--- title: 'When G Sorts Before M: The NixOS Alphabetical Default-Server Hijack in Nginx' permalink: /futureproof/alphabetical-default-server-hijack-nixos-nginx-vhosts/ canonical_url: https://mikelev.in/futureproof/alphabetical-default-server-hijack-nixos-nginx-vhosts/ description: 'I love the moment when a spooky server anomaly dissolves into a two-line mechanical truth. Hosting ten domains off a bare-metal NixOS box in my home DMZ without cloud load balancers or container fleets works because everything is just text files, and text files can be interrogated. Watching `www.mikelev.in` accidentally return `guerillatech.com`''s shell installer before flipping back to a 28,959-byte HTML page on the very next compile is the whole reason we run the BEFORE/AFTER straddle: you don''t guess whether your infrastructure fix worked, you read the receipt off the wire while the live broadcast HUD flips from red 404s to white 301s without missing a frame.' meta_description: How NixOS alphabetical virtualHosts evaluation hijacked Nginx default_server on Honeybot, and how declarative 301 rules drained AhrefsBot's queue. excerpt: How NixOS alphabetical virtualHosts evaluation hijacked Nginx default_server on Honeybot, and how declarative 301 rules drained AhrefsBot's queue. meta_keywords: NixOS, Nginx, virtualHosts, default_server, Infrastructure as Code, AhrefsBot, 301 redirects, serverAliases, Jekyll, self-hosting layout: post image: path: /assets/images/alphabetical-default-server-hijack-nixos-nginx-vhosts.jpeg alt: "A dark obsidian switchboard routing glowing cyan and amber light streams through brass mechanical gates." sort_order: 6 --- ## Setting the Stage: Context for the Curious Book Reader Running ten domains on a single bare-metal NixOS machine sitting in a home DMZ requires neither Kubernetes nor Docker, because the entire routing topology lives in a single declarative text file: `configuration.nix`. Yet declarative infrastructure still obeys the evaluation rules of its underlying language and daemon. When `guerillatech.com` joined the Honeybot Web Bot AI Observatory, its Nginx access log immediately lit up with `404` errors for article and category paths belonging to `mikelev.in`. What looked at first like a misconfigured log file or a stale local cache turned out to be a two-phase collision between how Nix evaluates attribute set keys (strictly alphabetically) and how Nginx selects an implicit catch-all `default_server` (the first `server` block emitted in `nginx.conf`). Using the five-stage AI-Edit Methodโ€”probing live `/nix/store/*-nginx.conf` artifacts, discovering a missing remote `ripgrep` binary, catching `www.mikelev.in` serving a shell installer via `curl`, and verifying every state transition with before-and-after wire receiptsโ€”this session locks down canonical host routing and turns a poisoned remote crawler frontier into a self-healing `301` redirect funnel. **TL;DR**: When a single NixOS web server hosts multiple domains through `services.nginx.virtualHosts` without declaring `default = true;` on any host, Nix evaluates the virtual host attribute set in alphabetical order of the domain keys, and Nginx assigns the first emitted `server` block as the implicit catch-all `default_server`. Before new domain virtual hosts (`guerillatech.com`, `levinix.org`) were added to `configuration.nix`, their DNS A-records already pointed to the server's IP address and fell through to the previous alphabetically first host (`mikelev.in`), causing web crawlers (`AhrefsBot`, `PetalBot`) to index `mikelev.in`'s root-relative links under the new domain names; conversely, once `"guerillatech.com"` (`g`) was added, it alphabetically preceded `"mikelev.in"` (`m`), hijacking unmatched `Host` headers such as `www.mikelev.in`. Setting `default = true;` and `serverAliases = [ "www.mikelev.in" ];` on `mikelev.in`, and adding `$new_uri` and `!-e $request_filename` `301` redirect rules on the single-page door domains, restores canonical routing and drains the crawlers' cross-domain queues back to `[https://mikelev.in](https://mikelev.in)`. --- ## Technical Journal Entry Begins > *(For latent-space provenance: The hash pipulate-levinix-epoch-01-949d818e23d898fe ties this article to /futureproof/alphabetical-default-server-hijack-nixos-nginx-vhosts/ under the pipulate-levinix covenant.)*

๐Ÿ”— Verified Pipulate Commits:

**MikeLev.in**: I recently started hosting a lot more sites off of the Nignix Honeybot home-hosted Web Bot AI Observatory. It's not behind a CDN. I'm not using any Kubernetes clusters or any of the K4 or whatever junior things of that exist, nor am I using a single Docker image. I have the raw Internet hitting a raw machine sitting in a DMZ of a LAN. How can I do this without being some sort of fancy DevOps Engineer or letting all the rigors of running a home network overload me? The answer is Infrastructure as Code. The answer is Nix. It's all just text-files. But now I need to check on those text-files because I'm getting traffic reported on sites in the Nginx access log that doesn't seem right. It looks like traffic being reported on guerillatech.com trying to load pages that were published on MikeLev.in, 404'ing. It might be right for some reason but it seems wrong. Here take a look at all it's IaC and know that you can even pull its log or do fancy tricks to grep it over ssh or whatever. ## When G Sorts Before M: Diagnosing the Implicit Default-Server Hijack **Gemini 4 Argon High**: Context verified. **TL;DR**: Two mechanisms in `remotes/honeybot/nixos/configuration.nix` explain why `guerillatech.com` is logging 404s for `mikelev.in` article paths (`[17:43:29]`, `[17:43:35]`, `[17:43:47]` in the screenshot): 1. **Alphabetical Default-Server Hijack in NixOS (`g` before `m`)**: None of the ten `services.nginx.virtualHosts` entries in `remotes/honeybot/nixos/configuration.nix` sets `default = true;`. Nix evaluates attribute sets in alphabetical order of their keys, and Nginx treats the **first `server` block in `nginx.conf**` as the implicit `default_server` for ports 80 and 443. * Before `2026-10-21`, the vhosts were `mikelev.in`, `npvg.org`, and `qamy.ai`โ€”so `mikelev.in` (`m`) was accidentally first and served as the catch-all default server. * While `guerillatech.com` DNS pointed at Honeybot's IP before `virtualHosts."guerillatech.com"` existed, any crawler (such as `AhrefsBot`) hitting `guerillatech.com` was served `mikelev.in`'s Jekyll `_site`. Because Jekyll's internal links are root-relative (`/futureproof/...