When G Sorts Before M: The NixOS Alphabetical Default-Server Hijack in Nginx
• Mike Levin
Setting the Stage: Context for the Curious Book Reader
Running ten domains on a single bare-metal NixOS machine sitting in a home DMZ requires neither Kubernetes nor Docker, because the entire routing topology lives in a single declarative text file: configuration.nix. Yet declarative infrastructure still obeys the evaluation rules of its underlying language and daemon. When guerillatech.com joined the Honeybot Web Bot AI Observatory, its Nginx access log immediately lit up with 404 errors for article and category paths belonging to mikelev.in. What looked at first like a misconfigured log file or a stale local cache turned out to be a two-phase collision between how Nix evaluates attribute set keys (strictly alphabetically) and how Nginx selects an implicit catch-all default_server (the first server block emitted in nginx.conf). Using the five-stage AI-Edit Method—probing live /nix/store/*-nginx.conf artifacts, discovering a missing remote ripgrep binary, catching www.mikelev.in serving a shell installer via curl, and verifying every state transition with before-and-after wire receipts—this session locks down canonical host routing and turns a poisoned remote crawler frontier into a self-healing 301 redirect funnel.
TL;DR: When a single NixOS web server hosts multiple domains through services.nginx.virtualHosts without declaring default = true; on any host, Nix evaluates the virtual host attribute set in alphabetical order of the domain keys, and Nginx assigns the first emitted server block as the implicit catch-all default_server. Before new domain virtual hosts (guerillatech.com, levinix.org) were added to configuration.nix, their DNS A-records already pointed to the server’s IP address and fell through to the previous alphabetically first host (mikelev.in), causing web crawlers (AhrefsBot, PetalBot) to index mikelev.in’s root-relative links under the new domain names; conversely, once "guerillatech.com" (g) was added, it alphabetically preceded "mikelev.in" (m), hijacking unmatched Host headers such as www.mikelev.in. Setting default = true; and serverAliases = [ "www.mikelev.in" ]; on mikelev.in, and adding $new_uri and !-e $request_filename 301 redirect rules on the single-page door domains, restores canonical routing and drains the crawlers’ cross-domain queues back to [https://mikelev.in](https://mikelev.in).
Technical Journal Entry Begins
MikeLev.in: I recently started hosting a lot more sites off of the Nignix Honeybot home-hosted Web Bot AI Observatory. It’s not behind a CDN. I’m not using any Kubernetes clusters or any of the K4 or whatever junior things of that exist, nor am I using a single Docker image. I have the raw Internet hitting a raw machine sitting in a DMZ of a LAN.
How can I do this without being some sort of fancy DevOps Engineer or letting all the rigors of running a home network overload me?
The answer is Infrastructure as Code.
The answer is Nix.
It’s all just text-files.
But now I need to check on those text-files because I’m getting traffic reported on sites in the Nginx access log that doesn’t seem right. It looks like traffic being reported on guerillatech.com trying to load pages that were published on MikeLev.in, 404’ing. It might be right for some reason but it seems wrong. Here take a look at all it’s IaC and know that you can even pull its log or do fancy tricks to grep it over ssh or whatever.
When G Sorts Before M: Diagnosing the Implicit Default-Server Hijack
Gemini 4 Argon High: Context verified.
TL;DR: Two mechanisms in remotes/honeybot/nixos/configuration.nix explain why guerillatech.com is logging 404s for mikelev.in article paths ([17:43:29], [17:43:35], [17:43:47] in the screenshot):
- Alphabetical Default-Server Hijack in NixOS (
gbeforem): None of the tenservices.nginx.virtualHostsentries inremotes/honeybot/nixos/configuration.nixsetsdefault = true;. Nix evaluates attribute sets in alphabetical order of their keys, and Nginx treats the **firstserverblock innginx.conf**as the implicitdefault_serverfor ports 80 and 443.- Before
2026-10-21, the vhosts weremikelev.in,npvg.org, andqamy.ai—somikelev.in(m) was accidentally first and served as the catch-all default server. - While
guerillatech.comDNS pointed at Honeybot’s IP beforevirtualHosts."guerillatech.com"existed, any crawler (such asAhrefsBot) hittingguerillatech.comwas servedmikelev.in’s Jekyll_site. Because Jekyll’s internal links are root-relative (/futureproof/...,/prompt-engineering/...),AhrefsBotqueuedmikelev.in’s URL tree under theguerillatech.comhost. - Today (
2026-10-25), addingvirtualHosts."guerillatech.com"gaveguerillatech.comits own isolated root (/home/mike/www/guerillatech.com), soAhrefsBot’s queued crawl frontier for[guerillatech.com/futureproof/](https://guerillatech.com/futureproof/)...now 404s againstguerillatech.com’s one-page door.
- Before
guerillatech.comIs Now the Implicit Catch-All Default Server: Because"guerillatech.com"starts withg, it is now the firstserverblock emitted innginx.conf(ahead oflevinix.*,mikelev.in,npvg.org,qamy.ai,rfc9110.org,rfc9111.io, andsunpug.io). Any request arriving at Honeybot with an unmatchedHostheader (includingwww.mikelev.in, sincevirtualHosts."mikelev.in"has noserverAliases) or an HTTP/1.0 request with noHostheader now routes toguerillatech.cominstead ofmikelev.in.
BEFORE 2026-10-21 (alphabetical keys: m, n, q)
1st server block: mikelev.in <-- implicit default_server
guerillatech.com (no vhost yet) ──► falls through to mikelev.in/_site
──► AhrefsBot indexes /futureproof/* under guerillatech.com
AFTER 2026-10-25 (alphabetical keys: g, l, m, n, q, r, s)
1st server block: guerillatech.com <-- NEW implicit default_server!
AhrefsBot retries queued guerillatech.com/futureproof/* ──► hits /home/mike/www/guerillatech.com ──► 404
Unmatched Host / bare-IP requests ──► hits guerillatech.com instead of mikelev.in
Before we patch remotes/honeybot/nixos/configuration.nix to pin default = true; on mikelev.in (and decide whether cross-domain legacy paths on the door domains should 404 or redirect to mikelev.in), let’s run the read-only SSH probe below to inspect:
- the exact
server_nameorder in Honeybot’s livenginx.conf, - the raw
Host:"guerillatech.com"log lines in/var/log/nginx/access.log, and - whether those paths exist in
mikelev.in’s_site/redirects.map.
1: BEFORE (PROBE)
Run in (nix) pipulate $:
ssh honeybot 'cfg=$(ps -eo args | rg -o "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; rg "server_name |default_server" "$cfg"; echo "=== GUERILLATECH LOG HITS ==="; rg "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; rg "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/" ~/www/mikelev.in/_site/redirects.map'
2: AFTER (NEXT CONTEXT)
Paste into context.txt (via context or x) for (nix) pipulate $:
remotes/honeybot/nixos/configuration.nix
remotes/honeybot/scripts/logs.py
! ssh honeybot 'cfg=$(ps -eo args | rg -o "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; rg "server_name |default_server" "$cfg"; echo "=== GUERILLATECH LOG HITS ==="; rg "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; rg "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/" ~/www/mikelev.in/_site/redirects.map'
3: CHANGE (PATCHES)
No repo patches required on this turn (probe-first gate before modifying Honeybot’s Nginx config). No ignition required.
4: PROMPT
Copy into prompt.md (via prompt or p) for (nix) pipulate $:
Review the live nginx.conf server_name ordering, the raw guerillatech.com access.log lines, and the redirects.map check from Honeybot. Confirm whether AhrefsBot crawled guerillatech.com while it fell through to the default server, and emit the SEARCH/REPLACE patch for remotes/honeybot/nixos/configuration.nix (and any redirect/default_server hygiene needed).
5: DELIVERABLE
- Live receipt of Honeybot’s compiled
nginx.confserver_nameorder confirming"guerillatech.com"is emitted first with nodefault_serverset. - Raw
access.loglines forHost:"guerillatech.com"showing the exact request, referrer, and user-agent fields. - Confirmation of how
mikelev.inhandles those three slugs (_sitevs.redirects.map) so the next turn’s patch locksdefault = true;ontomikelev.incleanly.
MikeLev.in:
THE AI-EDIT METHOD
Same commands, run twice, one change between them. Where the readings differ is what the change did; the diff in the middle is the receipt.
1: BEFORE (PROBE):
On branch main
Your branch is up to date with 'origin/main'.
nothing to commit, working tree clean
GIT repo clean. Take BEFORE reading, make CHANGE, record AFTER diff.
(nix) pipulate $ ssh honeybot 'cfg=$(ps -eo args | rg -o "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; rg "server_name |default_server" "$cfg"; echo "=== GUERILLATECH LOG HITS ==="; rg "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; rg "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/" ~/www/mikelev.in/_site/redirects.map'
bash: line 1: rg: command not found
=== NGINX CONF: ===
bash: line 1: rg: command not found
=== GUERILLATECH LOG HITS ===
bash: line 1: rg: command not found
=== MIKELEV.IN REDIRECT MAP CHECK ===
bash: line 1: rg: command not found
(nix) pipulate $
2: AFTER (NEXT CONTEXT):
# # Content 1
# context.txt
#
# # WE BEGIN AT THE BEGINNING AND WILL GO ON TILL WE COME TO THE END, THEN STOP.
# ~/repos/nixos/configuration.nix
# ~/repos/nixos/services.nix
# ~/repos/nixos/packages.nix
# ~/repos/nixos/autognome.py
# init.lua
# flake.nix
#
# # HOME-HOSTED (NOT BEHIND CDN) NGINX WEBSERVER HONEYBOT AI OBSERVATORY
# nixops.sh
# remotes/honeybot/hooks/post-receive
# remotes/honeybot/nixos/configuration.nix
# remotes/honeybot/scripts/score.py
# remotes/honeybot/scripts/card.py
# remotes/honeybot/scripts/forest.py
# remotes/honeybot/scripts/test_forest.py
# remotes/honeybot/scripts/logs.py
# remotes/honeybot/scripts/content_loader.py
# remotes/honeybot/scripts/db.py
#
# # THE DATA EVERYONE NEEDS
# remotes/honeybot/queries/trapdoor_ips.sql
# ! echo "--- WHO HYDRATES THE DOM ---" && cat remotes/honeybot/queries/trapdoor_ips.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db'
# remotes/honeybot/queries/content_neg_agents.sql
# ! echo "--- WHO NEGOTIATES MARKDOWN ---" && cat remotes/honeybot/queries/content_neg_agents.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db'
# Context 2
context.txt
remotes/honeybot/nixos/configuration.nix
remotes/honeybot/scripts/logs.py
! ssh honeybot 'cfg=$(ps -eo args | rg -o "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; rg "server_name |default_server" "$cfg"; echo "=== GUERILLATECH LOG HITS ==="; rg "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; rg "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/" ~/www/mikelev.in/_site/redirects.map'
3: CHANGE (PATCHES):
None this turn.
4: PROMPT:
Review the live nginx.conf server_name ordering, the raw guerillatech.com access.log lines, and the redirects.map check from Honeybot. Confirm whether AhrefsBot crawled guerillatech.com while it fell through to the default server, and emit the SEARCH/REPLACE patch for remotes/honeybot/nixos/configuration.nix (and any redirect/default_server hygiene needed).
5: DELIVERABLE:
Cleaning up combined log files for multi-site hosting on one Nginx server.
Exit Code 127: The Cheapest Falsifying Probe Meets a Missing Remote Binary
Gemini 4 Argon High: Context verified.
TL;DR: The SSH probe failed with exit code 127 (bash: line 1: rg: command not found) because ripgrep is installed on (nix) pipulate $ (packages.nix / flake.nix), not in remotes/honeybot/nixos/configuration.nix’s environment.systemPackages. Anything executed inside ssh honeybot '...' must use POSIX grep -E until we add ripgrep to Honeybot’s configuration.nix.
Per the Cheapest Falsifying Probe rule, we hold the remotes/honeybot/nixos/configuration.nix patch (adding default = true; and serverAliases on mikelev.in, plus ripgrep in environment.systemPackages, and any cross-domain redirect cleanup) until we have the live BEFORE reading in hand.
1: BEFORE (PROBE)
Run in (nix) pipulate $:
ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== GUERILLATECH ACCESS.LOG HITS ==="; grep -E "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== GUERILLATECH VHOST LOG ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; grep -E "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/|/pipulate/nixos/crc32/crc32/|/seo/pipulate/semantic-web/|/nix/nixos/python/initpy/" ~/www/mikelev.in/_site/redirects.map'
2: AFTER (NEXT CONTEXT)
Paste into context.txt (via context or x) for (nix) pipulate $:
context.txt
remotes/honeybot/nixos/configuration.nix
remotes/honeybot/scripts/logs.py
! ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== GUERILLATECH ACCESS.LOG HITS ==="; grep -E "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== GUERILLATECH VHOST LOG ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; grep -E "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/|/pipulate/nixos/crc32/crc32/|/seo/pipulate/semantic-web/|/nix/nixos/python/initpy/" ~/www/mikelev.in/_site/redirects.map'
3: CHANGE (PATCHES)
No repo patches required on this turn (re-running the BEFORE probe with grep -E on honeybot before patching remotes/honeybot/nixos/configuration.nix). No ignition required.
4: PROMPT
Copy into prompt.md (via prompt or p) for (nix) pipulate $:
Analyze the live nginx.conf listen/server_name output, the guerillatech.com log lines, and the redirects.map matches from Honeybot. Emit the SEARCH/REPLACE patch for remotes/honeybot/nixos/configuration.nix (including ripgrep on honeybot, default_server/alias hygiene on mikelev.in, and any log or redirect cleanup warranted by the evidence).
5: DELIVERABLE
- Clean BEFORE receipt from Honeybot using
grep -Eshowing:- The live
nginx.conflistenandserver_nameordering. - The raw
Host:"guerillatech.com"log lines from/var/log/nginx/access.logand/var/log/nginx/guerillatech.access.log. - Which of the 404ing paths exist in
~/www/mikelev.in/_site/redirects.map.
- The live
MikeLev.in:
THE AI-EDIT METHOD
Same commands, run twice, one change between them. Where the readings differ is what the change did; the diff in the middle is the receipt.
1: BEFORE (PROBE):
On branch main
Your branch is up to date with 'origin/main'.
nothing to commit, working tree clean
GIT repo clean. Take BEFORE reading, make CHANGE, record AFTER diff.
