Authentication

This blog does not provide public user accounts.

Reader access

All published posts and docs are publicly readable, and so are the Markdown rendition of every article (/blog/post/<slug>.md) and the machine-readable files (/sitemap.xml, /llms.txt).

Private operations

Publishing and maintenance go through /blog/admin/*. Every request there carries the operator token in an x-admin-token header; the comparison is constant-time, and a missing, empty or wrong token answers 401 — not 403, because the server does not distinguish "no token" from "wrong token" and does not want to.

Those endpoints are reachable on the loopback only: the public host closes /blog/admin/ at the edge, and the scheduler and the publishing scripts talk to 127.0.0.1 directly.

Security note

The token lives in the environment (ADMIN_TOKEN in .env), never in source control. When it is unset, every admin request is refused.