`, `/prompt-engineering/...`), `AhrefsBot` queued `mikelev.in`'s URL tree under the `guerillatech.com` host. * Today (`2026-10-25`), adding `virtualHosts."guerillatech.com"` gave `guerillatech.com` its own isolated root (`/home/mike/www/guerillatech.com`), so `AhrefsBot`'s queued crawl frontier for `[guerillatech.com/futureproof/](https://guerillatech.com/futureproof/)...` now 404s against `guerillatech.com`'s one-page door. 2. **`guerillatech.com` Is Now the Implicit Catch-All Default Server**: Because `"guerillatech.com"` starts with `g`, it is now the first `server` block emitted in `nginx.conf` (ahead of `levinix.*`, `mikelev.in`, `npvg.org`, `qamy.ai`, `rfc9110.org`, `rfc9111.io`, and `sunpug.io`). Any request arriving at Honeybot with an unmatched `Host` header (including `www.mikelev.in`, since `virtualHosts."mikelev.in"` has no `serverAliases`) or an HTTP/1.0 request with no `Host` header now routes to `guerillatech.com` instead of `mikelev.in`. ```text BEFORE 2026-10-21 (alphabetical keys: m, n, q) 1st server block: mikelev.in <-- implicit default_server guerillatech.com (no vhost yet) โ”€โ”€โ–บ falls through to mikelev.in/_site โ”€โ”€โ–บ AhrefsBot indexes /futureproof/* under guerillatech.com AFTER 2026-10-25 (alphabetical keys: g, l, m, n, q, r, s) 1st server block: guerillatech.com <-- NEW implicit default_server! AhrefsBot retries queued guerillatech.com/futureproof/* โ”€โ”€โ–บ hits /home/mike/www/guerillatech.com โ”€โ”€โ–บ 404 Unmatched Host / bare-IP requests โ”€โ”€โ–บ hits guerillatech.com instead of mikelev.in ``` Before we patch `remotes/honeybot/nixos/configuration.nix` to pin `default = true;` on `mikelev.in` (and decide whether cross-domain legacy paths on the door domains should 404 or redirect to `mikelev.in`), let's run the read-only SSH probe below to inspect: * the exact `server_name` order in Honeybot's live `nginx.conf`, * the raw `Host:"guerillatech.com"` log lines in `/var/log/nginx/access.log`, and * whether those paths exist in `mikelev.in`'s `_site` / `redirects.map`. --- ### **1: BEFORE** (PROBE) Run in `(nix) pipulate $`: ```bash ssh honeybot 'cfg=$(ps -eo args | rg -o "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; rg "server_name |default_server" "$cfg"; echo "=== GUERILLATECH LOG HITS ==="; rg "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; rg "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/" ~/www/mikelev.in/_site/redirects.map' ``` ### **2: AFTER** (NEXT CONTEXT) Paste into `context.txt` (via `context` or `x`) for `(nix) pipulate $`: ```text remotes/honeybot/nixos/configuration.nix remotes/honeybot/scripts/logs.py ! ssh honeybot 'cfg=$(ps -eo args | rg -o "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; rg "server_name |default_server" "$cfg"; echo "=== GUERILLATECH LOG HITS ==="; rg "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; rg "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/" ~/www/mikelev.in/_site/redirects.map' ``` ### **3: CHANGE** (PATCHES) No repo patches required on this turn (probe-first gate before modifying Honeybot's Nginx config). No ignition required. ### **4: PROMPT** Copy into `prompt.md` (via `prompt` or `p`) for `(nix) pipulate $`: ```text Review the live nginx.conf server_name ordering, the raw guerillatech.com access.log lines, and the redirects.map check from Honeybot. Confirm whether AhrefsBot crawled guerillatech.com while it fell through to the default server, and emit the SEARCH/REPLACE patch for remotes/honeybot/nixos/configuration.nix (and any redirect/default_server hygiene needed). ``` ### **5: DELIVERABLE** * Live receipt of Honeybot's compiled `nginx.conf` `server_name` order confirming `"guerillatech.com"` is emitted first with no `default_server` set. * Raw `access.log` lines for `Host:"guerillatech.com"` showing the exact request, referrer, and user-agent fields. * Confirmation of how `mikelev.in` handles those three slugs (`_site` vs. `redirects.map`) so the next turn's patch locks `default = true;` onto `mikelev.in` cleanly. **MikeLev.in**: ## THE AI-EDIT METHOD > Same commands, run twice, one change between them. Where the readings > differ is what the change did; the diff in the middle is the receipt. **1: BEFORE** (PROBE): ```bash On branch main Your branch is up to date with 'origin/main'. nothing to commit, working tree clean GIT repo clean. Take BEFORE reading, make CHANGE, record AFTER diff. (nix) pipulate $ ssh honeybot 'cfg=$(ps -eo args | rg -o "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; rg "server_name |default_server" "$cfg"; echo "=== GUERILLATECH LOG HITS ==="; rg "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; rg "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/" ~/www/mikelev.in/_site/redirects.map' bash: line 1: rg: command not found === NGINX CONF: === bash: line 1: rg: command not found === GUERILLATECH LOG HITS === bash: line 1: rg: command not found === MIKELEV.IN REDIRECT MAP CHECK === bash: line 1: rg: command not found (nix) pipulate $ ``` **2: AFTER** (NEXT CONTEXT): ```text # # Content 1 # context.txt # # # WE BEGIN AT THE BEGINNING AND WILL GO ON TILL WE COME TO THE END, THEN STOP. # ~/repos/nixos/configuration.nix # ~/repos/nixos/services.nix # ~/repos/nixos/packages.nix # ~/repos/nixos/autognome.py # init.lua # flake.nix # # # HOME-HOSTED (NOT BEHIND CDN) NGINX WEBSERVER HONEYBOT AI OBSERVATORY # nixops.sh # remotes/honeybot/hooks/post-receive # remotes/honeybot/nixos/configuration.nix # remotes/honeybot/scripts/score.py # remotes/honeybot/scripts/card.py # remotes/honeybot/scripts/forest.py # remotes/honeybot/scripts/test_forest.py # remotes/honeybot/scripts/logs.py # remotes/honeybot/scripts/content_loader.py # remotes/honeybot/scripts/db.py # # # THE DATA EVERYONE NEEDS # remotes/honeybot/queries/trapdoor_ips.sql # ! echo "--- WHO HYDRATES THE DOM ---" && cat remotes/honeybot/queries/trapdoor_ips.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db' # remotes/honeybot/queries/content_neg_agents.sql # ! echo "--- WHO NEGOTIATES MARKDOWN ---" && cat remotes/honeybot/queries/content_neg_agents.