(nix) pipulate $ ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== GUERILLATECH ACCESS.LOG HITS ==="; grep -E "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== GUERILLATECH VHOST LOG ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; grep -E "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/|/pipulate/nixos/crc32/crc32/|/seo/pipulate/semantic-web/|/nix/nixos/python/initpy/" ~/www/mikelev.in/_site/redirects.map'
=== NGINX CONF: /nix/store/1v9yjd4635cr9iwhm0rva0xfhw6n2y50-nginx.conf ===
listen 0.0.0.0:80 ;
listen [::0]:80 ;
server_name guerillatech.com www.guerillatech.com;
listen 0.0.0.0:443 ssl ;
listen [::0]:443 ssl ;
server_name guerillatech.com www.guerillatech.com;
listen 0.0.0.0:80 ;
listen [::0]:80 ;
server_name levinix.com www.levinix.com;
listen 0.0.0.0:443 ssl ;
listen [::0]:443 ssl ;
server_name levinix.com www.levinix.com;
listen 0.0.0.0:80 ;
listen [::0]:80 ;
server_name levinix.org www.levinix.org;
listen 0.0.0.0:443 ssl ;
listen [::0]:443 ssl ;
server_name levinix.org www.levinix.org;
listen 0.0.0.0:80 ;
listen [::0]:80 ;
server_name levinux.com www.levinux.com;
listen 0.0.0.0:443 ssl ;
listen [::0]:443 ssl ;
server_name levinux.com www.levinux.com;
listen 0.0.0.0:80 ;
listen [::0]:80 ;
server_name mikelev.in ;
listen 0.0.0.0:443 ssl ;
listen [::0]:443 ssl ;
server_name mikelev.in ;
listen 0.0.0.0:80 ;
listen [::0]:80 ;
server_name npvg.org www.npvg.org;
listen 0.0.0.0:443 ssl ;
listen [::0]:443 ssl ;
server_name npvg.org www.npvg.org;
listen 0.0.0.0:80 ;
listen [::0]:80 ;
server_name qamy.ai www.qamy.ai;
listen 0.0.0.0:443 ssl ;
listen [::0]:443 ssl ;
server_name qamy.ai www.qamy.ai;
listen 0.0.0.0:80 ;
listen [::0]:80 ;
server_name rfc9110.org www.rfc9110.org;
listen 0.0.0.0:443 ssl ;
listen [::0]:443 ssl ;
server_name rfc9110.org www.rfc9110.org;
listen 0.0.0.0:80 ;
listen [::0]:80 ;
server_name rfc9111.io www.rfc9111.io;
listen 0.0.0.0:443 ssl ;
listen [::0]:443 ssl ;
server_name rfc9111.io www.rfc9111.io;
listen 0.0.0.0:80 ;
listen [::0]:80 ;
server_name sunpug.io www.sunpug.io;
listen 0.0.0.0:443 ssl ;
listen [::0]:443 ssl ;
server_name sunpug.io www.sunpug.io;
=== GUERILLATECH ACCESS.LOG HITS ===
[REDACTED_IP] - - [25/Oct/2026:17:53:35 -0400] "GET /futureproof/mobilegeddon-aigeddon-sovereign-computing/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:53:41 -0400] "GET /futureproof/openclaw-nixos-claude-opus-4-6-golden-master-test/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:53:47 -0400] "GET /futureproof/ai-strange-loop-not-a-bubble/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:53:53 -0400] "GET /futureproof/browser-api-managing-chrome-bookmarks-nix-python/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:53:59 -0400] "GET /futureproof/unhardwiring-blog-paths-write-read-split/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:54:05 -0400] "GET /futureproof/blind-fanout-model-evaluation-and-flight-recorder/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:54:11 -0400] "GET /futureproof/cartridge-and-codex-zero-dependency-replayability/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:54:17 -0400] "GET / HTTP/1.1" 301 162 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" Accept:"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7" MarkdownServed:0 Host:"guerillatech.com" Sig:"-"
[REDACTED_IP] - - [25/Oct/2026:17:54:17 -0400] "GET /futureproof/chain-of-custody-multi-model-review/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:54:18 -0400] "GET / HTTP/1.1" 200 1275 "http://guerillatech.com" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" Accept:"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7" MarkdownServed:0 Host:"guerillatech.com" Sig:"-"
[REDACTED_IP] - - [25/Oct/2026:17:54:23 -0400] "GET /futureproof/infinite-context-pipeline-narrative-code/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:54:29 -0400] "GET /futureproof/falsifying-the-vibe-deterministic-codebase-upgrades/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:54:35 -0400] "GET /futureproof/immutable-cartridge-nixos-google-drive-pipeline/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:54:41 -0400] "GET /jupyter-notebooks/jupyter-notebook/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:54:47 -0400] "GET /futureproof/forgetting-with-style-replayable-memory-engine/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:54:53 -0400] "GET /futureproof/two-years-four-models-one-verifiable-record/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:54:59 -0400] "GET /futureproof/building-landing-gear-multi-platform-tooling/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:55:05 -0400] "GET /futureproof/the-terminal-is-the-config-mcp-servers/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:55:11 -0400] "GET /futureproof/claude-cowork-linux-vm-hypervisor-gates/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:55:17 -0400] "GET /futureproof/archive-not-artifact-checkable-ai-receipts/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:55:23 -0400] "GET /futureproof/reversible-endosymbiosis-verifiable-ai-workflows/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:55:29 -0400] "GET /futureproof/cartridge-deed-outside-the-envelope/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:55:35 -0400] "GET /futureproof/three-tools-one-pipeline-walk-router-compiler/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:55:41 -0400] "GET /nixos/nixos-rebuild/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:55:47 -0400] "GET /futureproof/navigating-slack-ergonomic-appraisal-age-of-ai/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
=== GUERILLATECH VHOST LOG ===
[REDACTED_IP] - - [25/Oct/2026:17:53:35 -0400] "GET /futureproof/mobilegeddon-aigeddon-sovereign-computing/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:53:41 -0400] "GET /futureproof/openclaw-nixos-claude-opus-4-6-golden-master-test/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:53:47 -0400] "GET /futureproof/ai-strange-loop-not-a-bubble/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:53:53 -0400] "GET /futureproof/browser-api-managing-chrome-bookmarks-nix-python/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:53:59 -0400] "GET /futureproof/unhardwiring-blog-paths-write-read-split/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:54:05 -0400] "GET /futureproof/blind-fanout-model-evaluation-and-flight-recorder/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:54:11 -0400] "GET /futureproof/cartridge-and-codex-zero-dependency-replayability/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:54:17 -0400] "GET /futureproof/chain-of-custody-multi-model-review/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:54:18 -0400] "GET / HTTP/1.1" 200 1275 "http://guerillatech.com" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" Accept:"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7" MarkdownServed:0 Host:"guerillatech.com" Sig:"-"
[REDACTED_IP] - - [25/Oct/2026:17:54:23 -0400] "GET /futureproof/infinite-context-pipeline-narrative-code/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:54:24 -0400] "GET /prompt-engineering-12/ HTTP/2.0" 404 169 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36" Accept:"*/*" MarkdownServed:0 Host:"www.mikelev.in" Sig:"-"
[REDACTED_IP] - - [25/Oct/2026:17:54:29 -0400] "GET /futureproof/falsifying-the-vibe-deterministic-codebase-upgrades/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:54:35 -0400] "GET /futureproof/immutable-cartridge-nixos-google-drive-pipeline/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:54:41 -0400] "GET /jupyter-notebooks/jupyter-notebook/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:54:47 -0400] "GET /futureproof/forgetting-with-style-replayable-memory-engine/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:54:53 -0400] "GET /futureproof/two-years-four-models-one-verifiable-record/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:54:59 -0400] "GET /futureproof/building-landing-gear-multi-platform-tooling/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:55:05 -0400] "GET /futureproof/the-terminal-is-the-config-mcp-servers/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:55:11 -0400] "GET /futureproof/claude-cowork-linux-vm-hypervisor-gates/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:55:17 -0400] "GET /futureproof/archive-not-artifact-checkable-ai-receipts/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:55:23 -0400] "GET /futureproof/reversible-endosymbiosis-verifiable-ai-workflows/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:55:29 -0400] "GET /futureproof/cartridge-deed-outside-the-envelope/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:55:35 -0400] "GET /futureproof/three-tools-one-pipeline-walk-router-compiler/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:55:41 -0400] "GET /nixos/nixos-rebuild/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:17:55:47 -0400] "GET /futureproof/navigating-slack-ergonomic-appraisal-age-of-ai/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
=== MIKELEV.IN REDIRECT MAP CHECK ===
~^/blog/how-to-use-the-screen-command-for-linux-service//?$ /futureproof/duty-cycle-architecture-bot-observatory-nixos/;
~^/prompt-engineering/pipulate/ai-assisted-debugging//?$ /futureproof/ai-assisted-debugging-git-archeology/;
~^/prompt-engineering/pipulate/ai-embodiment/ai-future-proofing//?$ /futureproof/giving-ai-a-body-embodiment-agency/;
~^/prompt-engineering/pipulate/ai-embodiment/llm-inference//?$ /futureproof/the-jello-wobble-ai-embodiment-and-intuitive-machines/;
~^/prompt-engineering/pipulate/ai-embodiment/pipulate//?$ /futureproof/giving-ai-a-body-embodiment-agency/;
~^/prompt-engineering/pipulate/ai-mentorship//?$ /futureproof/ai-facilitating-self-improvement/;
~^/prompt-engineering/pipulate/computational-sovereignty/ai-workflow//?$ /futureproof/the-sovereign-stack-deterministic-ai-pipulate/;
~^/prompt-engineering/pipulate/digital-sovereignty/ai-persistence//?$ /futureproof/master-prompt-chip-otheseus-ai-persistence/;
~^/prompt-engineering/pipulate/foss-ai//?$ /futureproof/software-reimagined-nix-wet-workflows-local-llm/;
~^/prompt-engineering/pipulate/large-context-window//?$ /futureproof/golems-guardrails-ai-enduring-memory/;
~^/prompt-engineering/pipulate/large-context-window/ai-context//?$ /futureproof/context-saturation-semantic-compression-fractal-blog-navigation/;
~^/prompt-engineering/pipulate/large-context-window/ai-on-rails//?$ /futureproof/wright-brothers-ai-on-rails/;
~^/prompt-engineering/pipulate/large-context-window/ai-persistence//?$ /futureproof/golems-guardrails-ai-enduring-memory/;
~^/prompt-engineering/pipulate/llm-context/codex//?$ /futureproof/decoding-ai-a-personal-odyssey-through-models-and-minds/;
~^/prompt-engineering/pipulate/llm-optics-engine/llm-optics-engine//?$ /futureproof/llm-optics-engine-refracting-web-ai/;
~^/prompt-engineering/pipulate/llm-optics-engine/llm//?$ /futureproof/llm-optics-engine-refracting-web-ai/;
~^/prompt-engineering/pipulate/llm/local-ai//?$ /futureproof/local-ai-workflows-jupyter-nix/;
~^/prompt-engineering/pipulate/nix/iterative-development//?$ /futureproof/multiple-passes/;
~^/prompt-engineering/pipulate/nix/llm-architecture//?$ /futureproof/the-center-holds-forever-actualizer-machine/;
~^/prompt-engineering/pipulate/nix/token-efficiency//?$ /futureproof/token-transparency-ai-prompt-generation/;
~^/prompt-engineering/pipulate/nix/wet-coding//?$ /futureproof/wet-code-ai-native-development/;
~^/prompt-engineering/pipulate/nixos/iain-mcgilchrist//?$ /futureproof/the-meeseeks-mirror-ai-humanitys-vaudeville-inoculation/;
~^/prompt-engineering/pipulate/pipulate/ai-mentorship//?$ /futureproof/ai-facilitating-self-improvement/;
~^/prompt-engineering/pipulate/pipulate/ai-nuance//?$ /futureproof/api-ai-human-nuance/;
~^/prompt-engineering/pipulate/pipulate/computing-sovereignty//?$ /futureproof/computing-sovereignty-treatise-with-nix/;
~^/prompt-engineering/pipulate/pipulate/human-ai-synergy//?$ /futureproof/master-ai-emissary-mu-puzzle-digital-corpus-callosum/;
~^/prompt-engineering/pipulate/scenario-engine//?$ /futureproof/optimists-algorithm-sovereignty-symbiosis-scenario-engine/;
(nix) pipulate $
The Smoking Gun Receipt: Why www.mikelev.in Was Serving a Shell Script
2: AFTER (NEXT CONTEXT):
# # Content 1
# context.txt
#
# # WE BEGIN AT THE BEGINNING AND WILL GO ON TILL WE COME TO THE END, THEN STOP.
# ~/repos/nixos/configuration.nix
# ~/repos/nixos/services.nix
# ~/repos/nixos/packages.nix
# ~/repos/nixos/autognome.py
# init.lua
# flake.nix
#
# # HOME-HOSTED (NOT BEHIND CDN) NGINX WEBSERVER HONEYBOT AI OBSERVATORY
# nixops.sh
# remotes/honeybot/hooks/post-receive
# remotes/honeybot/nixos/configuration.nix
# remotes/honeybot/scripts/score.py
# remotes/honeybot/scripts/card.py
# remotes/honeybot/scripts/forest.py
# remotes/honeybot/scripts/test_forest.py
# remotes/honeybot/scripts/logs.py
# remotes/honeybot/scripts/content_loader.py
# remotes/honeybot/scripts/db.py
#
# # THE DATA EVERYONE NEEDS
# remotes/honeybot/queries/trapdoor_ips.sql
# ! echo "--- WHO HYDRATES THE DOM ---" && cat remotes/honeybot/queries/trapdoor_ips.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db'
# remotes/honeybot/queries/content_neg_agents.sql
# ! echo "--- WHO NEGOTIATES MARKDOWN ---" && cat remotes/honeybot/queries/content_neg_agents.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db'
# # Context 2
# context.txt
# remotes/honeybot/nixos/configuration.nix
# remotes/honeybot/scripts/logs.py
# ! ssh honeybot 'cfg=$(ps -eo args | rg -o "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; rg "server_name |default_server" "$cfg"; echo "=== GUERILLATECH LOG HITS ==="; rg "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; rg "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/" ~/www/mikelev.in/_site/redirects.map'
# Context 3
context.txt
remotes/honeybot/nixos/configuration.nix
remotes/honeybot/scripts/logs.py
! ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== GUERILLATECH ACCESS.LOG HITS ==="; grep -E "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== GUERILLATECH VHOST LOG ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; grep -E "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/|/pipulate/nixos/crc32/crc32/|/seo/pipulate/semantic-web/|/nix/nixos/python/initpy/" ~/www/mikelev.in/_site/redirects.map'
3: CHANGE (PATCHES):
None this turn.
4: PROMPT:
Analyze the live nginx.conf listen/server_name output, the guerillatech.com log lines, and the redirects.map matches from Honeybot. Emit the SEARCH/REPLACE patch for remotes/honeybot/nixos/configuration.nix (including ripgrep on honeybot, default_server/alias hygiene on mikelev.in, and any log or redirect cleanup warranted by the evidence).
Gemini 4 Argon High: Context verified.
TL;DR: The live Honeybot receipt confirms both hypotheses and exposes an active traffic-routing leak:
- No
default_serverinnginx.conf(guerillatech.comis first): In/nix/store/1v9yjd4635cr9iwhm0rva0xfhw6n2y50-nginx.conf, none of thelistendirectives carriesdefault_server, andserver_name guerillatech.com [www.guerillatech.com](https://www.guerillatech.com);is emitted first because Nix sorts attribute keys alphabetically (gbeforel,m,n,q,r,s). www.mikelev.inIs Falling Through Intoguerillatech.comand 404ing: Look at line 24 of=== GUERILLATECH VHOST LOG ===(/var/log/nginx/guerillatech.access.log):[REDACTED_IP] - - [25/Oct/2026:17:58:27 -0400] "GET /futureproof/gravity-of-the-mean-ai-code-regression/index.md?src=a+href HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)" Accept:"*/*" MarkdownServed:0 Host:"www.mikelev.in" Sig:"-"
And from your terminal run of the same log:
[REDACTED_IP] - - [25/Oct/2026:17:54:24 -0400] "GET /prompt-engineering-12/ HTTP/2.0" 404 169 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36" Accept:"*/*" MarkdownServed:0 Host:"www.mikelev.in" Sig:"-"
Because virtualHosts."mikelev.in" only declares server_name mikelev.in ; (with no serverAliases for www), every crawler or visitor requesting www.mikelev.in misses mikelev.in, lands in the implicit default server (guerillatech.com), logs to /var/log/nginx/guerillatech.access.log, and gets a 404 against /home/mike/www/guerillatech.com.
- **AhrefsBot’s Queued Crawl Frontier on
guerillatech.com**: BeforevirtualHosts."guerillatech.com"was added today (2026-10-25),guerillatech.com’s DNS A-record already pointed at Honeybot and fell through to the previous default server (mikelev.in).AhrefsBot(Sig:"\x22[https://ahrefs.com](https://ahrefs.com)\x22") crawledmikelev.in’s root-relative links underHost:"guerillatech.com"and is now working through that queue at 1 request every 6 seconds (/futureproof/...and legacy category paths inredirects.mapsuch as/htmx/python/,/pipulate/ai-workflows/, and/nixos/nixos-rebuild/).
What the Patch Below Does
In remotes/honeybot/nixos/configuration.nix:
- **Pins
default = true;andserverAliasesonvirtualHosts."mikelev.in"**: Makesmikelev.inthe explicitdefault_serveron ports80and443regardless of alphabetical vhost naming, and bindswww.mikelev.intomikelev.insowww.mikelev.intraffic stops falling intoguerillatech.com. - Redirects
mikelev.inGhost Paths onguerillatech.com(301->[https://mikelev.in](https://mikelev.in)): InvirtualHosts."guerillatech.com", any request matching$new_uri(fromredirects.map) or^/futureproof/returns a301to[https://mikelev.in](https://mikelev.in), draining AhrefsBot’s poisoned crawl queue back to the canonical host while keepingguerillatech.com’s/door (index.html,index.md,install.sh) untouched. - Installs
ripgrep(rg) on Honeybot: Addsripgreptoenvironment.systemPackagesso SSH probes onhoneybotsupportrg.
