Under the surface
How it’s built.
Lens on Security separates writing from hosting. Drafts and the publishing controls stay private on my home network, while readers receive a fast static website with no public database or administrator login.
Publishing architecture
01
Write privately
WireGuard + Raspberry Pi
I reach the private publisher through my VPN. Draft text and original photographs stay on the Pi-connected storage until I choose to publish.
02
Create the source
Markdown + optimized images
The publisher validates the article, converts uploads to web-ready JPEGs, removes EXIF metadata, and creates the Markdown used by the site.
03
Build automatically
GitHub + Astro
A dedicated deploy key pushes the new source to GitHub. GitHub Actions runs the Astro build and produces a static version of every page.
04
Serve publicly
GitHub Pages + HTTPS
GitHub Pages hosts the public files at lensonsecurity.com. Cloudflare provides authoritative DNS while HTTPS protects traffic to the site.
Security decisions
A small public surface.
No public admin login
The publisher is available only from approved private networks instead of being exposed to the internet.
No production database
The reader-facing site is static, reducing the number of services that can be attacked or fail.
Deliberate publishing
Publishing is an explicit action protected by request validation, repository checks, and a narrowly scoped GitHub key.
Reversible history
Every publication and unpublication becomes a Git commit, creating a useful record of how the site changed.
Private publishing interface
What the editors do.
The publisher turns common website updates into guided forms. It runs only on my private network; the public site receives the finished static files, never the editor itself.
01
Article editor
Write, preview, publish.
The composer combines the article title, summary, metadata, photographs, sources, and body in one place. Formatting controls support headings, emphasis, lists, links, code, highlights, and the site’s color palette. Drafts can be saved or previewed privately before an explicit publish action.
02
About editor
Maintain the public profile.
Profile text, certifications, links, the site’s purpose, and résumé details can be updated without editing source files. A headshot tool provides drag-and-zoom positioning, then produces the same 4:5 crop used by the public page while removing embedded image metadata.
03
Reading editor
Curate subscribed sources.
RSS and Atom feeds can be added, organized into fixed categories, hidden, or made public. Publishing updates the Reading page, where subscribed articles are collected into a single viewer and refreshed automatically throughout the day.
These screenshots use empty or already-public information. Private drafts, network addresses, access keys, and server configuration are intentionally excluded.