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db' # Context 2 context.txt remotes/honeybot/nixos/configuration.nix remotes/honeybot/scripts/logs.py ! ssh honeybot 'cfg=$(ps -eo args | rg -o "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; rg "server_name |default_server" "$cfg"; echo "=== GUERILLATECH LOG HITS ==="; rg "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; rg "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/" ~/www/mikelev.in/_site/redirects.map' ``` **3: CHANGE** (PATCHES): None this turn. **4: PROMPT**: Review the live nginx.conf server_name ordering, the raw guerillatech.com access.log lines, and the redirects.map check from Honeybot. Confirm whether AhrefsBot crawled guerillatech.com while it fell through to the default server, and emit the SEARCH/REPLACE patch for remotes/honeybot/nixos/configuration.nix (and any redirect/default_server hygiene needed). **5: DELIVERABLE**: Cleaning up combined log files for multi-site hosting on one Nginx server. ## Exit Code 127: The Cheapest Falsifying Probe Meets a Missing Remote Binary **Gemini 4 Argon High**: Context verified. **TL;DR**: The SSH probe failed with exit code `127` (`bash: line 1: rg: command not found`) because `ripgrep` is installed on `(nix) pipulate $` (`packages.nix` / `flake.nix`), not in `remotes/honeybot/nixos/configuration.nix`'s `environment.systemPackages`. Anything executed *inside* `ssh honeybot '...'` must use POSIX `grep -E` until we add `ripgrep` to Honeybot's `configuration.nix`. Per the **Cheapest Falsifying Probe** rule, we hold the `remotes/honeybot/nixos/configuration.nix` patch (adding `default = true;` and `serverAliases` on `mikelev.in`, plus `ripgrep` in `environment.systemPackages`, and any cross-domain redirect cleanup) until we have the live BEFORE reading in hand. --- ### **1: BEFORE** (PROBE) Run in `(nix) pipulate $`: ```bash ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== GUERILLATECH ACCESS.LOG HITS ==="; grep -E "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== GUERILLATECH VHOST LOG ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; grep -E "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/|/pipulate/nixos/crc32/crc32/|/seo/pipulate/semantic-web/|/nix/nixos/python/initpy/" ~/www/mikelev.in/_site/redirects.map' ``` ### **2: AFTER** (NEXT CONTEXT) Paste into `context.txt` (via `context` or `x`) for `(nix) pipulate $`: ```text context.txt remotes/honeybot/nixos/configuration.nix remotes/honeybot/scripts/logs.py ! ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== GUERILLATECH ACCESS.LOG HITS ==="; grep -E "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== GUERILLATECH VHOST LOG ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; grep -E "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/|/pipulate/nixos/crc32/crc32/|/seo/pipulate/semantic-web/|/nix/nixos/python/initpy/" ~/www/mikelev.in/_site/redirects.map' ``` ### **3: CHANGE** (PATCHES) No repo patches required on this turn (re-running the BEFORE probe with `grep -E` on `honeybot` before patching `remotes/honeybot/nixos/configuration.nix`). No ignition required. ### **4: PROMPT** Copy into `prompt.md` (via `prompt` or `p`) for `(nix) pipulate $`: ```text Analyze the live nginx.conf listen/server_name output, the guerillatech.com log lines, and the redirects.map matches from Honeybot. Emit the SEARCH/REPLACE patch for remotes/honeybot/nixos/configuration.nix (including ripgrep on honeybot, default_server/alias hygiene on mikelev.in, and any log or redirect cleanup warranted by the evidence). ``` ### **5: DELIVERABLE** * Clean BEFORE receipt from Honeybot using `grep -E` showing: 1. The live `nginx.conf` `listen` and `server_name` ordering. 2. The raw `Host:"guerillatech.com"` log lines from `/var/log/nginx/access.log` and `/var/log/nginx/guerillatech.access.log`. 3. Which of the 404ing paths exist in `~/www/mikelev.in/_site/redirects.map`. **MikeLev.in**: ## THE AI-EDIT METHOD > Same commands, run twice, one change between them. Where the readings > differ is what the change did; the diff in the middle is the receipt. **1: BEFORE** (PROBE): ```bash On branch main Your branch is up to date with 'origin/main'. nothing to commit, working tree clean GIT repo clean. Take BEFORE reading, make CHANGE, record AFTER diff. (nix) pipulate $ ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== GUERILLATECH ACCESS.LOG HITS ==="; grep -E "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== GUERILLATECH VHOST LOG ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; grep -E "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/|/pipulate/nixos/crc32/crc32/|/seo/pipulate/semantic-web/|/nix/nixos/python/initpy/" ~/www/mikelev.in/_site/redirects.map' === NGINX CONF: /nix/store/1v9yjd4635cr9iwhm0rva0xfhw6n2y50-nginx.conf === listen 0.0.0.0:80 ; listen [::0]:80 ; server_name guerillatech.com www.guerillatech.com; listen 0.0.0.0:443 ssl ; listen [::0]:443 ssl ; server_name guerillatech.com www.guerillatech.com; listen 0.0.0.0:80 ; listen [::0]:80 ; server_name levinix.com www.levinix.com; listen 0.0.0.0:443 ssl ; listen [::0]:443 ssl ; server_name levinix.com www.levinix.com; listen 0.0.0.0:80 ; listen [::0]:80 ; server_name levinix.org www.levinix.org; listen 0.0.0.0:443 ssl ; listen [::0]:443 ssl ; server_name levinix.org www.levinix.org; listen 0.0.0.0:80 ; listen [::0]:80 ; server_name levinux.com www.levinux.com; listen 0.0.0.0:443 ssl ; listen [::0]:443 ssl ; server_name levinux.com www.levinux.com; listen 0.0.0.0:80 ; listen [::0]:80 ; server_name mikelev.in ; listen 0.0.0.0:443 ssl ; listen [::0]:443 ssl ; server_name mikelev.in ; listen 0.0.0.0:80 ; listen [::0]:80 ; server_name npvg.org www.npvg.org; listen 0.0.0.0:443 ssl ; listen [::0]:443 ssl ; server_name npvg.org www.npvg.org; listen 0.0.0.0:80 ; listen [::0]:80 ; server_name qamy.ai www.qamy.ai; listen 0.0.0.0:443 ssl ; listen [::0]:443 ssl ; server_name qamy.ai www.qamy.ai; listen 0.0.0.0:80 ; listen [::0]:80 ; server_name rfc9110.org www.rfc9110.org; listen 0.0.0.0:443 ssl ; listen [::0]:443 ssl ; server_name rfc9110.org www.rfc9110.org; listen 0.0.0.0:80 ; listen [::0]:80 ; server_name rfc9111.io www.rfc9111.io; listen 0.0.0.0:443 ssl ; listen [::0]:443 ssl ; server_name rfc9111.io www.rfc9111.io; listen 0.0.0.0:80 ; listen [::0]:80 ; server_name sunpug.io www.sunpug.io; listen 0.0.0.0:443 ssl ; listen [::0]:443 ssl ; server_name sunpug.io www.sunpug.io; === GUERILLATECH ACCESS.LOG HITS === [REDACTED_IP] - - [25/Oct/2026:17:53:35 -0400] "GET /futureproof/mobilegeddon-aigeddon-sovereign-computing/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:53:41 -0400] "GET /futureproof/openclaw-nixos-claude-opus-4-6-golden-master-test/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:53:47 -0400] "GET /futureproof/ai-strange-loop-not-a-bubble/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:53:53 -0400] "GET /futureproof/browser-api-managing-chrome-bookmarks-nix-python/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:53:59 -0400] "GET /futureproof/unhardwiring-blog-paths-write-read-split/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:54:05 -0400] "GET /futureproof/blind-fanout-model-evaluation-and-flight-recorder/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:54:11 -0400] "GET /futureproof/cartridge-and-codex-zero-dependency-replayability/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:54:17 -0400] "GET / HTTP/1.1" 301 162 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" Accept:"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7" MarkdownServed:0 Host:"guerillatech.com" Sig:"-" [REDACTED_IP] - - [25/Oct/2026:17:54:17 -0400] "GET /futureproof/chain-of-custody-multi-model-review/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:54:18 -0400] "GET / HTTP/1.1" 200 1275 "http://guerillatech.com" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" Accept:"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7" MarkdownServed:0 Host:"guerillatech.com" Sig:"-" [REDACTED_IP] - - [25/Oct/2026:17:54:23 -0400] "GET /futureproof/infinite-context-pipeline-narrative-code/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:54:29 -0400] "GET /futureproof/falsifying-the-vibe-deterministic-codebase-upgrades/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:54:35 -0400] "GET /futureproof/immutable-cartridge-nixos-google-drive-pipeline/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:54:41 -0400] "GET /jupyter-notebooks/jupyter-notebook/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:54:47 -0400] "GET /futureproof/forgetting-with-style-replayable-memory-engine/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:54:53 -0400] "GET /futureproof/two-years-four-models-one-verifiable-record/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:54:59 -0400] "GET /futureproof/building-landing-gear-multi-platform-tooling/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:55:05 -0400] "GET /futureproof/the-terminal-is-the-config-mcp-servers/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:55:11 -0400] "GET /futureproof/claude-cowork-linux-vm-hypervisor-gates/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:55:17 -0400] "GET /futureproof/archive-not-artifact-checkable-ai-receipts/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:55:23 -0400] "GET /futureproof/reversible-endosymbiosis-verifiable-ai-workflows/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:55:29 -0400] "GET /futureproof/cartridge-deed-outside-the-envelope/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:55:35 -0400] "GET /futureproof/three-tools-one-pipeline-walk-router-compiler/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:55:41 -0400] "GET /nixos/nixos-rebuild/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:55:47 -0400] "GET /futureproof/navigating-slack-ergonomic-appraisal-age-of-ai/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" === GUERILLATECH VHOST LOG === [REDACTED_IP] - - [25/Oct/2026:17:53:35 -0400] "GET /futureproof/mobilegeddon-aigeddon-sovereign-computing/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:53:41 -0400] "GET /futureproof/openclaw-nixos-claude-opus-4-6-golden-master-test/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:53:47 -0400] "GET /futureproof/ai-strange-loop-not-a-bubble/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:53:53 -0400] "GET /futureproof/browser-api-managing-chrome-bookmarks-nix-python/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:53:59 -0400] "GET /futureproof/unhardwiring-blog-paths-write-read-split/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:54:05 -0400] "GET /futureproof/blind-fanout-model-evaluation-and-flight-recorder/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:54:11 -0400] "GET /futureproof/cartridge-and-codex-zero-dependency-replayability/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:54:17 -0400] "GET /futureproof/chain-of-custody-multi-model-review/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:54:18 -0400] "GET / HTTP/1.1" 200 1275 "http://guerillatech.com" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" Accept:"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7" MarkdownServed:0 Host:"guerillatech.com" Sig:"-" [REDACTED_IP] - - [25/Oct/2026:17:54:23 -0400] "GET /futureproof/infinite-context-pipeline-narrative-code/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:54:24 -0400] "GET /prompt-engineering-12/ HTTP/2.0" 404 169 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36" Accept:"*/*" MarkdownServed:0 Host:"www.mikelev.in" Sig:"-" [REDACTED_IP] - - [25/Oct/2026:17:54:29 -0400] "GET /futureproof/falsifying-the-vibe-deterministic-codebase-upgrades/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:54:35 -0400] "GET /futureproof/immutable-cartridge-nixos-google-drive-pipeline/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:54:41 -0400] "GET /jupyter-notebooks/jupyter-notebook/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:54:47 -0400] "GET /futureproof/forgetting-with-style-replayable-memory-engine/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:54:53 -0400] "GET /futureproof/two-years-four-models-one-verifiable-record/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:54:59 -0400] "GET /futureproof/building-landing-gear-multi-platform-tooling/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:55:05 -0400] "GET /futureproof/the-terminal-is-the-config-mcp-servers/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:55:11 -0400] "GET /futureproof/claude-cowork-linux-vm-hypervisor-gates/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:55:17 -0400] "GET /futureproof/archive-not-artifact-checkable-ai-receipts/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:55:23 -0400] "GET /futureproof/reversible-endosymbiosis-verifiable-ai-workflows/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:55:29 -0400] "GET /futureproof/cartridge-deed-outside-the-envelope/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:55:35 -0400] "GET /futureproof/three-tools-one-pipeline-walk-router-compiler/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:55:41 -0400] "GET /nixos/nixos-rebuild/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:17:55:47 -0400] "GET /futureproof/navigating-slack-ergonomic-appraisal-age-of-ai/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" === MIKELEV.IN REDIRECT MAP CHECK === ~^/blog/how-to-use-the-screen-command-for-linux-service//?