1: BEFORE (PROBE)
Run in (nix) pipulate $:
ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== RIPGREP ON HONEYBOT ==="; command -v rg || echo "rg: absent"; echo "=== PROBE WWW.MIKELEV.IN & GUERILLATECH GHOST ==="; curl -skI --resolve www.mikelev.in:443:127.0.0.1 https://www.mikelev.in/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | head -n 5'
2: AFTER (NEXT CONTEXT)
Paste into context.txt (via context or x) for (nix) pipulate $:
context.txt
remotes/honeybot/nixos/configuration.nix
! ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== RIPGREP ON HONEYBOT ==="; command -v rg || echo "rg: absent"; echo "=== PROBE WWW.MIKELEV.IN & GUERILLATECH GHOST ==="; curl -skI --resolve www.mikelev.in:443:127.0.0.1 https://www.mikelev.in/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | head -n 5'
3: CHANGE (PATCHES)
Apply in (nix) pipulate $:
Target: remotes/honeybot/nixos/configuration.nix
[[[SEARCH]]]
sub_filter '__INSTALL_DEFAULT_NAME__' 'guerillatech';
if ($serve_markdown) {
rewrite ^ /index.md break;
}
try_files $npvg_index /index.md =404;
'';
};
locations."/" = {
extraConfig = ''
add_header Vary "Accept" always;
if ($serve_markdown) {
rewrite ^(.*)/$ $1/index.md break;
rewrite ^(.*[^/])$ $1/index.md break;
}
try_files $uri $uri/index.html $uri/index.md =404;
'';
};
[[[DIVIDER]]]
sub_filter '__INSTALL_DEFAULT_NAME__' 'guerillatech';
if ($serve_markdown) {
rewrite ^ /index.md break;
}
try_files $npvg_index /index.md =404;
'';
};
locations."/" = {
extraConfig = ''
add_header Vary "Accept" always;
if ($new_uri) {
return 301 https://mikelev.in$new_uri;
}
if ($uri ~ ^/futureproof/) {
return 301 https://mikelev.in$request_uri;
}
if ($serve_markdown) {
rewrite ^(.*)/$ $1/index.md break;
rewrite ^(.*[^/])$ $1/index.md break;
}
try_files $uri $uri/index.html $uri/index.md =404;
'';
};
[[[REPLACE]]]
Target: remotes/honeybot/nixos/configuration.nix
[[[SEARCH]]]
virtualHosts."mikelev.in" = {
forceSSL = true; # Force all traffic to HTTPS
enableACME = true; # Let's Encrypt magic
[[[DIVIDER]]]
virtualHosts."mikelev.in" = {
default = true; # Explicit default_server on :80 and :443 (beats alphabetical vhost order)
forceSSL = true; # Force all traffic to HTTPS
enableACME = true; # Let's Encrypt magic
serverAliases = [ ("www." + "mikelev.in") ];
[[[REPLACE]]]
Target: remotes/honeybot/nixos/configuration.nix
[[[SEARCH]]]
environment.systemPackages = with pkgs; [
git
tmux
sqlite
alacritty
[[[DIVIDER]]]
environment.systemPackages = with pkgs; [
git
ripgrep
tmux
sqlite
alacritty
[[[REPLACE]]]
Ignition (run in (nix) pipulate $ after patch, app, d, m so the staged config is live on honeybot before compile runs the AFTER probe):
./nixops.sh && ssh -t honeybot 'sudo cp ~/nixos-config-staged/* /etc/nixos/ && sudo nixos-rebuild switch'
4: PROMPT
Copy into prompt.md (via prompt or p) for (nix) pipulate $:
Verify the AFTER receipt from Honeybot confirming that mikelev.in owns default_server and www.mikelev.in, guerillatech.com 301-redirects ghost /futureproof/ and $new_uri requests to https://mikelev.in, and ripgrep is installed on honeybot.
5: DELIVERABLE
mikelev.inownsdefault_serveron ports80and443and serveswww.mikelev.indirectly instead of leakingwww.mikelev.inrequests intoguerillatech.access.log.guerillatech.comreturns301 Moved Permanentlyto[https://mikelev.in](https://mikelev.in)for queued/futureproof/...and$new_urighost paths while continuing to serve its own/door (index.html,index.md,install.sh).rg(ripgrep) is installed in Honeybot’s system PATH.
MikeLev.in:
THE AI-EDIT METHOD
Same commands, run twice, one change between them. Where the readings differ is what the change did; the diff in the middle is the receipt.
1: BEFORE (PROBE):
On branch main
Your branch is up to date with 'origin/main'.
nothing to commit, working tree clean
GIT repo clean. Take BEFORE reading, make CHANGE, record AFTER diff.
(nix) pipulate $ ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== RIPGREP ON HONEYBOT ==="; command -v rg || echo "rg: absent"; echo "=== PROBE WWW.MIKELEV.IN & GUERILLATECH GHOST ==="; curl -skI --resolve www.mikelev.in:443:127.0.0.1 https://www.mikelev.in/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | head -n 5'
=== NGINX CONF: /nix/store/1v9yjd4635cr9iwhm0rva0xfhw6n2y50-nginx.conf ===
listen 0.0.0.0:80 ;
listen [::0]:80 ;
server_name guerillatech.com www.guerillatech.com;
listen 0.0.0.0:443 ssl ;
listen [::0]:443 ssl ;
server_name guerillatech.com www.guerillatech.com;
listen 0.0.0.0:80 ;
listen [::0]:80 ;
server_name levinix.com www.levinix.com;
listen 0.0.0.0:443 ssl ;
listen [::0]:443 ssl ;
server_name levinix.com www.levinix.com;
listen 0.0.0.0:80 ;
listen [::0]:80 ;
server_name levinix.org www.levinix.org;
listen 0.0.0.0:443 ssl ;
listen [::0]:443 ssl ;
server_name levinix.org www.levinix.org;
listen 0.0.0.0:80 ;
listen [::0]:80 ;
server_name levinux.com www.levinux.com;
listen 0.0.0.0:443 ssl ;
listen [::0]:443 ssl ;
server_name levinux.com www.levinux.com;
listen 0.0.0.0:80 ;
listen [::0]:80 ;
server_name mikelev.in ;
listen 0.0.0.0:443 ssl ;
listen [::0]:443 ssl ;
server_name mikelev.in ;
listen 0.0.0.0:80 ;
listen [::0]:80 ;
server_name npvg.org www.npvg.org;
listen 0.0.0.0:443 ssl ;
listen [::0]:443 ssl ;
server_name npvg.org www.npvg.org;
listen 0.0.0.0:80 ;
listen [::0]:80 ;
server_name qamy.ai www.qamy.ai;
listen 0.0.0.0:443 ssl ;
listen [::0]:443 ssl ;
server_name qamy.ai www.qamy.ai;
listen 0.0.0.0:80 ;
listen [::0]:80 ;
server_name rfc9110.org www.rfc9110.org;
listen 0.0.0.0:443 ssl ;
listen [::0]:443 ssl ;
server_name rfc9110.org www.rfc9110.org;
listen 0.0.0.0:80 ;
listen [::0]:80 ;
server_name rfc9111.io www.rfc9111.io;
listen 0.0.0.0:443 ssl ;
listen [::0]:443 ssl ;
server_name rfc9111.io www.rfc9111.io;
listen 0.0.0.0:80 ;
listen [::0]:80 ;
server_name sunpug.io www.sunpug.io;
listen 0.0.0.0:443 ssl ;
listen [::0]:443 ssl ;
server_name sunpug.io www.sunpug.io;
=== RIPGREP ON HONEYBOT ===
rg: absent
=== PROBE WWW.MIKELEV.IN & GUERILLATECH GHOST ===
HTTP/2 200
server: nginx
date: Sun, 25 Oct 2026 22:04:57 GMT
content-type: text/x-shellscript
vary: Accept, User-Agent
HTTP/2 404
server: nginx
date: Sun, 25 Oct 2026 22:04:57 GMT
content-type: text/html
content-length: 146
(nix) pipulate $
2: AFTER (NEXT CONTEXT):
# # Content 1
# context.txt
#
# # WE BEGIN AT THE BEGINNING AND WILL GO ON TILL WE COME TO THE END, THEN STOP.
# ~/repos/nixos/configuration.nix
# ~/repos/nixos/services.nix
# ~/repos/nixos/packages.nix
# ~/repos/nixos/autognome.py
# init.lua
# flake.nix
#
# # HOME-HOSTED (NOT BEHIND CDN) NGINX WEBSERVER HONEYBOT AI OBSERVATORY
# nixops.sh
# remotes/honeybot/hooks/post-receive
# remotes/honeybot/nixos/configuration.nix
# remotes/honeybot/scripts/score.py
# remotes/honeybot/scripts/card.py
# remotes/honeybot/scripts/forest.py
# remotes/honeybot/scripts/test_forest.py
# remotes/honeybot/scripts/logs.py
# remotes/honeybot/scripts/content_loader.py
# remotes/honeybot/scripts/db.py
#
# # THE DATA EVERYONE NEEDS
# remotes/honeybot/queries/trapdoor_ips.sql
# ! echo "--- WHO HYDRATES THE DOM ---" && cat remotes/honeybot/queries/trapdoor_ips.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db'
# remotes/honeybot/queries/content_neg_agents.sql
# ! echo "--- WHO NEGOTIATES MARKDOWN ---" && cat remotes/honeybot/queries/content_neg_agents.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db'
# # Context 2
# context.txt
# remotes/honeybot/nixos/configuration.nix
# remotes/honeybot/scripts/logs.py
# ! ssh honeybot 'cfg=$(ps -eo args | rg -o "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; rg "server_name |default_server" "$cfg"; echo "=== GUERILLATECH LOG HITS ==="; rg "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; rg "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/" ~/www/mikelev.in/_site/redirects.map'
# # Context 3
# context.txt
# remotes/honeybot/nixos/configuration.nix
# remotes/honeybot/scripts/logs.py
# ! ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== GUERILLATECH ACCESS.LOG HITS ==="; grep -E "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== GUERILLATECH VHOST LOG ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; grep -E "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/|/pipulate/nixos/crc32/crc32/|/seo/pipulate/semantic-web/|/nix/nixos/python/initpy/" ~/www/mikelev.in/_site/redirects.map'
# Context 4
context.txt
remotes/honeybot/nixos/configuration.nix
! ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== RIPGREP ON HONEYBOT ==="; command -v rg || echo "rg: absent"; echo "=== PROBE WWW.MIKELEV.IN & GUERILLATECH GHOST ==="; curl -skI --resolve www.mikelev.in:443:127.0.0.1 https://www.mikelev.in/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | head -n 5'
3: CHANGE (PATCHES):
On branch main
Your branch is up to date with 'origin/main'.
nothing to commit, working tree clean
GIT repo clean. Take BEFORE reading, make CHANGE, record AFTER diff.
(nix) pipulate $ patch
(nix) pipulate $ app
✅ DETERMINISTIC PATCH APPLIED: Successfully mutated 'remotes/honeybot/nixos/configuration.nix'.
✅ DETERMINISTIC PATCH APPLIED: Successfully mutated 'remotes/honeybot/nixos/configuration.nix'.
✅ DETERMINISTIC PATCH APPLIED: Successfully mutated 'remotes/honeybot/nixos/configuration.nix'.
(nix) pipulate $ d
diff --git a/remotes/honeybot/nixos/configuration.nix b/remotes/honeybot/nixos/configuration.nix
index f43376a..de61e9b 100644
--- a/remotes/honeybot/nixos/configuration.nix
+++ b/remotes/honeybot/nixos/configuration.nix
@@ -440,6 +440,12 @@
locations."/" = {
extraConfig = ''
add_header Vary "Accept" always;
+ if ($new_uri) {
+ return 301 https://mikelev.in$new_uri;
+ }
+ if ($uri ~ ^/futureproof/) {
+ return 301 https://mikelev.in$request_uri;
+ }
if ($serve_markdown) {
rewrite ^(.*)/$ $1/index.md break;
rewrite ^(.*[^/])$ $1/index.md break;
@@ -612,8 +618,10 @@
};
virtualHosts."mikelev.in" = {
+ default = true; # Explicit default_server on :80 and :443 (beats alphabetical vhost order)
forceSSL = true; # Force all traffic to HTTPS
enableACME = true; # Let's Encrypt magic
+ serverAliases = [ ("www." + "mikelev.in") ];
# The Web Root
root = "/home/mike/www/mikelev.in/_site";
@@ -676,6 +684,7 @@
# $ nix search wget
environment.systemPackages = with pkgs; [
git
+ ripgrep
tmux
sqlite
alacritty
(nix) pipulate $ m
📝 Committing: chore: Refactor virtualHost configuration for honeybot
[main b96f24c] chore: Refactor virtualHost configuration for honeybot
1 file changed, 9 insertions(+)
(nix) pipulate $ git push
Enumerating objects: 11, done.
Counting objects: 100% (11/11), done.
Delta compression using up to 48 threads
Compressing objects: 100% (4/4), done.
Writing objects: 100% (6/6), 713 bytes | 713.00 KiB/s, done.
Total 6 (delta 3), reused 0 (delta 0), pack-reused 0 (from 0)
remote: Resolving deltas: 100% (3/3), completed with 3 local objects.
To github.com:pipulate/pipulate.git
fa79b76..b96f24c main -> main
(nix) pipulate $
Ignition: often “exit”, “nix develop”. Instructions may vary.
On branch main
Your branch is up to date with 'origin/main'.
nothing to commit, working tree clean
GIT repo clean. Take BEFORE reading, make CHANGE, record AFTER diff.
(nix) pipulate $ ./nixops.sh && ssh -t honeybot 'sudo cp ~/nixos-config-staged/* /etc/nixos/ && sudo nixos-rebuild switch'
🚀 Syncing Hooks...
post-receive 100% 3080 595.1KB/s 00:00
🚀 Syncing Scripts (New Location)...
sending incremental file list
deleting __pycache__/content_loader.cpython-313.pyc
__pycache__/
sent 684 bytes received 62 bytes 1,492.00 bytes/sec
total size is 317,322 speedup is 425.36
sending incremental file list
sent 68 bytes received 12 bytes 160.00 bytes/sec
total size is 140,366 speedup is 1,754.58
sending incremental file list
sent 59 bytes received 12 bytes 47.33 bytes/sec
total size is 645,230 speedup is 9,087.75
🚀 Syncing NPvg pad (one address, two bodies)...
sending incremental file list
sent 232 bytes received 16 bytes 496.00 bytes/sec
total size is 5,440 speedup is 21.94
🚀 Syncing qamy.ai door (npvg.org's shape, its own tree)...
sending incremental file list
./
sent 235 bytes received 23 bytes 516.00 bytes/sec
total size is 4,646 speedup is 18.01
🚀 Syncing installer to the home-hosted doors (npvg.org qamy.ai levinix.org sunpug.io guerillatech.com rfc9110.org rfc9111.io)...
sending incremental file list
sent 62 bytes received 12 bytes 148.00 bytes/sec
total size is 25,724 speedup is 347.62
sending incremental file list
sent 62 bytes received 12 bytes 148.00 bytes/sec
total size is 25,724 speedup is 347.62
sending incremental file list
sent 62 bytes received 12 bytes 148.00 bytes/sec
total size is 25,724 speedup is 347.62
sending incremental file list
sent 62 bytes received 12 bytes 148.00 bytes/sec
total size is 25,724 speedup is 347.62
sending incremental file list
sent 62 bytes received 12 bytes 148.00 bytes/sec
total size is 25,724 speedup is 347.62
sending incremental file list
sent 62 bytes received 12 bytes 148.00 bytes/sec
total size is 25,724 speedup is 347.62
sending incremental file list
sent 62 bytes received 12 bytes 148.00 bytes/sec
total size is 25,724 speedup is 347.62
🧠 Syncing 2nd Brain archive (brain.zip) to qamy.ai and mikelev.in...
sending incremental file list
sent 62 bytes received 12 bytes 148.00 bytes/sec
total size is 46,809,534 speedup is 632,561.27
🚀 Syncing levinux.com deck (remark.js HTML + RFC 9110 index.md)...
sending incremental file list
sent 203 bytes received 12 bytes 430.00 bytes/sec
total size is 720,316 speedup is 3,350.31
sending incremental file list
sent 93 bytes received 12 bytes 210.00 bytes/sec
total size is 3,964 speedup is 37.75
🚀 Syncing sunpug.io door...
sending incremental file list
sent 100 bytes received 12 bytes 224.00 bytes/sec
total size is 4,791 speedup is 42.78
🚀 Syncing guerillatech.com door...
sending incremental file list
sent 92 bytes received 12 bytes 69.33 bytes/sec
total size is 3,755 speedup is 36.11
🚀 Syncing rfc9110.org door...
sending incremental file list
sent 92 bytes received 12 bytes 208.00 bytes/sec
total size is 3,558 speedup is 34.21
🚀 Syncing rfc9111.io door...
sending incremental file list
sent 92 bytes received 12 bytes 208.00 bytes/sec
total size is 3,729 speedup is 35.86
🚀 Syncing NixOS Config...
sending incremental file list
configuration.nix
sent 2,796 bytes received 329 bytes 2,083.33 bytes/sec
total size is 34,575 speedup is 11.06
✅ Sync Complete.
To apply NixOS config: ssh -t mike@[REDACTED_IP] 'sudo cp ~/nixos-config-staged/* /etc/nixos/ && sudo nixos-rebuild switch'
[sudo] password for mike:
Sorry, try again.
