a hotfix (v2026.10.4-p1) go out on October 26, which hasn’t been written up yet. Starting October 19, a bot started feeding other people’s email addresses into the sign-up form from rotating IPs — 77 sign-ups in three days, none of them real. The site wasn’t the target; it was being used as a delivery mechanism to bury someone’s inbox (subscription bombing), and its sending reputation was taking the hit. A few things changed in response:

• The verification email now opens a page with a Confirm My Email button instead of verifying on the link itself. Corporate mail scanners open every link in an email, and they’d been “confirming” accounts nobody made.
• The sign-up form carries a signed timing token next to the honeypot, so a submission faster than a person can type is silently dropped.
• A site-wide cap of 10 email-sending sign-ups per day bounds the damage no matter how many IPs a bot rotates through. Resend-verification and password-reset for unconfirmed accounts count against the same cap.
• Accounts nobody confirms within 7 days get purged nightly, and completing a password reset now also confirms your email.

This week’s proper release is about Log a Match reliability. The biggest fix: a match you’ve started now survives browsing mid-game. Quick Log and an event’s New Match form share one on-device draft, so you can start a match in one, go check a deck or your profile, come back through the other, and your opponents and start time are still there. The form also refuses to save a match with no result picked — previously that stored a match with zero games, which the deck page counted as a loss. Symfony was patched across the board (7.4.22) while I was in there.

📚 View Source — v2026.11.1 — viewsource.school

New to Deploy Notes: View Source is a project I built for an after-school coding program I’m running with the Boys & Girls Club. Think CodePen or JSFiddle, but designed with kids’ privacy in mind — no analytics, no third-party code, and a lot more hand-holding: auto-save, history, easy exports, and sample projects students can start from instead of a blank page.

This week shipped a lot of that sample content. Block Builder is a little 2D block world built to be modded — mods.js ships with four working mods and a challenge ladder from “change a word” up to “make sand fall,” using the same event-hook ideas real game plugins use. If a mod has a bug, the game turns off just that mod and the console says which one and why. Three more samples landed alongside it: Guess the Number (a first JavaScript game), Catch the Critter (a clicking game with a settings panel to tweak), and Stranded on Planet Zorb (a choose-your-own-adventure made of linked HTML pages, no JS at all). There’s a teaching playbook in the repo now too, with session plans and an answer key for every challenge level.

On the site itself: a privacy policy at /privacy written in plain words for students, with its numbers pulled straight from the site’s settings so they can’t drift. Teachers and the admin can now make their own projects for demos, with one-click switching between their panel and the editor, and a bug that sent staff to a “not found” page when starting from a sample is fixed.

🔮 On Deck

The privacy page on uncleversace.com still needs a line about Accumulated Knowledge’s 7-day purge. On View Source, the next big pieces are teacher feedback on student projects and publishing with an approval queue.