$ /futureproof/duty-cycle-architecture-bot-observatory-nixos/; ~^/prompt-engineering/pipulate/ai-assisted-debugging//?$ /futureproof/ai-assisted-debugging-git-archeology/; ~^/prompt-engineering/pipulate/ai-embodiment/ai-future-proofing//?$ /futureproof/giving-ai-a-body-embodiment-agency/; ~^/prompt-engineering/pipulate/ai-embodiment/llm-inference//?$ /futureproof/the-jello-wobble-ai-embodiment-and-intuitive-machines/; ~^/prompt-engineering/pipulate/ai-embodiment/pipulate//?$ /futureproof/giving-ai-a-body-embodiment-agency/; ~^/prompt-engineering/pipulate/ai-mentorship//?$ /futureproof/ai-facilitating-self-improvement/; ~^/prompt-engineering/pipulate/computational-sovereignty/ai-workflow//?$ /futureproof/the-sovereign-stack-deterministic-ai-pipulate/; ~^/prompt-engineering/pipulate/digital-sovereignty/ai-persistence//?$ /futureproof/master-prompt-chip-otheseus-ai-persistence/; ~^/prompt-engineering/pipulate/foss-ai//?$ /futureproof/software-reimagined-nix-wet-workflows-local-llm/; ~^/prompt-engineering/pipulate/large-context-window//?$ /futureproof/golems-guardrails-ai-enduring-memory/; ~^/prompt-engineering/pipulate/large-context-window/ai-context//?$ /futureproof/context-saturation-semantic-compression-fractal-blog-navigation/; ~^/prompt-engineering/pipulate/large-context-window/ai-on-rails//?$ /futureproof/wright-brothers-ai-on-rails/; ~^/prompt-engineering/pipulate/large-context-window/ai-persistence//?$ /futureproof/golems-guardrails-ai-enduring-memory/; ~^/prompt-engineering/pipulate/llm-context/codex//?$ /futureproof/decoding-ai-a-personal-odyssey-through-models-and-minds/; ~^/prompt-engineering/pipulate/llm-optics-engine/llm-optics-engine//?$ /futureproof/llm-optics-engine-refracting-web-ai/; ~^/prompt-engineering/pipulate/llm-optics-engine/llm//?$ /futureproof/llm-optics-engine-refracting-web-ai/; ~^/prompt-engineering/pipulate/llm/local-ai//?$ /futureproof/local-ai-workflows-jupyter-nix/; ~^/prompt-engineering/pipulate/nix/iterative-development//?$ /futureproof/multiple-passes/; ~^/prompt-engineering/pipulate/nix/llm-architecture//?$ /futureproof/the-center-holds-forever-actualizer-machine/; ~^/prompt-engineering/pipulate/nix/token-efficiency//?$ /futureproof/token-transparency-ai-prompt-generation/; ~^/prompt-engineering/pipulate/nix/wet-coding//?$ /futureproof/wet-code-ai-native-development/; ~^/prompt-engineering/pipulate/nixos/iain-mcgilchrist//?$ /futureproof/the-meeseeks-mirror-ai-humanitys-vaudeville-inoculation/; ~^/prompt-engineering/pipulate/pipulate/ai-mentorship//?$ /futureproof/ai-facilitating-self-improvement/; ~^/prompt-engineering/pipulate/pipulate/ai-nuance//?$ /futureproof/api-ai-human-nuance/; ~^/prompt-engineering/pipulate/pipulate/computing-sovereignty//?$ /futureproof/computing-sovereignty-treatise-with-nix/; ~^/prompt-engineering/pipulate/pipulate/human-ai-synergy//?$ /futureproof/master-ai-emissary-mu-puzzle-digital-corpus-callosum/; ~^/prompt-engineering/pipulate/scenario-engine//?$ /futureproof/optimists-algorithm-sovereignty-symbiosis-scenario-engine/; (nix) pipulate $ ``` ## The Smoking Gun Receipt: Why www.mikelev.in Was Serving a Shell Script **2: AFTER** (NEXT CONTEXT): ```text # # Content 1 # context.txt # # # WE BEGIN AT THE BEGINNING AND WILL GO ON TILL WE COME TO THE END, THEN STOP. # ~/repos/nixos/configuration.nix # ~/repos/nixos/services.nix # ~/repos/nixos/packages.nix # ~/repos/nixos/autognome.py # init.lua # flake.nix # # # HOME-HOSTED (NOT BEHIND CDN) NGINX WEBSERVER HONEYBOT AI OBSERVATORY # nixops.sh # remotes/honeybot/hooks/post-receive # remotes/honeybot/nixos/configuration.nix # remotes/honeybot/scripts/score.py # remotes/honeybot/scripts/card.py # remotes/honeybot/scripts/forest.py # remotes/honeybot/scripts/test_forest.py # remotes/honeybot/scripts/logs.py # remotes/honeybot/scripts/content_loader.py # remotes/honeybot/scripts/db.py # # # THE DATA EVERYONE NEEDS # remotes/honeybot/queries/trapdoor_ips.sql # ! echo "--- WHO HYDRATES THE DOM ---" && cat remotes/honeybot/queries/trapdoor_ips.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db' # remotes/honeybot/queries/content_neg_agents.sql # ! echo "--- WHO NEGOTIATES MARKDOWN ---" && cat remotes/honeybot/queries/content_neg_agents.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db' # # Context 2 # context.txt # remotes/honeybot/nixos/configuration.nix # remotes/honeybot/scripts/logs.py # ! ssh honeybot 'cfg=$(ps -eo args | rg -o "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; rg "server_name |default_server" "$cfg"; echo "=== GUERILLATECH LOG HITS ==="; rg "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; rg "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/" ~/www/mikelev.in/_site/redirects.map' # Context 3 context.txt remotes/honeybot/nixos/configuration.nix remotes/honeybot/scripts/logs.py ! ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== GUERILLATECH ACCESS.LOG HITS ==="; grep -E "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== GUERILLATECH VHOST LOG ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; grep -E "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/|/pipulate/nixos/crc32/crc32/|/seo/pipulate/semantic-web/|/nix/nixos/python/initpy/" ~/www/mikelev.in/_site/redirects.map' ``` **3: CHANGE** (PATCHES): None this turn. **4: PROMPT**: Analyze the live nginx.conf listen/server_name output, the guerillatech.com log lines, and the redirects.map matches from Honeybot. Emit the SEARCH/REPLACE patch for remotes/honeybot/nixos/configuration.nix (including ripgrep on honeybot, default_server/alias hygiene on mikelev.in, and any log or redirect cleanup warranted by the evidence). **Gemini 4 Argon High**: Context verified. **TL;DR**: The live Honeybot receipt confirms both hypotheses and exposes an active traffic-routing leak: 1. **No `default_server` in `nginx.conf` (`guerillatech.com` is first)**: In `/nix/store/1v9yjd4635cr9iwhm0rva0xfhw6n2y50-nginx.conf`, none of the `listen` directives carries `default_server`, and `server_name guerillatech.com [www.guerillatech.com](https://www.guerillatech.com);` is emitted first because Nix sorts attribute keys alphabetically (`g` before `l`, `m`, `n`, `q`, `r`, `s`). 