[sudo] password for mike:
building the system configuration...
evaluation warning: The option `services.logind.lidSwitchExternalPower' defined in `/etc/nixos/configuration.nix' has been renamed to `services.logind.settings.Login.HandleLidSwitchExternalPower'.
evaluation warning: The option `services.logind.lidSwitch' defined in `/etc/nixos/configuration.nix' has been renamed to `services.logind.settings.Login.HandleLidSwitch'.
evaluation warning: The option `services.xserver.displayManager.gdm.wayland' defined in `/etc/nixos/configuration.nix' has been renamed to `services.displayManager.gdm.wayland'.
evaluation warning: The option `services.xserver.displayManager.gdm.enable' defined in `/etc/nixos/configuration.nix' has been renamed to `services.displayManager.gdm.enable'.
these 20 derivations will be built:
/nix/store/8pz08gaq06xaj1c7yd7bv6x7g3h9w1w3-system-path.drv
/nix/store/c67b1sj6acils7kjsnz3rgwsdal3qfvi-dbus-1.drv
/nix/store/7n2shrynf4f6wbysqfn1yianvy6i6xxh-X-Restart-Triggers-acme-mikelev.in.drv
/nix/store/ncn57npkjajlh9hxgmfzrlwlrn8f1ifa-unit-script-acme-mikelev.in-start.drv
/nix/store/63g4qr1gji2l84vzrg84k72q6nihyhzn-unit-acme-mikelev.in.service.drv
/nix/store/aqfgim3pww8b0sbivgpi61b6gdv0wnyl-nginx.conf.drv
/nix/store/5kayha8853nrhbxkskrq14i284kc5qbv-unit-script-nginx-pre-start.drv
/nix/store/9dq9d05xavqlfw922d4f4nx8d8p2dln7-unit-nginx.service.drv
/nix/store/90l30n6625px6252w63vk57cgqb4j1y4-X-Restart-Triggers-dbus.drv
/nix/store/aqqdhmkfcrww0ahkybqq104n613q3gij-unit-dbus.service.drv
/nix/store/4kj62vzz5xpbal7w6m8i2229wpkwd6na-unit-script-acme-order-renew-mikelev.in-start.drv
/nix/store/ri3wg5hd4x2mawlzj9vv6vzpjb1s01hg-unit-acme-order-renew-mikelev.in.service.drv
/nix/store/dlkgzic9ji5z146fbspg9fk5z3hnpmmh-X-Restart-Triggers-polkit.drv
/nix/store/wr6h0h2ibzf8x4qgrngw2kbgq7d1zz0h-unit-polkit.service.drv
/nix/store/yrvdb3mjjkx7hmiwn2785adhahnf79xl-unit-accounts-daemon.service.drv
/nix/store/ciaj8fpvgna3g21l4lvqlgs7bclfy26s-system-units.drv
/nix/store/1bcfcrx9r0kzlgr6rawy5blp8gxv7j6s-unit-dbus.service.drv
/nix/store/qzdhk80g3hjxyrcqalcs8f5a53zjl3h7-user-units.drv
/nix/store/0afbncfl7zz9cmpb1prw9dnhq8jnvzhi-etc.drv
/nix/store/nswq52vj0n7yfc1ig0w373nnn4ljklfs-nixos-system-honeybot-26.05pre913595.c6245e83d836.drv
this path will be fetched (1.54 MiB download, 6.42 MiB unpacked):
/nix/store/2fngznir58zqpvg2wl7iy5amlsbzhf9p-ripgrep-15.1.0
copying path '/nix/store/2fngznir58zqpvg2wl7iy5amlsbzhf9p-ripgrep-15.1.0' from 'https://cache.nixos.org'...
building '/nix/store/7n2shrynf4f6wbysqfn1yianvy6i6xxh-X-Restart-Triggers-acme-mikelev.in.drv'...
building '/nix/store/aqfgim3pww8b0sbivgpi61b6gdv0wnyl-nginx.conf.drv'...
building '/nix/store/ncn57npkjajlh9hxgmfzrlwlrn8f1ifa-unit-script-acme-mikelev.in-start.drv'...
building '/nix/store/4kj62vzz5xpbal7w6m8i2229wpkwd6na-unit-script-acme-order-renew-mikelev.in-start.drv'...
building '/nix/store/8pz08gaq06xaj1c7yd7bv6x7g3h9w1w3-system-path.drv'...
building '/nix/store/63g4qr1gji2l84vzrg84k72q6nihyhzn-unit-acme-mikelev.in.service.drv'...
building '/nix/store/ri3wg5hd4x2mawlzj9vv6vzpjb1s01hg-unit-acme-order-renew-mikelev.in.service.drv'...
[context] INFO Can't find variable 'new_uri'
[context] INFO Can't find variable 'new_uri'
==================== Results ===================
No issues found.
==================== Summary ===================
Total issues:
Unspecified: 0
Low: 0
Medium: 0
High: 0
building '/nix/store/5kayha8853nrhbxkskrq14i284kc5qbv-unit-script-nginx-pre-start.drv'...
building '/nix/store/9dq9d05xavqlfw922d4f4nx8d8p2dln7-unit-nginx.service.drv'...
created 9768 symlinks in user environment
gtk-update-icon-cache: Cache file created successfully.
building '/nix/store/dlkgzic9ji5z146fbspg9fk5z3hnpmmh-X-Restart-Triggers-polkit.drv'...
building '/nix/store/c67b1sj6acils7kjsnz3rgwsdal3qfvi-dbus-1.drv'...
building '/nix/store/yrvdb3mjjkx7hmiwn2785adhahnf79xl-unit-accounts-daemon.service.drv'...
building '/nix/store/wr6h0h2ibzf8x4qgrngw2kbgq7d1zz0h-unit-polkit.service.drv'...
building '/nix/store/90l30n6625px6252w63vk57cgqb4j1y4-X-Restart-Triggers-dbus.drv'...
building '/nix/store/1bcfcrx9r0kzlgr6rawy5blp8gxv7j6s-unit-dbus.service.drv'...
building '/nix/store/aqqdhmkfcrww0ahkybqq104n613q3gij-unit-dbus.service.drv'...
building '/nix/store/qzdhk80g3hjxyrcqalcs8f5a53zjl3h7-user-units.drv'...
building '/nix/store/ciaj8fpvgna3g21l4lvqlgs7bclfy26s-system-units.drv'...
building '/nix/store/0afbncfl7zz9cmpb1prw9dnhq8jnvzhi-etc.drv'...
building '/nix/store/nswq52vj0n7yfc1ig0w373nnn4ljklfs-nixos-system-honeybot-26.05pre913595.c6245e83d836.drv'...
stopping the following units: accounts-daemon.service, acme-mikelev.in.service
activating the configuration...
setting up /etc...
reloading user units for mike...
restarting sysinit-reactivation.target
reloading the following units: dbus.service
restarting the following units: nginx.service, polkit.service
starting the following units: accounts-daemon.service, acme-mikelev.in.service
the following new units were started: acme-order-renew-mikelev.in.service, NetworkManager-dispatcher.service
Done. The new configuration is /nix/store/akbs7qmc3j8pg1s3kdw3d94hh18ci5ya-nixos-system-honeybot-26.05pre913595.c6245e83d836
Connection to [REDACTED_IP] closed.
(nix) pipulate $
4: PROMPT:
Verify the AFTER receipt from Honeybot confirming that mikelev.in owns default_server and www.mikelev.in, guerillatech.com 301-redirects ghost /futureproof/ and $new_uri requests to https://mikelev.in, and ripgrep is installed on honeybot.
5: DELIVERABLE:
Wow, okay that nixops upgrade happened and it really has nothing to do with the slide show. I might want to wait a few minutes for the new log file information under the new Nix infrastructure to have a chance to make a difference on the logging of the information coming in before I compile the context.
Just as a reminder for people following along, or trying to, the Context Compiler has a static reading of the “before” conditions that you see above. It also has a test set up to take those readings again as the “after” conditions of the test being conducted.
The test started being conducted the moment I did that ignition and so the longer I kill time typing here explaining, the better the data that will have accumulated in the log file for the second test when I lift this article up again with a Hi-Ya! and compile.
Okay, that’s long enough. Let’s see.
Gemini?
Gemini 4 Argon High: Context verified.
TL;DR: All three changes in remotes/honeybot/nixos/configuration.nix are verified by the BEFORE/AFTER straddle in this compile:
- The Smoking Gun in the
www.mikelev.inBEFORE Receipt: Look at whatcurl -skI --resolve www.mikelev.in:443:127.0.0.1 [https://www.mikelev.in/](https://www.mikelev.in/)returned before vs. after the patch: ```text BEFORE (22:04:57 GMT): HTTP/2 200 content-type: text/x-shellscript vary: Accept, User-Agent
AFTER (22:11:48 GMT): HTTP/2 200 content-type: text/html content-length: 28959
Before the patch, a `curl` to `[https://www.mikelev.in/](https://www.mikelev.in/)` fell through to the alphabetical first vhost (`guerillatech.com`), matched `~*^curl`, and served `guerillatech`'s `install.sh` (`text/x-shellscript`). After the patch, `server_name mikelev.in www.mikelev.in;` and `default_server` on `:80` and `:443` are live in `/nix/store/rjjv2lfnvk5fp8jdy81qzrjbixzsd380-nginx.conf` (with Let's Encrypt automatically updating the cert via `acme-order-renew-mikelev.in.service`), and `[https://www.mikelev.in/](https://www.mikelev.in/)` serves the 28,959-byte `mikelev.in` homepage.
2. **Ghost Paths on `guerillatech.com` Flip from `404` to `301**`:
* **BEFORE**: `[https://guerillatech.com/futureproof/the-door-names-the-folder/](https://guerillatech.com/futureproof/the-door-names-the-folder/)` returned `HTTP/2 404` (`content-length: 146`).
* **AFTER**: Returns `HTTP/2 301` (`content-length: 162`), redirecting AhrefsBot's queued crawl frontier to `[https://mikelev.in](https://mikelev.in)`.
3. **`ripgrep` on Honeybot**:
* **BEFORE**: `rg: absent`
* **AFTER**: `/run/current-system/sw/bin/rg` (`ripgrep-15.1.0`).
### Why the Live Log Tail Didn't Appear in This Compile
In `context.txt`, `Context 3` (which tailed `guerillatech.access.log`) was commented out when `Context 4` (which ran the `nginx.conf` + `curl` check) was added. Now that `rg` is installed on `honeybot` and traffic has accumulated since the `18:11` EDT switchover, the read-only probe below uses `rg` on `honeybot` to capture:
* the post-switch `301` stream in `/var/log/nginx/guerillatech.access.log`,
* confirmation that `Host:"www.mikelev.in"` no longer lands in `guerillatech.access.log`, and
* a check across all other `*.access.log` door files for any `/futureproof/` 404s.
---
### **1: BEFORE** (PROBE)
Run in `(nix) pipulate $`:
```bash
ssh honeybot 'echo "=== GUERILLATECH VHOST LOG (LAST 25) ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== REDIRECT LOCATION HEADER CHECK ==="; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | rg -i "^(HTTP/|location:)"; echo "=== OTHER DOOR LOGS WITH /futureproof/ HITS ==="; rg -c "/futureproof/" /var/log/nginx/*.access.log || true'
2: AFTER (NEXT CONTEXT)
Paste into context.txt (via context or x) for (nix) pipulate $:
context.txt
remotes/honeybot/nixos/configuration.nix
! ssh honeybot 'echo "=== GUERILLATECH VHOST LOG (LAST 25) ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== REDIRECT LOCATION HEADER CHECK ==="; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | rg -i "^(HTTP/|location:)"; echo "=== OTHER DOOR LOGS WITH /futureproof/ HITS ==="; rg -c "/futureproof/" /var/log/nginx/*.access.log || true'
3: CHANGE (PATCHES)
No repo patches required on this turn. No ignition required.
4: PROMPT
Copy into prompt.md (via prompt or p) for (nix) pipulate $:
Inspect the post-switch guerillatech.access.log tail and the cross-door /futureproof/ hit counts from Honeybot. If any other door domain has queued /futureproof/ 404s, emit the SEARCH/REPLACE patch; otherwise confirm the system is clean and ready to dismount.
5: DELIVERABLE
- Live log receipt from
/var/log/nginx/guerillatech.access.logshowingAhrefsBotreceiving301s instead of404s andwww.mikelev.inno longer leaking intoguerillatech.access.log. - Cross-door census of
/var/log/nginx/*.access.logconfirming whether any other door vhost needs the same ghost-redirect guard before dismounting.
MikeLev.in: Was there anything else I was supposed to do?
Look at the screenshot I just took.
THE AI-EDIT METHOD
Same commands, run twice, one change between them. Where the readings differ is what the change did; the diff in the middle is the receipt.
1: BEFORE (PROBE):
On branch main
Your branch is up to date with 'origin/main'.
nothing to commit, working tree clean
GIT repo clean. Take BEFORE reading, make CHANGE, record AFTER diff.
(nix) pipulate $ ssh honeybot 'echo "=== GUERILLATECH VHOST LOG (LAST 25) ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== REDIRECT LOCATION HEADER CHECK ==="; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | rg -i "^(HTTP/|location:)"; echo "=== OTHER DOOR LOGS WITH /futureproof/ HITS ==="; rg -c "/futureproof/" /var/log/nginx/*.access.log || true'
=== GUERILLATECH VHOST LOG (LAST 25) ===
[REDACTED_IP] - - [25/Oct/2026:18:17:12 -0400] "GET /nixos/forever-machine/nix/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:17:23 -0400] "GET /nix/nix-flakes/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:17:34 -0400] "GET /pipulate/jupyter-notebooks/jupyter-notebooks/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:17:45 -0400] "GET /nix/context-engineering/ai-test-automation/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:17:56 -0400] "GET /jekyll/jekyll/awk/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:18:07 -0400] "GET /nix/pipulate/pipulate/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:18:18 -0400] "GET /pipulate/jupyter-notebooks/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:18:29 -0400] "GET /nixos/web-scraping/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:18:40 -0400] "GET /nix/nix/python-packaging/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:18:51 -0400] "GET /prompt-engineering/nix/ai-workflows/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:19:02 -0400] "GET /jupyter-notebooks/code-refactoring/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:19:13 -0400] "GET /pipulate/pipulate/model-context-protocol-mcp/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
127.0.0.1 - - [25/Oct/2026:18:19:14 -0400] "HEAD /futureproof/the-door-names-the-folder/ HTTP/2.0" 301 0 "-" "curl/8.17.0" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"-"
[REDACTED_IP] - - [25/Oct/2026:18:19:24 -0400] "GET /nix/nixos/tts/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:19:35 -0400] "GET /nix-flakes/nixos/unix/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:19:46 -0400] "GET /nix/nixos/pandas/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:19:57 -0400] "GET /prompt-engineering/pipulate/model-context-protocol-mcp/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:20:08 -0400] "GET /prompt-engineering/pipulate/ai-tool-calling/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:20:19 -0400] "GET /nix/nixos/idempotency/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:20:30 -0400] "GET /nix/nixos/accessibility-tree/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:20:41 -0400] "GET /nix/context-engineering/master-prompt/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:20:52 -0400] "GET /nix/jupyter-notebooks/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:21:03 -0400] "GET /nixos/nixos-rebuild/generations/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:21:14 -0400] "GET /nix/deterministic-patching/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:21:24 -0400] "GET /python/future-proofing/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
=== REDIRECT LOCATION HEADER CHECK ===
HTTP/2 301
location: https://mikelev.in/futureproof/the-door-names-the-folder/
=== OTHER DOOR LOGS WITH /futureproof/ HITS ===
/var/log/nginx/guerillatech.access.log:1699
/var/log/nginx/levinix.access.log:321
(nix) pipulate $
2: AFTER (NEXT CONTEXT):
# # Content 1
# context.txt
#
# # WE BEGIN AT THE BEGINNING AND WILL GO ON TILL WE COME TO THE END, THEN STOP.
# ~/repos/nixos/configuration.nix
# ~/repos/nixos/services.nix
# ~/repos/nixos/packages.nix
# ~/repos/nixos/autognome.py
# init.lua
# flake.nix
#
# # HOME-HOSTED (NOT BEHIND CDN) NGINX WEBSERVER HONEYBOT AI OBSERVATORY
# nixops.sh
# remotes/honeybot/hooks/post-receive
# remotes/honeybot/nixos/configuration.nix
# remotes/honeybot/scripts/score.py
# remotes/honeybot/scripts/card.py
# remotes/honeybot/scripts/forest.py
# remotes/honeybot/scripts/test_forest.py
# remotes/honeybot/scripts/logs.py
# remotes/honeybot/scripts/content_loader.py
# remotes/honeybot/scripts/db.py
#
# # THE DATA EVERYONE NEEDS
# remotes/honeybot/queries/trapdoor_ips.sql
# ! echo "--- WHO HYDRATES THE DOM ---" && cat remotes/honeybot/queries/trapdoor_ips.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db'
# remotes/honeybot/queries/content_neg_agents.sql
# ! echo "--- WHO NEGOTIATES MARKDOWN ---" && cat remotes/honeybot/queries/content_neg_agents.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db'
# # Context 2
# context.txt
# remotes/honeybot/nixos/configuration.nix
# remotes/honeybot/scripts/logs.py
# ! ssh honeybot 'cfg=$(ps -eo args | rg -o "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; rg "server_name |default_server" "$cfg"; echo "=== GUERILLATECH LOG HITS ==="; rg "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; rg "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/" ~/www/mikelev.in/_site/redirects.map'
# # Context 3
# context.txt
# remotes/honeybot/nixos/configuration.nix
# remotes/honeybot/scripts/logs.py
# ! ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== GUERILLATECH ACCESS.LOG HITS ==="; grep -E "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== GUERILLATECH VHOST LOG ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; grep -E "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/|/pipulate/nixos/crc32/crc32/|/seo/pipulate/semantic-web/|/nix/nixos/python/initpy/" ~/www/mikelev.in/_site/redirects.map'
# # Context 4
# context.txt
# remotes/honeybot/nixos/configuration.nix
# ! ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== RIPGREP ON HONEYBOT ==="; command -v rg || echo "rg: absent"; echo "=== PROBE WWW.MIKELEV.IN & GUERILLATECH GHOST ==="; curl -skI --resolve www.mikelev.in:443:127.0.0.1 https://www.mikelev.in/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | head -n 5'
# Context 5
context.txt
remotes/honeybot/nixos/configuration.nix
! ssh honeybot 'echo "=== GUERILLATECH VHOST LOG (LAST 25) ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== REDIRECT LOCATION HEADER CHECK ==="; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | rg -i "^(HTTP/|location:)"; echo "=== OTHER DOOR LOGS WITH /futureproof/ HITS ==="; rg -c "/futureproof/" /var/log/nginx/*.access.log || true'
3: CHANGE (PATCHES):
None this turn.
