Opening a can of worms - Systems

website CMS security

Anyway, enough complaining. About the title, seems like no matter what you do in this field you're always opening another can of worms, building this site was no different. If you dig into the archive posts you'll see various pitfalls I fell into with previous iterations, but the machines and systems mentioned there are no longer in place. Making the core of the site has been trial and error over many years but I was indeed able to build the entire menu system using only HTML5 and CSS3 which is no small feat considering the number of moving parts and need for accessibility options.

The observant among you may notice there is in fact some PHP in there but as of this post all it does is set up a basic session cookie with error handling to ensure you can't access things you shouldn't. In future I'd like to expand this a bit and maybe include some JavaScript to validate, perhaps as some sort of login system more as a proof of ability than any particular need. I am cautious of this though as maintaining any sort of database for such things is not exactly a wise move in case you get hacked, so maybe I'll integrate it with Google's API for token login or something, who knows?

To add the content I could've built a system myself but as they say you really shouldn't re-invent the wheel, so I decided to fall back onto existing services and use my hand-made website to weave them all together. For the blog I needed a CMS, I've used WordPress lots before but its bloaty, often quite restrictive, and of course is famous for its security holes because everyone uses it. So I decided instead to use Grav, its much simpler, lighter and more free-form, and that took me a while to get used to but once you start digging a lot of it is fairly straightforward. What I like most about it is its very like using both Jekyll which I've done on my Github for years and markdown which is becoming the defacto standard for documentation.

Github on the other hand presented a lot more problems, which you wouldn't expect as a more commonly used site that I already had in a fully operational state. The problems though more stemmed from me than the site itself, this is usually the case as I have a tendency to try do things "properly" that often stands in the way of functionality. Now that I owned my domain rather than purely leased it (something I'll get into in the section after next), I figured it would be nice to actually integrate the development site into the main one. Namely I wanted to have the site proxy through my main one, so not only does it use my custom subdomain, but so you don't see that subdomain at all because instead it is requested as a pseudo-subdirectory. The logic behind this may not be apparent so allow me to elaborate.

Previous Post Next Post