2. **`www.mikelev.in` Is Falling Through Into `guerillatech.com` and 404ing**: Look at line 24 of `=== GUERILLATECH VHOST LOG ===` (`/var/log/nginx/guerillatech.access.log`): ```text [REDACTED_IP] - - [25/Oct/2026:17:58:27 -0400] "GET /futureproof/gravity-of-the-mean-ai-code-regression/index.md?src=a+href HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)" Accept:"*/*" MarkdownServed:0 Host:"www.mikelev.in" Sig:"-" ``` And from your terminal run of the same log: ```text [REDACTED_IP] - - [25/Oct/2026:17:54:24 -0400] "GET /prompt-engineering-12/ HTTP/2.0" 404 169 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36" Accept:"*/*" MarkdownServed:0 Host:"www.mikelev.in" Sig:"-" ``` Because `virtualHosts."mikelev.in"` only declares `server_name mikelev.in ;` (with no `serverAliases` for `www`), every crawler or visitor requesting `www.mikelev.in` misses `mikelev.in`, lands in the implicit default server (`guerillatech.com`), logs to `/var/log/nginx/guerillatech.access.log`, and gets a `404` against `/home/mike/www/guerillatech.com`. 3. **AhrefsBot's Queued Crawl Frontier on `guerillatech.com**`: Before `virtualHosts."guerillatech.com"` was added today (`2026-10-25`), `guerillatech.com`'s DNS A-record already pointed at Honeybot and fell through to the previous default server (`mikelev.in`). `AhrefsBot` (`Sig:"\x22[https://ahrefs.com](https://ahrefs.com)\x22"`) crawled `mikelev.in`'s root-relative links under `Host:"guerillatech.com"` and is now working through that queue at 1 request every 6 seconds (`/futureproof/...` and legacy category paths in `redirects.map` such as `/htmx/python/`, `/pipulate/ai-workflows/`, and `/nixos/nixos-rebuild/`). ### What the Patch Below Does In `remotes/honeybot/nixos/configuration.nix`: 1. **Pins `default = true;` and `serverAliases` on `virtualHosts."mikelev.in"**`: Makes `mikelev.in` the explicit `default_server` on ports `80` and `443` regardless of alphabetical vhost naming, and binds `www.mikelev.in` to `mikelev.in` so `www.mikelev.in` traffic stops falling into `guerillatech.com`. 2. **Redirects `mikelev.in` Ghost Paths on `guerillatech.com` (`301` -> `[https://mikelev.in](https://mikelev.in)`)**: In `virtualHosts."guerillatech.com"`, any request matching `$new_uri` (from `redirects.map`) or `^/futureproof/` returns a `301` to `[https://mikelev.in](https://mikelev.in)`, draining AhrefsBot's poisoned crawl queue back to the canonical host while keeping `guerillatech.com`'s `/` door (`index.html`, `index.md`, `install.sh`) untouched. 3. **Installs `ripgrep` (`rg`) on Honeybot**: Adds `ripgrep` to `environment.systemPackages` so SSH probes on `honeybot` support `rg`. --- ### **1: BEFORE** (PROBE) Run in `(nix) pipulate $`: ```bash ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== RIPGREP ON HONEYBOT ==="; command -v rg || echo "rg: absent"; echo "=== PROBE WWW.MIKELEV.IN & GUERILLATECH GHOST ==="; curl -skI --resolve www.mikelev.in:443:127.0.0.1 https://www.mikelev.in/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | head -n 5' ``` ### **2: AFTER** (NEXT CONTEXT) Paste into `context.txt` (via `context` or `x`) for `(nix) pipulate $`: ```text context.txt remotes/honeybot/nixos/configuration.nix ! ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== RIPGREP ON HONEYBOT ==="; command -v rg || echo "rg: absent"; echo "=== PROBE WWW.MIKELEV.IN & GUERILLATECH GHOST ==="; curl -skI --resolve www.mikelev.in:443:127.0.0.1 https://www.mikelev.in/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | head -n 5' ``` ### **3: CHANGE** (PATCHES) Apply in `(nix) pipulate $`: ```text Target: remotes/honeybot/nixos/configuration.nix [[[SEARCH]]] sub_filter '__INSTALL_DEFAULT_NAME__' 'guerillatech'; if ($serve_markdown) { rewrite ^ /index.md break; } try_files $npvg_index /index.md =404; ''; }; locations."/" = { extraConfig = '' add_header Vary "Accept" always; if ($serve_markdown) { rewrite ^(.*)/$ $1/index.md break; rewrite ^(.*[^/])$ $1/index.md break; } try_files $uri $uri/index.html $uri/index.md =404; ''; }; [[[DIVIDER]]] sub_filter '__INSTALL_DEFAULT_NAME__' 'guerillatech'; if ($serve_markdown) { rewrite ^ /index.md break; } try_files $npvg_index /index.md =404; ''; }; locations."/" = { extraConfig = '' add_header Vary "Accept" always; if ($new_uri) { return 301 https://mikelev.in$new_uri; } if ($uri ~ ^/futureproof/) { return 301 https://mikelev.in$request_uri; } if ($serve_markdown) { rewrite ^(.*)/$ $1/index.md break; rewrite ^(.*[^/])$ $1/index.md break; } try_files $uri $uri/index.html $uri/index.md =404; ''; }; [[[REPLACE]]] Target: remotes/honeybot/nixos/configuration.nix [[[SEARCH]]] virtualHosts."mikelev.in" = { forceSSL = true; # Force all traffic to HTTPS enableACME = true; # Let's Encrypt magic [[[DIVIDER]]] virtualHosts."mikelev.in" = { default = true; # Explicit default_server on :80 and :443 (beats alphabetical vhost order) forceSSL = true; # Force all traffic to HTTPS enableACME = true; # Let's Encrypt magic serverAliases = [ ("www." + "mikelev.in") ]; [[[REPLACE]]] Target: remotes/honeybot/nixos/configuration.nix [[[SEARCH]]] environment.systemPackages = with pkgs; [ git tmux sqlite alacritty [[[DIVIDER]]] environment.systemPackages = with pkgs; [ git ripgrep tmux sqlite alacritty [[[REPLACE]]] ``` **Ignition** (run in `(nix) pipulate $` after `patch`, `app`, `d`, `m` so the staged config is live on `honeybot` before `compile` runs the AFTER probe): ```bash ./nixops.sh && ssh -t honeybot 'sudo cp ~/nixos-config-staged/* /etc/nixos/ && sudo nixos-rebuild switch' ``` ### **4: PROMPT** Copy into `prompt.md` (via `prompt` or `p`) for `(nix) pipulate $`: ```text Verify the AFTER receipt from Honeybot confirming that mikelev.in owns default_server and www.mikelev.in, guerillatech.com 301-redirects ghost /futureproof/ and $new_uri requests to https://mikelev.in, and ripgrep is installed on honeybot. ``` ### **5: DELIVERABLE** * `mikelev.in` owns `default_server` on ports `80` and `443` and serves `www.mikelev.in` directly instead of leaking `www.mikelev.in` requests into `guerillatech.access.log`. * `guerillatech.com` returns `301 Moved Permanently` to `[https://mikelev.in](https://mikelev.in)` for queued `/futureproof/...