Ignition: often “exit”, “nix develop”. Instructions may vary.
Inspect the post-switch guerillatech.access.log tail and the cross-door /futureproof/ hit counts from Honeybot. If any other door domain has queued /futureproof/ 404s, emit the SEARCH/REPLACE patch; otherwise confirm the system is clean and ready to dismount.
5: DELIVERABLE:
It looks like the same problem is going on. Is there any way to flush it like maybe it’s some cache. Or are we missing something?
Remote Crawler Queues vs. Local Caches: Catching Legacy Category Ghosts
Gemini 4 Argon High: Context verified.
TL;DR: You are seeing two things in the new screenshots:
- Why
AhrefsBotkeeps requestingguerillatech.comURLs (No local cache—it is Ahrefs’ remote crawl queue): ThoseGETrequests are arriving live over the Internet from Ahrefs’ crawler cluster (51.68.*,54.37.*,92.222.*,37.59.*,176.31.*,5.39.*,94.23.*) at 1 request every ~11 seconds. Whileguerillatech.com(andlevinix.org, which has321hits in/var/log/nginx/levinix.access.log) pointed at Honeybot’s IP before theirvirtualHostsblocks existed, Nginx servedmikelev.in’s site as the default server. AhrefsBot ingestedmikelev.in’s internal links under[https://guerillatech.com/](https://guerillatech.com/)...into Ahrefs’ own database. There is no cache on Honeybot to flush; AhrefsBot simply drains its remote queue by requesting each URL and updating its index when it receives a301. - What we missed in the first redirect rule (
/futureproof/vs. legacy category paths):- Look at your second screenshot at
[18:21:33]:/futureproof/the-door-names-the-folder/returned[301]in white, and zero/futureproof/URLs have 404’d onguerillatech.comsince the rebuild.
- Look at your second screenshot at
- Every remaining red
[404]onguerillatech.comin your screenshots (/pipulate/pipulate/model-context-protocol-mcp/,/nix/nixos/tts/,/nix/nixos/pandas/,/prompt-engineering/pipulate/ai-tool-calling/,/nix/nixos/nbstripout/,/nixos/nix-flakes/,/htmx/nix-flakes/websockets/) is an older category-style path that neither starts with/futureproof/nor exists inredirects.mapyet (noticemikelev.inis also 404ing on those same legacy category patterns at[18:19:35],[18:19:43],[18:20:02],[18:21:38], and[18:23:07]).
WHY THOSE PATHS STILL 404'D ON GUERILLATECH.COM:
GET /futureproof/... ──► matched ^/futureproof/ ──► 301 to mikelev.in (FIXED)
GET /nix/nixos/nbstripout/ ──► not ^/futureproof/, not in redirects.map
──► fell through to guerillatech try_files =404 (MISSED)
THE FIX FOR SINGLE-PAGE DOORS (guerillatech, levinix, npvg, qamy, rfc9110, rfc9111, sunpug):
GET / ──► locations."= /" serves index.html / index.md / install.sh (200)
GET /index.html, /index.md, /install.sh ─► file exists in door root (-e $request_filename) (200)
GET <any non-existent path on door> ──► if ($new_uri) ──► 301 https://mikelev.in$new_uri
──► if (!-e $request_filename) ─► 301 https://mikelev.in$request_uri
Replacing if ($uri ~ ^/futureproof/) with if (!-e $request_filename) across the single-page doors means any path that is not a real file in /home/mike/www/<door> immediately returns 301 to [https://mikelev.in](https://mikelev.in) (using $new_uri if it is in redirects.map, or $request_uri otherwise).
1: BEFORE (PROBE)
Run in (nix) pipulate $:
ssh honeybot 'echo "=== LEGACY CATEGORY PATH ON GUERILLATECH & LEVINIX ==="; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/nix/nixos/nbstripout/ | rg -i "^(HTTP/|location:)"; curl -skI --resolve levinix.org:443:127.0.0.1 https://levinix.org/futureproof/the-door-names-the-folder/ | rg -i "^(HTTP/|location:)"; echo "=== DOOR ROOT 200 CHECK ==="; curl -skI -A "Mozilla/5.0" --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/ | head -n 5'
2: AFTER (NEXT CONTEXT)
Paste into context.txt (via context or x) for (nix) pipulate $:
context.txt
remotes/honeybot/nixos/configuration.nix
! ssh honeybot 'echo "=== LEGACY CATEGORY PATH ON GUERILLATECH & LEVINIX ==="; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/nix/nixos/nbstripout/ | rg -i "^(HTTP/|location:)"; curl -skI --resolve levinix.org:443:127.0.0.1 https://levinix.org/futureproof/the-door-names-the-folder/ | rg -i "^(HTTP/|location:)"; echo "=== DOOR ROOT 200 CHECK ==="; curl -skI -A "Mozilla/5.0" --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/ | head -n 5'
3: CHANGE (PATCHES)
Apply in (nix) pipulate $:
Target: remotes/honeybot/nixos/configuration.nix
[[[SEARCH]]]
locations."/" = {
extraConfig = ''
try_files $uri $uri/index.html =404;
'';
};
};
# THE QAMY DOOR (2026-09-29). npvg.org's door with its name and alias,
[[[DIVIDER]]]
locations."/" = {
extraConfig = ''
if ($new_uri) {
return 301 https://mikelev.in$new_uri;
}
if (!-e $request_filename) {
return 301 https://mikelev.in$request_uri;
}
try_files $uri $uri/index.html =404;
'';
};
};
# THE QAMY DOOR (2026-09-29). npvg.org's door with its name and alias,
[[[REPLACE]]]
Target: remotes/honeybot/nixos/configuration.nix
[[[SEARCH]]]
locations."/" = {
extraConfig = ''
try_files $uri $uri/index.html =404;
'';
};
};
# THE LEVINIX DOOR (2026-10-21): Target 4 in blogs.nix (WORA Nix Flake
[[[DIVIDER]]]
locations."/" = {
extraConfig = ''
if ($new_uri) {
return 301 https://mikelev.in$new_uri;
}
if (!-e $request_filename) {
return 301 https://mikelev.in$request_uri;
}
try_files $uri $uri/index.html =404;
'';
};
};
# THE LEVINIX DOOR (2026-10-21): Target 4 in blogs.nix (WORA Nix Flake
[[[REPLACE]]]
Target: remotes/honeybot/nixos/configuration.nix
[[[SEARCH]]]
locations."/" = {
extraConfig = ''
add_header Vary "Accept" always;
if ($serve_markdown) {
rewrite ^(.*)/$ $1/index.md break;
rewrite ^(.*[^/])$ $1/index.md break;
}
try_files $uri $uri/index.html $uri/index.md =404;
'';
};
};
# THE GUERILLATECH DOOR (2026-10-25): Target 5 in blogs.nix (Nix vs. Docker
[[[DIVIDER]]]
locations."/" = {
extraConfig = ''
add_header Vary "Accept" always;
if ($new_uri) {
return 301 https://mikelev.in$new_uri;
}
if (!-e $request_filename) {
return 301 https://mikelev.in$request_uri;
}
if ($serve_markdown) {
rewrite ^(.*)/$ $1/index.md break;
rewrite ^(.*[^/])$ $1/index.md break;
}
try_files $uri $uri/index.html $uri/index.md =404;
'';
};
};
# THE GUERILLATECH DOOR (2026-10-25): Target 5 in blogs.nix (Nix vs. Docker
[[[REPLACE]]]
Target: remotes/honeybot/nixos/configuration.nix
[[[SEARCH]]]
locations."/" = {
extraConfig = ''
add_header Vary "Accept" always;
if ($new_uri) {
return 301 https://mikelev.in$new_uri;
}
if ($uri ~ ^/futureproof/) {
return 301 https://mikelev.in$request_uri;
}
if ($serve_markdown) {
rewrite ^(.*)/$ $1/index.md break;
rewrite ^(.*[^/])$ $1/index.md break;
}
try_files $uri $uri/index.html $uri/index.md =404;
'';
};
};
# THE RFC 9110 DOOR (2026-10-25): Target 6 in blogs.nix (Proactive HTTP
[[[DIVIDER]]]
locations."/" = {
extraConfig = ''
add_header Vary "Accept" always;
if ($new_uri) {
return 301 https://mikelev.in$new_uri;
}
if (!-e $request_filename) {
return 301 https://mikelev.in$request_uri;
}
if ($serve_markdown) {
rewrite ^(.*)/$ $1/index.md break;
rewrite ^(.*[^/])$ $1/index.md break;
}
try_files $uri $uri/index.html $uri/index.md =404;
'';
};
};
# THE RFC 9110 DOOR (2026-10-25): Target 6 in blogs.nix (Proactive HTTP
[[[REPLACE]]]
Target: remotes/honeybot/nixos/configuration.nix
[[[SEARCH]]]
locations."/" = {
extraConfig = ''
add_header Vary "Accept" always;
if ($serve_markdown) {
rewrite ^(.*)/$ $1/index.md break;
rewrite ^(.*[^/])$ $1/index.md break;
}
try_files $uri $uri/index.html $uri/index.md =404;
'';
};
};
# THE RFC 9111 DOOR (2026-10-25): Target 7 in blogs.nix (Retiring wasteful
[[[DIVIDER]]]
locations."/" = {
extraConfig = ''
add_header Vary "Accept" always;
if ($new_uri) {
return 301 https://mikelev.in$new_uri;
}
if (!-e $request_filename) {
return 301 https://mikelev.in$request_uri;
}
if ($serve_markdown) {
rewrite ^(.*)/$ $1/index.md break;
rewrite ^(.*[^/])$ $1/index.md break;
}
try_files $uri $uri/index.html $uri/index.md =404;
'';
};
};
# THE RFC 9111 DOOR (2026-10-25): Target 7 in blogs.nix (Retiring wasteful
[[[REPLACE]]]
Target: remotes/honeybot/nixos/configuration.nix
[[[SEARCH]]]
locations."/" = {
extraConfig = ''
add_header Vary "Accept" always;
if ($serve_markdown) {
rewrite ^(.*)/$ $1/index.md break;
rewrite ^(.*[^/])$ $1/index.md break;
}
try_files $uri $uri/index.html $uri/index.md =404;
'';
};
};
# THE SUNPUG DOOR (2026-10-24): SVNPvg -> SUNPug (the friendly vampire /
[[[DIVIDER]]]
locations."/" = {
extraConfig = ''
add_header Vary "Accept" always;
if ($new_uri) {
return 301 https://mikelev.in$new_uri;
}
if (!-e $request_filename) {
return 301 https://mikelev.in$request_uri;
}
if ($serve_markdown) {
rewrite ^(.*)/$ $1/index.md break;
rewrite ^(.*[^/])$ $1/index.md break;
}
try_files $uri $uri/index.html $uri/index.md =404;
'';
};
};
# THE SUNPUG DOOR (2026-10-24): SVNPvg -> SUNPug (the friendly vampire /
[[[REPLACE]]]
Target: remotes/honeybot/nixos/configuration.nix
[[[SEARCH]]]
locations."/" = {
extraConfig = ''
add_header Vary "Accept" always;
if ($serve_markdown) {
rewrite ^(.*)/$ $1/index.md break;
rewrite ^(.*[^/])$ $1/index.md break;
}
try_files $uri $uri/index.html $uri/index.md =404;
'';
};
};
# THE LEVINIX.COM REDIRECT (2026-10-23): Retires the .com in favor of the
[[[DIVIDER]]]
locations."/" = {
extraConfig = ''
add_header Vary "Accept" always;
if ($new_uri) {
return 301 https://mikelev.in$new_uri;
}
if (!-e $request_filename) {
return 301 https://mikelev.in$request_uri;
}
if ($serve_markdown) {
rewrite ^(.*)/$ $1/index.md break;
rewrite ^(.*[^/])$ $1/index.md break;
}
try_files $uri $uri/index.html $uri/index.md =404;
'';
};
};
# THE LEVINIX.COM REDIRECT (2026-10-23): Retires the .com in favor of the
[[[REPLACE]]]
Ignition (run in (nix) pipulate $ after patch, app, d, m so the updated door rules activate on honeybot before compile):
./nixops.sh && ssh -t honeybot 'sudo cp ~/nixos-config-staged/* /etc/nixos/ && sudo nixos-rebuild switch'
4: PROMPT
Copy into prompt.md (via prompt or p) for (nix) pipulate $:
Verify the AFTER receipt confirming that legacy category paths like /nix/nixos/nbstripout/ on guerillatech.com and /futureproof/ paths on levinix.org now return 301 to https://mikelev.in while root door requests (HTML and curl installer) continue to return 200 OK.
5: DELIVERABLE
- Every non-existent path on all seven single-page doors (
npvg.org,qamy.ai,levinix.org,guerillatech.com,rfc9110.org,rfc9111.io,sunpug.io)—including legacy category paths like/nix/nixos/nbstripout/and/prompt-engineering/pipulate/ai-tool-calling/—returns301 Moved Permanentlyto[https://mikelev.in](https://mikelev.in)instead of404on the door domain. - Root door requests (
/for HTML,Accept: text/markdown, andcurlinstaller) continue returning200 OK.
MikeLev.in:
THE AI-EDIT METHOD
Same commands, run twice, one change between them. Where the readings differ is what the change did; the diff in the middle is the receipt.
1: BEFORE (PROBE):
On branch main
Your branch is up to date with 'origin/main'.
nothing to commit, working tree clean
GIT repo clean. Take BEFORE reading, make CHANGE, record AFTER diff.
(nix) pipulate $ ssh honeybot 'echo "=== LEGACY CATEGORY PATH ON GUERILLATECH & LEVINIX ==="; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/nix/nixos/nbstripout/ | rg -i "^(HTTP/|location:)"; curl -skI --resolve levinix.org:443:127.0.0.1 https://levinix.org/futureproof/the-door-names-the-folder/ | rg -i "^(HTTP/|location:)"; echo "=== DOOR ROOT 200 CHECK ==="; curl -skI -A "Mozilla/5.0" --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/ | head -n 5'
=== LEGACY CATEGORY PATH ON GUERILLATECH & LEVINIX ===
HTTP/2 404
HTTP/2 404
=== DOOR ROOT 200 CHECK ===
HTTP/2 200
server: nginx
date: Sun, 25 Oct 2026 22:31:53 GMT
content-type: text/html
vary: Accept-Encoding
HTTP/2 200
server: nginx
date: Sun, 25 Oct 2026 22:31:53 GMT
content-type: text/x-shellscript
vary: Accept, User-Agent
(nix) pipulate $
2: AFTER (NEXT CONTEXT):
I’m also now showing you the Jekyll publishing pipeline in case it has any bearing. I should have shown that from the start because it does the redirect mappings.
# # Content 1
# context.txt
#
# # WE BEGIN AT THE BEGINNING AND WILL GO ON TILL WE COME TO THE END, THEN STOP.
# ~/repos/nixos/configuration.nix
# ~/repos/nixos/services.nix
# ~/repos/nixos/packages.nix
# ~/repos/nixos/autognome.py
# init.lua
# flake.nix
#
# # HOME-HOSTED (NOT BEHIND CDN) NGINX WEBSERVER HONEYBOT AI OBSERVATORY
# nixops.sh
# remotes/honeybot/hooks/post-receive
# remotes/honeybot/nixos/configuration.nix
# remotes/honeybot/scripts/score.py
# remotes/honeybot/scripts/card.py
# remotes/honeybot/scripts/forest.py
# remotes/honeybot/scripts/test_forest.py
# remotes/honeybot/scripts/logs.py
# remotes/honeybot/scripts/content_loader.py
# remotes/honeybot/scripts/db.py
#
# # THE DATA EVERYONE NEEDS
# remotes/honeybot/queries/trapdoor_ips.sql
# ! echo "--- WHO HYDRATES THE DOM ---" && cat remotes/honeybot/queries/trapdoor_ips.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db'
# remotes/honeybot/queries/content_neg_agents.sql
# ! echo "--- WHO NEGOTIATES MARKDOWN ---" && cat remotes/honeybot/queries/content_neg_agents.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db'
# # Context 2
# context.txt
# remotes/honeybot/nixos/configuration.nix
# remotes/honeybot/scripts/logs.py
# ! ssh honeybot 'cfg=$(ps -eo args | rg -o "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; rg "server_name |default_server" "$cfg"; echo "=== GUERILLATECH LOG HITS ==="; rg "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; rg "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/" ~/www/mikelev.in/_site/redirects.map'
# # Context 3
# context.txt
# remotes/honeybot/nixos/configuration.nix
# remotes/honeybot/scripts/logs.py
# ! ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== GUERILLATECH ACCESS.LOG HITS ==="; grep -E "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== GUERILLATECH VHOST LOG ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; grep -E "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/|/pipulate/nixos/crc32/crc32/|/seo/pipulate/semantic-web/|/nix/nixos/python/initpy/" ~/www/mikelev.in/_site/redirects.map'
# # Context 4
# context.txt
# remotes/honeybot/nixos/configuration.nix
# ! ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== RIPGREP ON HONEYBOT ==="; command -v rg || echo "rg: absent"; echo "=== PROBE WWW.MIKELEV.IN & GUERILLATECH GHOST ==="; curl -skI --resolve www.mikelev.in:443:127.0.0.1 https://www.mikelev.in/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | head -n 5'
# # Context 5
# context.txt
# remotes/honeybot/nixos/configuration.nix
# ! ssh honeybot 'echo "=== GUERILLATECH VHOST LOG (LAST 25) ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== REDIRECT LOCATION HEADER CHECK ==="; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | rg -i "^(HTTP/|location:)"; echo "=== OTHER DOOR LOGS WITH /futureproof/ HITS ==="; rg -c "/futureproof/" /var/log/nginx/*.access.log || true'
# Context 6
context.txt
# THE JEKYLL BLOG LIKE A HACKER (INVENTED SKILL.md & AGENTS.md FORMAT) PUBLISHING PIPELINE
~/repos/nixos/blogs.nix
~/.config/pipulate/blogs.json
scripts/articles/publishizer.py
scripts/articles/common.py
scripts/articles/articleizer.py
scripts/articles/link_injector.py
scripts/articles/build_knowledge_graph.py
scripts/articles/editing_prompt.txt
scripts/articles/sanitizer.py
scripts/articles/contextualizer.py
scripts/articles/generate_llms_txt.py
scripts/articles/generate_post_nav.py
remotes/honeybot/nixos/configuration.nix
! ssh honeybot 'echo "=== LEGACY CATEGORY PATH ON GUERILLATECH & LEVINIX ==="; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/nix/nixos/nbstripout/ | rg -i "^(HTTP/|location:)"; curl -skI --resolve levinix.org:443:127.0.0.1 https://levinix.org/futureproof/the-door-names-the-folder/ | rg -i "^(HTTP/|location:)"; echo "=== DOOR ROOT 200 CHECK ==="; curl -skI -A "Mozilla/5.0" --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/ | head -n 5'
3: CHANGE (PATCHES):
I’m still forging ahead with the changes though. We can always revert.
On branch main
Your branch is up to date with 'origin/main'.
nothing to commit, working tree clean
GIT repo clean. Take BEFORE reading, make CHANGE, record AFTER diff.
(nix) pipulate $ patch
(nix) pipulate $ app
✅ DETERMINISTIC PATCH APPLIED: Successfully mutated 'remotes/honeybot/nixos/configuration.nix'.
✅ DETERMINISTIC PATCH APPLIED: Successfully mutated 'remotes/honeybot/nixos/configuration.nix'.
✅ DETERMINISTIC PATCH APPLIED: Successfully mutated 'remotes/honeybot/nixos/configuration.nix'.
✅ DETERMINISTIC PATCH APPLIED: Successfully mutated 'remotes/honeybot/nixos/configuration.nix'.
✅ DETERMINISTIC PATCH APPLIED: Successfully mutated 'remotes/honeybot/nixos/configuration.nix'.
✅ DETERMINISTIC PATCH APPLIED: Successfully mutated 'remotes/honeybot/nixos/configuration.nix'.
✅ DETERMINISTIC PATCH APPLIED: Successfully mutated 'remotes/honeybot/nixos/configuration.nix'.
(nix) pipulate $ d
diff --git a/remotes/honeybot/nixos/configuration.nix b/remotes/honeybot/nixos/configuration.nix
index de61e9b..e225ada 100644
--- a/remotes/honeybot/nixos/configuration.nix
+++ b/remotes/honeybot/nixos/configuration.nix
@@ -320,6 +320,12 @@
locations."/" = {
extraConfig = ''
+ if ($new_uri) {
+ return 301 https://mikelev.in$new_uri;
+ }
+ if (!-e $request_filename) {
+ return 301 https://mikelev.in$request_uri;
+ }
try_files $uri $uri/index.html =404;
'';
};
@@ -360,6 +366,12 @@
locations."/" = {
extraConfig = ''
+ if ($new_uri) {
+ return 301 https://mikelev.in$new_uri;
+ }
+ if (!-e $request_filename) {
+ return 301 https://mikelev.in$request_uri;
+ }
try_files $uri $uri/index.html =404;
'';
};
@@ -400,6 +412,12 @@
locations."/" = {
extraConfig = ''
add_header Vary "Accept" always;
+ if ($new_uri) {
+ return 301 https://mikelev.in$new_uri;
+ }
+ if (!-e $request_filename) {
+ return 301 https://mikelev.in$request_uri;
+ }
if ($serve_markdown) {
rewrite ^(.*)/$ $1/index.md break;
rewrite ^(.*[^/])$ $1/index.md break;
@@ -443,7 +461,7 @@
if ($new_uri) {
return 301 https://mikelev.in$new_uri;
}
- if ($uri ~ ^/futureproof/) {
+ if (!-e $request_filename) {
return 301 https://mikelev.in$request_uri;
}
if ($serve_markdown) {
@@ -486,6 +504,12 @@
locations."/" = {
extraConfig = ''
add_header Vary "Accept" always;
+ if ($new_uri) {
+ return 301 https://mikelev.in$new_uri;
+ }
+ if (!-e $request_filename) {
+ return 301 https://mikelev.in$request_uri;
+ }
if ($serve_markdown) {
rewrite ^(.*)/$ $1/index.md break;
rewrite ^(.*[^/])$ $1/index.md break;
@@ -526,6 +550,12 @@
locations."/" = {
extraConfig = ''
add_header Vary "Accept" always;
+ if ($new_uri) {
+ return 301 https://mikelev.in$new_uri;
+ }
+ if (!-e $request_filename) {
+ return 301 https://mikelev.in$request_uri;
+ }
if ($serve_markdown) {
rewrite ^(.*)/$ $1/index.md break;
rewrite ^(.*[^/])$ $1/index.md break;
@@ -568,6 +598,12 @@
locations."/" = {
extraConfig = ''
add_header Vary "Accept" always;
+ if ($new_uri) {
+ return 301 https://mikelev.in$new_uri;
+ }
+ if (!-e $request_filename) {
+ return 301 https://mikelev.in$request_uri;
+ }
if ($serve_markdown) {
rewrite ^(.*)/$ $1/index.md break;
rewrite ^(.*[^/])$ $1/index.md break;
(nix) pipulate $ m
📝 Committing: chore: Improve Nix configuration with 301 redirects
[main 11eaed7] chore: Improve Nix configuration with 301 redirects
1 file changed, 37 insertions(+), 1 deletion(-)
(nix) pipulate $ git push
Enumerating objects: 11, done.
Counting objects: 100% (11/11), done.
Delta compression using up to 48 threads
Compressing objects: 100% (4/4), done.
Writing objects: 100% (6/6), 580 bytes | 580.00 KiB/s, done.
Total 6 (delta 3), reused 0 (delta 0), pack-reused 0 (from 0)
remote: Resolving deltas: 100% (3/3), completed with 3 local objects.
To github.com:pipulate/pipulate.git
b96f24c..11eaed7 main -> main
(nix) pipulate $
Ignition: often “exit”, “nix develop”. Instructions may vary.
On branch main
Your branch is up to date with 'origin/main'.
nothing to commit, working tree clean
GIT repo clean. Take BEFORE reading, make CHANGE, record AFTER diff.
(nix) pipulate $ ./nixops.sh && ssh -t honeybot 'sudo cp ~/nixos-config-staged/* /etc/nixos/ && sudo nixos-rebuild switch'
🚀 Syncing Hooks...
post-receive 100% 3080 585.6KB/s 00:00
🚀 Syncing Scripts (New Location)...
sending incremental file list
deleting __pycache__/content_loader.cpython-313.pyc
__pycache__/
sent 684 bytes received 62 bytes 1,492.00 bytes/sec
total size is 317,322 speedup is 425.36
sending incremental file list
sent 68 bytes received 12 bytes 160.00 bytes/sec
total size is 140,366 speedup is 1,754.58
sending incremental file list
sent 59 bytes received 12 bytes 47.33 bytes/sec
total size is 645,230 speedup is 9,087.75
🚀 Syncing NPvg pad (one address, two bodies)...
sending incremental file list
sent 232 bytes received 16 bytes 496.00 bytes/sec
total size is 5,440 speedup is 21.94
🚀 Syncing qamy.ai door (npvg.org's shape, its own tree)...
sending incremental file list
sent 232 bytes received 16 bytes 496.00 bytes/sec
total size is 4,646 speedup is 18.73
🚀 Syncing installer to the home-hosted doors (npvg.org qamy.ai levinix.org sunpug.io guerillatech.com rfc9110.org rfc9111.io)...
sending incremental file list
sent 62 bytes received 12 bytes 148.00 bytes/sec
total size is 25,724 speedup is 347.62
sending incremental file list
sent 62 bytes received 12 bytes 148.00 bytes/sec
total size is 25,724 speedup is 347.62
sending incremental file list
sent 62 bytes received 12 bytes 148.00 bytes/sec
total size is 25,724 speedup is 347.62
sending incremental file list
sent 62 bytes received 12 bytes 148.00 bytes/sec
total size is 25,724 speedup is 347.62
sending incremental file list
sent 62 bytes received 12 bytes 148.00 bytes/sec
total size is 25,724 speedup is 347.62
sending incremental file list
sent 62 bytes received 12 bytes 148.00 bytes/sec
total size is 25,724 speedup is 347.62
sending incremental file list
sent 62 bytes received 12 bytes 148.00 bytes/sec
total size is 25,724 speedup is 347.62
🧠 Syncing 2nd Brain archive (brain.zip) to qamy.ai and mikelev.in...
sending incremental file list
sent 62 bytes received 12 bytes 49.33 bytes/sec
total size is 46,809,534 speedup is 632,561.27
🚀 Syncing levinux.com deck (remark.js HTML + RFC 9110 index.md)...
sending incremental file list
sent 203 bytes received 12 bytes 430.00 bytes/sec
total size is 720,316 speedup is 3,350.31
sending incremental file list
sent 93 bytes received 12 bytes 210.00 bytes/sec
total size is 3,964 speedup is 37.75
🚀 Syncing sunpug.io door...
sending incremental file list
sent 100 bytes received 12 bytes 224.00 bytes/sec
total size is 4,791 speedup is 42.78
🚀 Syncing guerillatech.com door...
sending incremental file list
sent 92 bytes received 12 bytes 208.00 bytes/sec
total size is 3,755 speedup is 36.11
🚀 Syncing rfc9110.org door...
sending incremental file list
sent 92 bytes received 12 bytes 208.00 bytes/sec
total size is 3,558 speedup is 34.21
🚀 Syncing rfc9111.io door...
sending incremental file list
sent 92 bytes received 12 bytes 208.00 bytes/sec
total size is 3,729 speedup is 35.86
🚀 Syncing NixOS Config...
sending incremental file list
configuration.nix
sent 6,428 bytes received 335 bytes 4,508.67 bytes/sec
total size is 35,769 speedup is 5.29
✅ Sync Complete.
To apply NixOS config: ssh -t mike@[REDACTED_IP] 'sudo cp ~/nixos-config-staged/* /etc/nixos/ && sudo nixos-rebuild switch'
[sudo] password for mike:
building the system configuration...
evaluation warning: The option `services.logind.lidSwitchExternalPower' defined in `/etc/nixos/configuration.nix' has been renamed to `services.logind.settings.Login.HandleLidSwitchExternalPower'.
evaluation warning: The option `services.logind.lidSwitch' defined in `/etc/nixos/configuration.nix' has been renamed to `services.logind.settings.Login.HandleLidSwitch'.
evaluation warning: The option `services.xserver.displayManager.gdm.wayland' defined in `/etc/nixos/configuration.nix' has been renamed to `services.displayManager.gdm.wayland'.
evaluation warning: The option `services.xserver.displayManager.gdm.enable' defined in `/etc/nixos/configuration.nix' has been renamed to `services.displayManager.gdm.enable'.
these 6 derivations will be built:
/nix/store/02baqbkypsgysv28wf9p8i6h5bs86phn-nginx.conf.drv
/nix/store/aak42h1w3i3yqljsnmpb2h6pibmlm9ls-unit-script-nginx-pre-start.drv
/nix/store/j238gl2fajqs377g3dx9ij8fh7dz6jg2-unit-nginx.service.drv
/nix/store/0bmzwa7plvn1amiax0c64bidpwc3ibxm-system-units.drv
/nix/store/dxsw3whfg4zkhkl1lzs9w1q28alffajg-etc.drv
/nix/store/n86xz0iiwxq9k7l3ax1n79frysrmbfkg-nixos-system-honeybot-26.05pre913595.c6245e83d836.drv
building '/nix/store/02baqbkypsgysv28wf9p8i6h5bs86phn-nginx.conf.drv'...
[context] INFO Can't find variable 'new_uri'
[context] INFO Can't find variable 'new_uri'
[context] INFO Can't find variable 'new_uri'
[context] INFO Can't find variable 'new_uri'
[context] INFO Can't find variable 'new_uri'
[context] INFO Can't find variable 'new_uri'
[context] INFO Can't find variable 'new_uri'
[context] INFO Can't find variable 'new_uri'
==================== Results ===================
No issues found.
==================== Summary ===================
Total issues:
Unspecified: 0
Low: 0
Medium: 0
High: 0
building '/nix/store/aak42h1w3i3yqljsnmpb2h6pibmlm9ls-unit-script-nginx-pre-start.drv'...
building '/nix/store/j238gl2fajqs377g3dx9ij8fh7dz6jg2-unit-nginx.service.drv'...
building '/nix/store/0bmzwa7plvn1amiax0c64bidpwc3ibxm-system-units.drv'...
building '/nix/store/dxsw3whfg4zkhkl1lzs9w1q28alffajg-etc.drv'...
building '/nix/store/n86xz0iiwxq9k7l3ax1n79frysrmbfkg-nixos-system-honeybot-26.05pre913595.c6245e83d836.drv'...
activating the configuration...
setting up /etc...
reloading user units for mike...
restarting sysinit-reactivation.target
restarting the following units: nginx.service
the following new units were started: NetworkManager-dispatcher.service
Done. The new configuration is /nix/store/a10ac5qfcifm6zdfk7028g3l6b9l2nsf-nixos-system-honeybot-26.05pre913595.c6245e83d836
Connection to [REDACTED_IP] closed.
(nix) pipulate $
4: PROMPT:
Verify the AFTER receipt confirming that legacy category paths like /nix/nixos/nbstripout/ on guerillatech.com and /futureproof/ paths on levinix.org now return 301 to https://mikelev.in while root door requests (HTML and curl installer) continue to return 200 OK.