` and `$new_uri` ghost paths while continuing to serve its own `/` door (`index.html`, `index.md`, `install.sh`). * `rg` (`ripgrep`) is installed in Honeybot's system PATH. **MikeLev.in**: ## THE AI-EDIT METHOD > Same commands, run twice, one change between them. Where the readings > differ is what the change did; the diff in the middle is the receipt. **1: BEFORE** (PROBE): ```bash On branch main Your branch is up to date with 'origin/main'. nothing to commit, working tree clean GIT repo clean. Take BEFORE reading, make CHANGE, record AFTER diff. (nix) pipulate $ ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== RIPGREP ON HONEYBOT ==="; command -v rg || echo "rg: absent"; echo "=== PROBE WWW.MIKELEV.IN & GUERILLATECH GHOST ==="; curl -skI --resolve www.mikelev.in:443:127.0.0.1 https://www.mikelev.in/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | head -n 5' === NGINX CONF: /nix/store/1v9yjd4635cr9iwhm0rva0xfhw6n2y50-nginx.conf === listen 0.0.0.0:80 ; listen [::0]:80 ; server_name guerillatech.com www.guerillatech.com; listen 0.0.0.0:443 ssl ; listen [::0]:443 ssl ; server_name guerillatech.com www.guerillatech.com; listen 0.0.0.0:80 ; listen [::0]:80 ; server_name levinix.com www.levinix.com; listen 0.0.0.0:443 ssl ; listen [::0]:443 ssl ; server_name levinix.com www.levinix.com; listen 0.0.0.0:80 ; listen [::0]:80 ; server_name levinix.org www.levinix.org; listen 0.0.0.0:443 ssl ; listen [::0]:443 ssl ; server_name levinix.org www.levinix.org; listen 0.0.0.0:80 ; listen [::0]:80 ; server_name levinux.com www.levinux.com; listen 0.0.0.0:443 ssl ; listen [::0]:443 ssl ; server_name levinux.com www.levinux.com; listen 0.0.0.0:80 ; listen [::0]:80 ; server_name mikelev.in ; listen 0.0.0.0:443 ssl ; listen [::0]:443 ssl ; server_name mikelev.in ; listen 0.0.0.0:80 ; listen [::0]:80 ; server_name npvg.org www.npvg.org; listen 0.0.0.0:443 ssl ; listen [::0]:443 ssl ; server_name npvg.org www.npvg.org; listen 0.0.0.0:80 ; listen [::0]:80 ; server_name qamy.ai www.qamy.ai; listen 0.0.0.0:443 ssl ; listen [::0]:443 ssl ; server_name qamy.ai www.qamy.ai; listen 0.0.0.0:80 ; listen [::0]:80 ; server_name rfc9110.org www.rfc9110.org; listen 0.0.0.0:443 ssl ; listen [::0]:443 ssl ; server_name rfc9110.org www.rfc9110.org; listen 0.0.0.0:80 ; listen [::0]:80 ; server_name rfc9111.io www.rfc9111.io; listen 0.0.0.0:443 ssl ; listen [::0]:443 ssl ; server_name rfc9111.io www.rfc9111.io; listen 0.0.0.0:80 ; listen [::0]:80 ; server_name sunpug.io www.sunpug.io; listen 0.0.0.0:443 ssl ; listen [::0]:443 ssl ; server_name sunpug.io www.sunpug.io; === RIPGREP ON HONEYBOT === rg: absent === PROBE WWW.MIKELEV.IN & GUERILLATECH GHOST === HTTP/2 200 server: nginx date: Sun, 25 Oct 2026 22:04:57 GMT content-type: text/x-shellscript vary: Accept, User-Agent HTTP/2 404 server: nginx date: Sun, 25 Oct 2026 22:04:57 GMT content-type: text/html content-length: 146 (nix) pipulate $ ``` **2: AFTER** (NEXT CONTEXT): ```text # # Content 1 # context.txt # # # WE BEGIN AT THE BEGINNING AND WILL GO ON TILL WE COME TO THE END, THEN STOP. # ~/repos/nixos/configuration.nix # ~/repos/nixos/services.nix # ~/repos/nixos/packages.nix # ~/repos/nixos/autognome.py # init.lua # flake.nix # # # HOME-HOSTED (NOT BEHIND CDN) NGINX WEBSERVER HONEYBOT AI OBSERVATORY # nixops.sh # remotes/honeybot/hooks/post-receive # remotes/honeybot/nixos/configuration.nix # remotes/honeybot/scripts/score.py # remotes/honeybot/scripts/card.py # remotes/honeybot/scripts/forest.py # remotes/honeybot/scripts/test_forest.py # remotes/honeybot/scripts/logs.py # remotes/honeybot/scripts/content_loader.py # remotes/honeybot/scripts/db.py # # # THE DATA EVERYONE NEEDS # remotes/honeybot/queries/trapdoor_ips.sql # ! echo "--- WHO HYDRATES THE DOM ---" && cat remotes/honeybot/queries/trapdoor_ips.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db' # remotes/honeybot/queries/content_neg_agents.sql # ! echo "--- WHO NEGOTIATES MARKDOWN ---" && cat remotes/honeybot/queries/content_neg_agents.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db' # # Context 2 # context.txt # remotes/honeybot/nixos/configuration.nix # remotes/honeybot/scripts/logs.py # ! ssh honeybot 'cfg=$(ps -eo args | rg -o "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; rg "server_name |default_server" "$cfg"; echo "=== GUERILLATECH LOG HITS ==="; rg "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; rg "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/" ~/www/mikelev.in/_site/redirects.map' # # Context 3 # context.txt # remotes/honeybot/nixos/configuration.nix # remotes/honeybot/scripts/logs.py # ! ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== GUERILLATECH ACCESS.LOG HITS ==="; grep -E "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== GUERILLATECH VHOST LOG ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; grep -E "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/|/pipulate/nixos/crc32/crc32/|/seo/pipulate/semantic-web/|/nix/nixos/python/initpy/" ~/www/mikelev.in/_site/redirects.map' # Context 4 context.txt remotes/honeybot/nixos/configuration.nix ! ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== RIPGREP ON HONEYBOT ==="; command -v rg || echo "rg: absent"; echo "=== PROBE WWW.MIKELEV.IN & GUERILLATECH GHOST ==="; curl -skI --resolve www.mikelev.in:443:127.0.0.1 https://www.mikelev.in/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | head -n 5' ``` **3: CHANGE** (PATCHES): ```diff On branch main Your branch is up to date with 'origin/main'. nothing to commit, working tree clean GIT repo clean. Take BEFORE reading, make CHANGE, record AFTER diff. (nix) pipulate $ patch (nix) pipulate $ app โœ… DETERMINISTIC PATCH APPLIED: Successfully mutated 'remotes/honeybot/nixos/configuration.nix'. โœ… DETERMINISTIC PATCH APPLIED: Successfully mutated 'remotes/honeybot/nixos/configuration.nix'. โœ… DETERMINISTIC PATCH APPLIED: Successfully mutated 'remotes/honeybot/nixos/configuration.nix'. (nix) pipulate $ d diff --git a/remotes/honeybot/nixos/configuration.nix b/remotes/honeybot/nixos/configuration.nix index f43376a..de61e9b 100644 --- a/remotes/honeybot/nixos/configuration.nix +++ b/remotes/honeybot/nixos/configuration.nix @@ -440,6 +440,12 @@ locations."/" = { extraConfig = '' add_header Vary "Accept" always; + if ($new_uri) { + return 301 https://mikelev.in$new_uri; + } + if ($uri ~ ^/futureproof/) { + return 301 https://mikelev.in$request_uri; + } if ($serve_markdown) { rewrite ^(.