5: DELIVERABLE:
Okay again I’m getting used to the idea that Nginx configuration changes that have a NixOS rebuild and switch update things right underneath the slideshow. The fixed logging should immediately after such patches are applied and ignited without a slideshow restart, so once again I’m killing a bit of time so that the after test has some good data in it.
I’m also interested in whether everything we did is just as valid now that you see the publishing pipeline and how the redirect maps are made.
Validating Single-Hop Redirects Against the Jekyll Knowledge Graph Pipeline
Gemini 4 Argon High: Context verified.
TL;DR: The BEFORE/AFTER straddle receipt confirms the fix is live, and inspecting the Jekyll publishing pipeline (blogs.nix, publishizer.py, build_knowledge_graph.py) confirms our Nginx rules are forward-compatible with how both mikelev.in and the door sites work.
1. AFTER Receipt Verification (22:31:53 GMT vs. 22:38:21 GMT)
BEFORE (22:31:53 GMT):
https://guerillatech.com/nix/nixos/nbstripout/ ──► HTTP/2 404
https://levinix.org/futureproof/the-door-names-the-folder/ ──► HTTP/2 404
AFTER (22:38:21 GMT):
https://guerillatech.com/nix/nixos/nbstripout/ ──► HTTP/2 301 -> https://mikelev.in/nix/nixos/nbstripout/
https://levinix.org/futureproof/the-door-names-the-folder/ ──► HTTP/2 301 -> https://mikelev.in/futureproof/the-door-names-the-folder/
https://guerillatech.com/ (Browser UA) ──► HTTP/2 200 (text/html)
https://guerillatech.com/ (curl UA) ──► HTTP/2 200 (text/x-shellscript)
Why the live HUD updates without restarting the slideshow: logs.py reads tail -f /var/log/nginx/access.log. When nixos-rebuild switch reloads nginx.service, Nginx writes the new 301 status codes into the same log stream immediately, flipping red [404] lines to white [301] lines on the next request.
2. Why the Publishing Pipeline Validates This Design
Seeing blogs.nix and build_knowledge_graph.py explains both where those multi-segment paths came from and why the two-guard rule in remotes/honeybot/nixos/configuration.nix is the right long-term fit:
- Where
/nix/nixos/nbstripout/and/htmx/nix-flakes/websockets/Come From: Inbuild_knowledge_graph.py, Target1(mikelev.in) builds a recursive K-Means / TF-IDF hub tree (TARGET_BRANCHING_FACTOR = 7) where each sub-hub gets a nested permalink (/{hub_1}/{hub_2}/{hub_3}/). As the corpus grows (1,584posts), K-Means cluster labels shift, andgenerate_redirects.py+sanitize_redirects.pymaps retired hub/category paths into/home/mike/www/mikelev.in/_site/redirects.map($new_uri). - Single-Hop Resolution When
$new_uriMatches: Because every door vhost checksif ($new_uri) { return 301 [https://mikelev.in](https://mikelev.in)$new_uri; }beforeif (!-e $request_filename), any legacy hub path already inredirects.mapredirects in one hop straight to its final/futureproof/...destination onmikelev.ininstead of chaining two301s. - **Zero Collision With Each Door’s Own
permalink_prefix**: Inblogs.nix, only Target1(mikelev.in) usespermalink_prefix = "futureproof". Every door has its own disjoint prefix (levinix->"packaging",guerillatech->"observatory",rfc9110->"semantics",rfc9111->"caching",qamy->"verification"). Because-e $request_filenameis true for any file or directory that exists inside/home/mike/www/<door>,index.html,index.md,install.sh,llms.txt,robots.txt,sitemap.xml, and any future posts synced to/home/mike/www/<door>/<prefix>/<slug>/are served locally as200 OK, while nonexistentmikelev.inpaths301back to[https://mikelev.in](https://mikelev.in).
To see the live AhrefsBot requests in /var/log/nginx/guerillatech.access.log now returning 301 instead of 404 since the 18:38 EDT switchover (or to dismount if you are satisfied), run the read-only log tail below.
1: BEFORE (PROBE)
Run in (nix) pipulate $:
ssh honeybot 'echo "=== GUERILLATECH LOG AFTER 18:38 REBUILD ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== LEVINIX LOG AFTER 18:38 REBUILD ==="; tail -n 10 /var/log/nginx/levinix.access.log'
2: AFTER (NEXT CONTEXT)
Paste into context.txt (via context or x) for (nix) pipulate $:
context.txt
remotes/honeybot/nixos/configuration.nix
scripts/articles/extract_404_ghosts.py
scripts/articles/generate_redirects.py
scripts/articles/sanitize_redirects.py
! ssh honeybot 'echo "=== GUERILLATECH LOG AFTER 18:38 REBUILD ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== LEVINIX LOG AFTER 18:38 REBUILD ==="; tail -n 10 /var/log/nginx/levinix.access.log'
3: CHANGE (PATCHES)
No repo patches required on this turn. No ignition required.
4: PROMPT
Copy into prompt.md (via prompt or p) for (nix) pipulate $ (or press \z in Neovim to stage the dismount if ready):
Review the live post-18:38 guerillatech.access.log and levinix.access.log lines from Honeybot confirming AhrefsBot hits are now returning 301 instead of 404, and check how extract_404_ghosts.py / generate_redirects.py handle the remaining 404s on mikelev.in.
5: DELIVERABLE
- Live
guerillatech.access.logandlevinix.access.logtail confirmingAhrefsBot’s crawl queue is now receiving301redirects to[https://mikelev.in](https://mikelev.in)instead of404s. - Optional inspection of
extract_404_ghosts.py,generate_redirects.py, andsanitize_redirects.py(or dismount with\z).
MikeLev.in: Okay so things look correct on the log file again. There’s no more MikeLev.in paths showing up as 404 requests on GorillaTech.com so all is good. I think this aticle is done but be sure to cover this for the newcommer as we wrap up, really down to the basics and the first principles here and such.
THE AI-EDIT METHOD
Same commands, run twice, one change between them. Where the readings differ is what the change did; the diff in the middle is the receipt.
1: BEFORE (PROBE):
On branch main
Your branch is up to date with 'origin/main'.
nothing to commit, working tree clean
GIT repo clean. Take BEFORE reading, make CHANGE, record AFTER diff.
(nix) pipulate $ ssh honeybot 'echo "=== GUERILLATECH LOG AFTER 18:38 REBUILD ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== LEVINIX LOG AFTER 18:38 REBUILD ==="; tail -n 10 /var/log/nginx/levinix.access.log'
=== GUERILLATECH LOG AFTER 18:38 REBUILD ===
[REDACTED_IP] - - [25/Oct/2026:18:28:11 -0400] "GET /jupyter-notebooks/jupyter-notebooks/state-management/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:28:22 -0400] "GET /futureproof/put-the-whole-problem-%D0%BD%D0%B0-the-bench/ HTTP/2.0" 301 162 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:28:33 -0400] "GET /nix-flakes/nixos/prompt-engineering/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:28:44 -0400] "GET /nix-flakes/nixos/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:28:55 -0400] "GET /prompt-engineering/prompt-engineering/semantic-compression/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:29:06 -0400] "GET /nixos/forever-machine/piton-holes/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:29:17 -0400] "GET /prompt-engineering/prompt-engineering/prompt-fu/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:29:27 -0400] "GET /pipulate/context-engineering/llms/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:29:38 -0400] "GET /nixos/dmz/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:29:49 -0400] "GET /htmx/llm/llm/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:30:00 -0400] "GET /nix/nix/pipulate/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:30:11 -0400] "GET /jupyter-notebooks/nix/developer-tools/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:30:22 -0400] "GET /pipulate/context-engineering/ai-context/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:30:33 -0400] "GET /htmx/python/web-framework/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:30:44 -0400] "GET /pipulate/nix/llm-package/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:30:55 -0400] "GET /nix/nix-flakes/neovim/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
[REDACTED_IP] - - [25/Oct/2026:18:31:06 -0400] "GET /nixos/forever-machine/agentic-ai/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22"
127.0.0.1 - - [25/Oct/2026:18:31:53 -0400] "HEAD /nix/nixos/nbstripout/ HTTP/2.0" 404 0 "-" "curl/8.17.0" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"-"
127.0.0.1 - - [25/Oct/2026:18:31:53 -0400] "HEAD / HTTP/2.0" 200 0 "-" "Mozilla/5.0" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"-"
127.0.0.1 - - [25/Oct/2026:18:31:53 -0400] "HEAD / HTTP/2.0" 200 0 "-" "curl/8.17.0" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"-"
[REDACTED_IP] - - [25/Oct/2026:18:34:02 -0400] "GET /futureproof/magic-cookie-pattern-self-bootstrapping-sovereignty/ HTTP/1.1" 301 162 "https://guerillatech.com/futureproof/the-living-broadcast-real-time-content-updates-for-your-automated-narrative/" "Mozilla/5.0 (Linux; Android 7.0;) AppleWebKit/537.36 (HTML, like Gecko) Mobile Safari/537.36 (compatible; PetalBot;+https://webmaster.petalsearch.com/site/petalbot)" Accept:"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8" MarkdownServed:0 Host:"guerillatech.com" Sig:"-"
[REDACTED_IP] - - [25/Oct/2026:18:36:55 -0400] "GET / HTTP/2.0" 200 1263 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/[REDACTED_IP] Safari/537.36" Accept:"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8" MarkdownServed:0 Host:"guerillatech.com" Sig:"-"
127.0.0.1 - - [25/Oct/2026:18:38:21 -0400] "HEAD /nix/nixos/nbstripout/ HTTP/2.0" 301 0 "-" "curl/8.17.0" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"-"
127.0.0.1 - - [25/Oct/2026:18:38:21 -0400] "HEAD / HTTP/2.0" 200 0 "-" "Mozilla/5.0" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"-"
127.0.0.1 - - [25/Oct/2026:18:38:21 -0400] "HEAD / HTTP/2.0" 200 0 "-" "curl/8.17.0" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"-"
=== LEVINIX LOG AFTER 18:38 REBUILD ===
[REDACTED_IP] - - [25/Oct/2026:18:29:37 -0400] "GET /webmail/phpinfo.php HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/[REDACTED_IP] Safari/537.36" Accept:"*/*" MarkdownServed:0 Host:"levinix.com" Sig:"-"
[REDACTED_IP] - - [25/Oct/2026:18:29:37 -0400] "GET /webmail/phpinfo.php HTTP/1.1" 404 180 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/[REDACTED_IP] Safari/537.36" Accept:"*/*" MarkdownServed:0 Host:"levinix.org" Sig:"-"
[REDACTED_IP] - - [25/Oct/2026:18:29:37 -0400] "GET /smtp/phpinfo.php HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/[REDACTED_IP] Safari/537.36" Accept:"*/*" MarkdownServed:0 Host:"levinix.com" Sig:"-"
[REDACTED_IP] - - [25/Oct/2026:18:29:37 -0400] "GET /smtp/phpinfo.php HTTP/1.1" 404 180 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/[REDACTED_IP] Safari/537.36" Accept:"*/*" MarkdownServed:0 Host:"levinix.org" Sig:"-"
127.0.0.1 - - [25/Oct/2026:18:31:53 -0400] "HEAD /futureproof/the-door-names-the-folder/ HTTP/2.0" 404 0 "-" "curl/8.17.0" Accept:"*/*" MarkdownServed:0 Host:"levinix.org" Sig:"-"
[REDACTED_IP] - - [25/Oct/2026:18:32:33 -0400] "GET /sitemaps.xml HTTP/2.0" 301 162 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36" Accept:"*/*" MarkdownServed:0 Host:"levinix.com" Sig:"-"
[REDACTED_IP] - - [25/Oct/2026:18:32:44 -0400] "GET /sitemaps.xml HTTP/2.0" 404 169 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36" Accept:"*/*" MarkdownServed:0 Host:"levinix.org" Sig:"-"
[REDACTED_IP] - - [25/Oct/2026:18:34:01 -0400] "GET / HTTP/1.1" 301 162 "-" "Ziwei-S2Promote/1.0" Accept:"application/json, text/event-stream" MarkdownServed:0 Host:"levinix.com" Sig:"-"
[REDACTED_IP] - - [25/Oct/2026:18:34:02 -0400] "GET / HTTP/1.1" 200 1708 "-" "Ziwei-S2Promote/1.0" Accept:"application/json, text/event-stream" MarkdownServed:0 Host:"levinix.org" Sig:"-"
127.0.0.1 - - [25/Oct/2026:18:38:21 -0400] "HEAD /futureproof/the-door-names-the-folder/ HTTP/2.0" 301 0 "-" "curl/8.17.0" Accept:"*/*" MarkdownServed:0 Host:"levinix.org" Sig:"-"
(nix) pipulate $
2: AFTER (NEXT CONTEXT):
# # Content 1
# context.txt
#
# # WE BEGIN AT THE BEGINNING AND WILL GO ON TILL WE COME TO THE END, THEN STOP.
# ~/repos/nixos/configuration.nix
# ~/repos/nixos/services.nix
# ~/repos/nixos/packages.nix
# ~/repos/nixos/autognome.py
# init.lua
# flake.nix
#
# # HOME-HOSTED (NOT BEHIND CDN) NGINX WEBSERVER HONEYBOT AI OBSERVATORY
# nixops.sh
# remotes/honeybot/hooks/post-receive
# remotes/honeybot/nixos/configuration.nix
# remotes/honeybot/scripts/score.py
# remotes/honeybot/scripts/card.py
# remotes/honeybot/scripts/forest.py
# remotes/honeybot/scripts/test_forest.py
# remotes/honeybot/scripts/logs.py
# remotes/honeybot/scripts/content_loader.py
# remotes/honeybot/scripts/db.py
#
# # THE DATA EVERYONE NEEDS
# remotes/honeybot/queries/trapdoor_ips.sql
# ! echo "--- WHO HYDRATES THE DOM ---" && cat remotes/honeybot/queries/trapdoor_ips.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db'
# remotes/honeybot/queries/content_neg_agents.sql
# ! echo "--- WHO NEGOTIATES MARKDOWN ---" && cat remotes/honeybot/queries/content_neg_agents.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db'
# # Context 2
# context.txt
# remotes/honeybot/nixos/configuration.nix
# remotes/honeybot/scripts/logs.py
# ! ssh honeybot 'cfg=$(ps -eo args | rg -o "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; rg "server_name |default_server" "$cfg"; echo "=== GUERILLATECH LOG HITS ==="; rg "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; rg "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/" ~/www/mikelev.in/_site/redirects.map'
# # Context 3
# context.txt
# remotes/honeybot/nixos/configuration.nix
# remotes/honeybot/scripts/logs.py
# ! ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== GUERILLATECH ACCESS.LOG HITS ==="; grep -E "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== GUERILLATECH VHOST LOG ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; grep -E "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/|/pipulate/nixos/crc32/crc32/|/seo/pipulate/semantic-web/|/nix/nixos/python/initpy/" ~/www/mikelev.in/_site/redirects.map'
# # Context 4
# context.txt
# remotes/honeybot/nixos/configuration.nix
# ! ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== RIPGREP ON HONEYBOT ==="; command -v rg || echo "rg: absent"; echo "=== PROBE WWW.MIKELEV.IN & GUERILLATECH GHOST ==="; curl -skI --resolve www.mikelev.in:443:127.0.0.1 https://www.mikelev.in/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | head -n 5'
# # Context 5
# context.txt
# remotes/honeybot/nixos/configuration.nix
# ! ssh honeybot 'echo "=== GUERILLATECH VHOST LOG (LAST 25) ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== REDIRECT LOCATION HEADER CHECK ==="; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | rg -i "^(HTTP/|location:)"; echo "=== OTHER DOOR LOGS WITH /futureproof/ HITS ==="; rg -c "/futureproof/" /var/log/nginx/*.access.log || true'
# # Context 6
# context.txt
# # THE JEKYLL BLOG LIKE A HACKER (INVENTED SKILL.md & AGENTS.md FORMAT) PUBLISHING PIPELINE
# ~/repos/nixos/blogs.nix
# ~/.config/pipulate/blogs.json
# scripts/articles/publishizer.py
# scripts/articles/common.py
# scripts/articles/articleizer.py
# scripts/articles/link_injector.py
# scripts/articles/build_knowledge_graph.py
# scripts/articles/editing_prompt.txt
# scripts/articles/sanitizer.py
# scripts/articles/contextualizer.py
# scripts/articles/generate_llms_txt.py
# scripts/articles/generate_post_nav.py
#
# remotes/honeybot/nixos/configuration.nix
# ! ssh honeybot 'echo "=== LEGACY CATEGORY PATH ON GUERILLATECH & LEVINIX ==="; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/nix/nixos/nbstripout/ | rg -i "^(HTTP/|location:)"; curl -skI --resolve levinix.org:443:127.0.0.1 https://levinix.org/futureproof/the-door-names-the-folder/ | rg -i "^(HTTP/|location:)"; echo "=== DOOR ROOT 200 CHECK ==="; curl -skI -A "Mozilla/5.0" --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/ | head -n 5'
# Context 7
context.txt
remotes/honeybot/nixos/configuration.nix
scripts/articles/extract_404_ghosts.py
scripts/articles/generate_redirects.py
scripts/articles/sanitize_redirects.py
! ssh honeybot 'echo "=== GUERILLATECH LOG AFTER 18:38 REBUILD ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== LEVINIX LOG AFTER 18:38 REBUILD ==="; tail -n 10 /var/log/nginx/levinix.access.log'
3: CHANGE (PATCHES):
None means done.
4: PROMPT:
Review the live post-18:38 guerillatech.access.log and levinix.access.log lines from Honeybot confirming AhrefsBot hits are now returning 301 instead of 404, and check how extract_404_ghosts.py / generate_redirects.py handle the remaining 404s on mikelev.in.
5: DELIVERABLE:
Hop off the ride. This ride’s stated goal is reached – dismount. This is the NOTARY BEAT: the ride ends here, is witnessed here, and is sealed here. Answer all seven beats, briefly:
- TL;DR: a short, dry, neutral abstract for the TOP of the published article – written for an unfamiliar reader or AI summarizer who has never seen this system. No hype, no insider handles unexplained.
- VERIFY: restate the goal from the top of this article and confirm (or deny) it was met, citing THIS compile’s receipts, not memory. Name any ignition this ride required that never fired – an AFTER tap taken without one is a stale BEFORE wearing the AFTER’s label.
- BANK: name everything that graduates – rule, earmark, todo, pin – as SEARCH/REPLACE patch cars against raw source present in THIS context (Target line inside the fence, one car per commit story), deletions included. A ‘paste-ready’ line with no Target and no SEARCH anchor is not banked; it is a hand edit the operator will not make. These BANK cars are the ONLY patches a dismount emits.
- DANGLING: what carries forward unbanked? One line each, no essays.
- SEED: the context.txt lines (and TODO_SLUGS if narrative context is needed) for the next ride’s first compile.
- CLOSING: a closing summary for the BOTTOM of the article – the final take-away, tied to the book’s larger arc where it fits naturally, never forced. Storytelling over inventory.
- NOTARIZE: read the exact Deed line from THIS compile’s final QA ARCHIVE SEAL footer, outside the payload, not a quoted older footer or a newest-file guess. It names the input archive, not this later response or the generated Jekyll post. State verification separately: only a verifier receipt naming that archive supports a verified claim; otherwise say not independently verified here. Count this Manifest’s live-command receipts, including failures. Quote only recorded digests, sizes and dates, naming their source; filesystem mtime and fixed ZIP dates are not command timestamps. Do not demand absent wc -c or dated-receipt fields. If the footer is missing, say so; otherwise close with its exact Deed line.
FINALITY: after beat 6, this discussion is CLOSED. Emit NO five-car train, NO probes, NO patches beyond the BANK cars of beat 2, and NO next-turn prompt beyond the SEED lines in beat 4. Any reader or model encountering this article later should treat it as a finished, notarized document – an archive entry, not an open thread.
The Notary Beat: First Principles of Multi-Tenant Host Routing
Gemini 4 Argon High: Context verified.
1. VERIFY
- Goal Restated: Diagnose and fix why
mikelev.inarticle and category paths were appearing as404requests underguerillatech.comin Honeybot’s live Nginx access logs, and verify that the fix is compatible with the Jekyll redirect-mapping pipeline. - Confirmed by THIS Compile’s Receipts:
- Tracked Diff Receipt (
Telemetry -> Recent Git Diff Telemetry): Commit11eaed7(de61e9b..e225adaonremotes/honeybot/nixos/configuration.nix) addedif ($new_uri) { return 301 [https://mikelev.in](https://mikelev.in)$new_uri; }andif (!-e $request_filename) { return 301 [https://mikelev.in](https://mikelev.in)$request_uri; }across all seven single-page door virtual hosts (npvg.org,qamy.ai,levinix.org,guerillatech.com,rfc9110.org,rfc9111.io,sunpug.io), building on commitb96f24cwhich pinneddefault = true;andserverAliases = [ ("www." + "mikelev.in") ];onvirtualHosts."mikelev.in"and installedripgrep. - Live Log Receipt (
! ssh honeybot 'echo "=== GUERILLATECH LOG AFTER 18:38 REBUILD ===" ...'):
- Tracked Diff Receipt (
- Prior to the second rebuild (
18:28:11–18:31:53 -0400),/futureproof/hits onguerillatech.comwere already returning301([25/Oct/2026:18:28:22 -0400] "GET /futureproof/put-the-whole-problem-%D0%BD%D0%B0-the-bench/ HTTP/2.0" 301fromAhrefsBot/7.0, and[25/Oct/2026:18:34:02 -0400] "GET /futureproof/magic-cookie-pattern-self-bootstrapping-sovereignty/ HTTP/1.1" 301fromPetalBot), while legacy category paths (/nix/nixos/nbstripout/) still returned404at18:31:53 -0400. -
After the second rebuild activated at
18:38:21 -0400,HEAD /nix/nixos/nbstripout/ HTTP/2.0onguerillatech.comandHEAD /futureproof/the-door-names-the-folder/ HTTP/2.0onlevinix.orgboth flipped from404to301, while root door requests (GET / HTTP/2.0from Chrome at18:36:55andHEAD / HTTP/2.0at18:38:21) continued returning200. - Ignitions: Both required ignitions (
./nixops.sh && ssh -t honeybot 'sudo cp ~/nixos-config-staged/* /etc/nixos/ && sudo nixos-rebuild switch') fired on their respective turns (nixos-system-honeybot-26.05pre913595.c6245e83d836activating/nix/store/akbs7qmc3j8pg1s3kdw3d94hh18ci5ya-...and/nix/store/a10ac5qfcifm6zdfk7028g3l6b9l2nsf-...). No required ignition was missed.
2. BANK
No additional patch cars are emitted at dismount: all remotes/honeybot/nixos/configuration.nix changes are already committed in b96f24c and 11eaed7 and active on Honeybot, and foo_files.py is not present in this compile’s Codebase.
3. DANGLING
foo_files.pywas not in this compile’s context; bank the NixOS Nginxdefault = true;virtual-host ordering lesson there on a future router turn if desired.- Legacy category/hub
404paths onmikelev.in(/nix/nixos/nbstripout/, etc.) await the nextCHOP_404_AFFAIRredirect-mapping run (extract_404_ghosts.py->_raw_map.csv->generate_redirects.py). scripts/articles/extract_404_ghosts.py:100carries a pre-existing RuffW292(no newline at end of file) diagnostic.- Four non-fatal NixOS 26.05 option-rename warnings (
services.logind.lidSwitch*andservices.xserver.displayManager.gdm.*) remain inremotes/honeybot/nixos/configuration.nix.
4. SEED
context.txt
scripts/articles/extract_404_ghosts.py
scripts/articles/generate_redirects.py
scripts/articles/sanitize_redirects.py
remotes/honeybot/queries/hot_404_remaps_top.sql
5. CLOSING
If you are new to self-hosting or Infrastructure as Code, what just happened on this ride is a textbook lesson in how the web actually works underneath cloud dashboards.
When you host multiple websites on a single machine with one public IP address, every incoming request arrives at the same front door (ports 80 and 443). Nginx decides which website folder to serve by reading the HTTP Host: header (and the TLS SNI hostname) and matching it against each site’s server_name list. If a request arrives for a hostname that Nginx does not recognize yet, Nginx does not drop the connection—it hands the request to whichever server block is marked default_server. And if no server block is explicitly marked default_server, Nginx silently promotes the **first server block in nginx.conf** to be the catch-all default.
In NixOS, services.nginx.virtualHosts is a Nix attribute set ({ "mikelev.in" = ...; "npvg.org" = ...; }). Nix evaluates attribute set keys in strict alphabetical order to guarantee reproducible builds. As long as the only hosted domains were mikelev.in, npvg.org, and qamy.ai, "mikelev.in" (m) happened to sort first and acted as the default server. That created a two-phase trap when new domains were pointed at the server:
- **Before the new virtual host existed in
configuration.nix**, pointingguerillatech.comorlevinix.orgat the server’s IP meant any crawler visiting those domains was silently servedmikelev.in’s 1,584-article Jekyll site. Because Jekyll’s internal links are root-relative (/futureproof/...,/nix/nixos/...), crawlers likeAhrefsBotandPetalBotdutifully queued thousands ofmikelev.inpaths underguerillatech.comin their remote databases. - The moment
virtualHosts."guerillatech.com"was added, two things flipped at once:guerillatech.comgot its own isolated one-page web root (turning AhrefsBot’s queued crawl frontier into a wall of404s), and because"guerillatech.com"starts withg, it alphabetically displaced"mikelev.in"(m) as the firstserverblock innginx.conf—hijacking unmatchedHostheaders likewww.mikelev.inand servingguerillatech’s installer script in their place.
Because the entire server is defined in a single declarative text file (remotes/honeybot/nixos/configuration.nix), fixing both halves of the problem took no container orchestration, no proxy appliance, and not even a restart of the live broadcast HUD. Adding default = true; and serverAliases on mikelev.in made the default server explicit rather than an accident of the alphabet, and adding a two-stage if ($new_uri) / if (!-e $request_filename) 301 redirect on each door domain turned AhrefsBot’s poisoned crawl queue into a self-healing funnel back to [https://mikelev.in](https://mikelev.in).
6. NOTARIZE
- Input Archive Deed:
qamy.ai_284-5afa01d8.zip(read from THIS compile’s finalQA ARCHIVE SEALfooter outside the payload; it names the input archive for this turn, not this response or the generated Jekyll post). - Verification Status: Not independently verified here (no verifier receipt naming
qamy.ai_284-5afa01d8.zipis present in this compile). - Live-Command Receipts Count:
1live-command receipt in the Manifest (0failures): -
! ssh honeybot 'echo "=== GUERILLATECH LOG AFTER 18:38 REBUILD ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== LEVINIX LOG AFTER 18:38 REBUILD ==="; tail -n 10 /var/log/nginx/levinix.access.log'(0.1615s,3,671 tokens | 8,779 bytesperManifestandSummary, capturing log events from25/Oct/2026:18:28:11 -0400to25/Oct/2026:18:38:21 -0400). - Recorded Payload Metrics (
Summary):84,924summed tokens,86,619verified tokens,16,078words,289,952characters,293,119bytes (UTF-8).
Deed: qamy.ai_284-5afa01d8.zip
Book Analysis
Ai Editorial Take
What stands out most from an outside architectural angle is how AhrefsBot inadvertently acted as an external, asynchronous state snapshot of a transient server misconfiguration. In distributed systems, we usually think of state living on our own disks or in our own databases. Here, a brief window where DNS A-records existed before their corresponding NixOS virtualHosts blocks caused an external crawler cluster to record a false topology—and then play that false topology back against the server at 11-second intervals days later. When the operator asked, ‘Is there any way to flush it like maybe it’s some cache?’, the realization that the ‘cache’ was actually Ahrefs’ remote crawl frontier reframed the entire fix: you cannot rm -rf a third party’s database, so your edge router must speak the protocol that instructs the remote state machine to rewrite its own records (301 Moved Permanently).
🐦 X.com Promo Tweet
When "g" sorts before "m" in NixOS: how alphabetical virtualHosts evaluation hijacked Nginx default_server and how 301s drained the crawl queue.
https://mikelev.in/futureproof/alphabetical-default-server-hijack-nixos-nginx-vhosts/
#NixOS #Nginx #SelfHosting
🎨 Hero Banner Image Prompt
A wide 16:9 graphic-novel ink-and-wash illustration set in a deep obsidian-slate (#111111) subterranean switching vault. Vertically centered in the frame, a massive brass and glass railway signal interlocking machine routes glowing cyan and warm amber fiber-optic light beams through seven arched mechanical doorways. One brass lever in the center is locked firmly into place with a heavy steel pin, diverting a tangled swarm of red spider-like mechanical crawler probes out of the side doors and into a single wide golden aqueduct at the center. High-contrast chiaroscuro lighting, crisp architectural pen work, rich metallic textures, and atmospheric dark slate shadows extending seamlessly to all four edges of the canvas. Full-bleed edge-to-edge composition filling 100% of the canvas with no borders, no frames, no matting, no margins, and no text overlays or lettering.
🖼️ YAML Frontmatter Image Override
image:
path: /assets/images/alphabetical-default-server-hijack-nixos-nginx-vhosts.jpeg
alt: "A dark obsidian switchboard routing glowing cyan and amber light streams through brass mechanical gates."
Title Brainstorm
- Title Option: When G Sorts Before M: The NixOS Alphabetical Default-Server Hijack in Nginx
- Filename:
alphabetical-default-server-hijack-nixos-nginx-vhosts.md - Rationale: Names the exact mechanical trigger (‘g’ sorting before ‘m’ in Nix attribute sets) alongside the concrete NixOS and Nginx technical components.
- Filename:
- Title Option: The Alphabetical Catch-All Trap: Fixing NixOS Nginx VirtualHosts and Crawler Ghosts
- Filename:
alphabetical-catch-all-trap-nixos-nginx-crawler-ghosts.md - Rationale: Highlights both halves of the diagnostic puzzle: the implicit catch-all server promotion and the resulting ghost URLs queued by external crawlers.
- Filename:
- Title Option: Draining Poisoned Crawl Queues: Explicit Nginx Default Servers and Single-Hop 301s on NixOS
- Filename:
draining-poisoned-crawl-queues-nixos-nginx-default-server.md - Rationale: Focuses on the SEO and crawler-hygiene engineering outcome—draining AhrefsBot’s cross-domain frontier back to the canonical host in a single hop.
- Filename:
- Title Option: Why www.mikelev.in Served a Shell Script: NixOS Attribute Sorting and Nginx Host Routing
- Filename:
why-www-served-shell-script-nixos-nginx-host-routing.md - Rationale: Leads with the most surprising wire receipt from the debugging session—the curl probe that returned text/x-shellscript on the main blog’s www subdomain.
- Filename:
Content Potential And Polish
- Core Strengths:
- Captures a classic, counterintuitive interaction between two sensible system properties: Nix’s lexicographical attribute-set evaluation and Nginx’s positional fallback for
default_server. - Demonstrates the value of the BEFORE/AFTER probe gate twice—first when catching the missing
ripgrepbinary on the remote host before mutating configuration, and second when discovering thatcurl https://www.mikelev.in/was actually servingguerillatech’sinstall.shscript. - Connects low-level HTTP routing rules (
if ($new_uri)beforeif (!-e $request_filename)) directly to the higher-level K-Means / TF-IDF knowledge graph pipeline so legacy hub redirects resolve in a single hop. - Closes with a clear, jargon-free first-principles explanation of HTTP
Hostheaders, TLS SNI, and virtual host dispatch suitable for newcomers to self-hosting.
- Captures a classic, counterintuitive interaction between two sensible system properties: Nix’s lexicographical attribute-set evaluation and Nginx’s positional fallback for
- Suggestions For Polish:
- Add a brief callout box early in the article contrasting Nginx’s
server_namematching priority (exact name, leading wildcard, trailing wildcard, regex, thendefault_server) so readers immediately see why omittingwww.mikelev.intriggered the fallback. - Include a short note on why
if (!-e $request_filename) { return ...; }at the location level is safe in Nginx when used purely withreturn 301, distinguishing it from the well-known ‘If is Evil’ pitfalls involvingtry_filesorproxy_passinsideifblocks.
- Add a brief callout box early in the article contrasting Nginx’s
Next Step Prompts
- Inspect
scripts/articles/extract_404_ghosts.py,scripts/articles/generate_redirects.py, andremotes/honeybot/queries/hot_404_remaps_top.sqlto trace how retired K-Means hub paths like/nix/nixos/nbstripout/onmikelev.inare harvested from the access log and compiled intoredirects.map. - Review the four NixOS 26.05 evaluation warnings in
remotes/honeybot/nixos/configuration.nix(services.logind.lidSwitch*andservices.xserver.displayManager.gdm.*) and prepare a clean SEARCH/REPLACE patch to migrate them to the new option paths.
💸 Spending $10,000/mo and up on HTML pre-render?
Fully implemented new web standards (RFC 9110
Accept: text/markdown, RFC 9111 Vary: Accept, and RFC 9421 Web Bot Auth) can save you that money. Contact Mike for a consultation (miklevin@gmail.com)
• RFC 9110/9111 Edge Advisory
• LinkedIn