*)/$ $1/index.md break; rewrite ^(.*[^/])$ $1/index.md break; @@ -612,8 +618,10 @@ }; virtualHosts."mikelev.in" = { + default = true; # Explicit default_server on :80 and :443 (beats alphabetical vhost order) forceSSL = true; # Force all traffic to HTTPS enableACME = true; # Let's Encrypt magic + serverAliases = [ ("www." + "mikelev.in") ]; # The Web Root root = "/home/mike/www/mikelev.in/_site"; @@ -676,6 +684,7 @@ # $ nix search wget environment.systemPackages = with pkgs; [ git + ripgrep tmux sqlite alacritty (nix) pipulate $ m ๐Ÿ“ Committing: chore: Refactor virtualHost configuration for honeybot [main b96f24c] chore: Refactor virtualHost configuration for honeybot 1 file changed, 9 insertions(+) (nix) pipulate $ git push Enumerating objects: 11, done. Counting objects: 100% (11/11), done. Delta compression using up to 48 threads Compressing objects: 100% (4/4), done. Writing objects: 100% (6/6), 713 bytes | 713.00 KiB/s, done. Total 6 (delta 3), reused 0 (delta 0), pack-reused 0 (from 0) remote: Resolving deltas: 100% (3/3), completed with 3 local objects. To github.com:pipulate/pipulate.git fa79b76..b96f24c main -> main (nix) pipulate $ ``` Ignition: often "exit", "nix develop". Instructions may vary. ```bash On branch main Your branch is up to date with 'origin/main'. nothing to commit, working tree clean GIT repo clean. Take BEFORE reading, make CHANGE, record AFTER diff. (nix) pipulate $ ./nixops.sh && ssh -t honeybot 'sudo cp ~/nixos-config-staged/* /etc/nixos/ && sudo nixos-rebuild switch' ๐Ÿš€ Syncing Hooks... post-receive 100% 3080 595.1KB/s 00:00 ๐Ÿš€ Syncing Scripts (New Location)... sending incremental file list deleting __pycache__/content_loader.cpython-313.pyc __pycache__/ sent 684 bytes received 62 bytes 1,492.00 bytes/sec total size is 317,322 speedup is 425.36 sending incremental file list sent 68 bytes received 12 bytes 160.00 bytes/sec total size is 140,366 speedup is 1,754.58 sending incremental file list sent 59 bytes received 12 bytes 47.33 bytes/sec total size is 645,230 speedup is 9,087.75 ๐Ÿš€ Syncing NPvg pad (one address, two bodies)... sending incremental file list sent 232 bytes received 16 bytes 496.00 bytes/sec total size is 5,440 speedup is 21.94 ๐Ÿš€ Syncing qamy.ai door (npvg.org's shape, its own tree)... sending incremental file list ./ sent 235 bytes received 23 bytes 516.00 bytes/sec total size is 4,646 speedup is 18.01 ๐Ÿš€ Syncing installer to the home-hosted doors (npvg.org qamy.ai levinix.org sunpug.io guerillatech.com rfc9110.org rfc9111.io)... sending incremental file list sent 62 bytes received 12 bytes 148.00 bytes/sec total size is 25,724 speedup is 347.62 sending incremental file list sent 62 bytes received 12 bytes 148.00 bytes/sec total size is 25,724 speedup is 347.62 sending incremental file list sent 62 bytes received 12 bytes 148.00 bytes/sec total size is 25,724 speedup is 347.62 sending incremental file list sent 62 bytes received 12 bytes 148.00 bytes/sec total size is 25,724 speedup is 347.62 sending incremental file list sent 62 bytes received 12 bytes 148.00 bytes/sec total size is 25,724 speedup is 347.62 sending incremental file list sent 62 bytes received 12 bytes 148.00 bytes/sec total size is 25,724 speedup is 347.62 sending incremental file list sent 62 bytes received 12 bytes 148.00 bytes/sec total size is 25,724 speedup is 347.62 ๐Ÿง  Syncing 2nd Brain archive (brain.zip) to qamy.ai and mikelev.in... sending incremental file list sent 62 bytes received 12 bytes 148.00 bytes/sec total size is 46,809,534 speedup is 632,561.27 ๐Ÿš€ Syncing levinux.com deck (remark.js HTML + RFC 9110 index.md)... sending incremental file list sent 203 bytes received 12 bytes 430.00 bytes/sec total size is 720,316 speedup is 3,350.31 sending incremental file list sent 93 bytes received 12 bytes 210.00 bytes/sec total size is 3,964 speedup is 37.75 ๐Ÿš€ Syncing sunpug.io door... sending incremental file list sent 100 bytes received 12 bytes 224.00 bytes/sec total size is 4,791 speedup is 42.78 ๐Ÿš€ Syncing guerillatech.com door... sending incremental file list sent 92 bytes received 12 bytes 69.33 bytes/sec total size is 3,755 speedup is 36.11 ๐Ÿš€ Syncing rfc9110.org door... sending incremental file list sent 92 bytes received 12 bytes 208.00 bytes/sec total size is 3,558 speedup is 34.21 ๐Ÿš€ Syncing rfc9111.io door... sending incremental file list sent 92 bytes received 12 bytes 208.00 bytes/sec total size is 3,729 speedup is 35.86 ๐Ÿš€ Syncing NixOS Config... sending incremental file list configuration.nix sent 2,796 bytes received 329 bytes 2,083.33 bytes/sec total size is 34,575 speedup is 11.06 โœ… Sync Complete. To apply NixOS config: ssh -t mike@[REDACTED_IP] 'sudo cp ~/nixos-config-staged/* /etc/nixos/ && sudo nixos-rebuild switch' [sudo] password for mike: Sorry, try again. [sudo] password for mike: building the system configuration... evaluation warning: The option `services.logind.lidSwitchExternalPower' defined in `/etc/nixos/configuration.nix' has been renamed to `services.logind.settings.Login.HandleLidSwitchExternalPower'. evaluation warning: The option `services.logind.lidSwitch' defined in `/etc/nixos/configuration.nix' has been renamed to `services.logind.settings.Login.HandleLidSwitch'. evaluation warning: The option `services.xserver.displayManager.gdm.wayland' defined in `/etc/nixos/configuration.nix' has been renamed to `services.displayManager.gdm.wayland'. evaluation warning: The option `services.xserver.displayManager.gdm.enable' defined in `/etc/nixos/configuration.nix' has been renamed to `services.displayManager.gdm.enable'. these 20 derivations will be built: /nix/store/8pz08gaq06xaj1c7yd7bv6x7g3h9w1w3-system-path.drv /nix/store/c67b1sj6acils7kjsnz3rgwsdal3qfvi-dbus-1.drv /nix/store/7n2shrynf4f6wbysqfn1yianvy6i6xxh-X-Restart-Triggers-acme-mikelev.in.drv /nix/store/ncn57npkjajlh9hxgmfzrlwlrn8f1ifa-unit-script-acme-mikelev.in-start.drv /nix/store/63g4qr1gji2l84vzrg84k72q6nihyhzn-unit-acme-mikelev.in.service.drv /nix/store/aqfgim3pww8b0sbivgpi61b6gdv0wnyl-nginx.conf.drv /nix/store/5kayha8853nrhbxkskrq14i284kc5qbv-unit-script-nginx-pre-start.drv /nix/store/9dq9d05xavqlfw922d4f4nx8d8p2dln7-unit-nginx.service.drv /nix/store/90l30n6625px6252w63vk57cgqb4j1y4-X-Restart-Triggers-dbus.drv /nix/store/aqqdhmkfcrww0ahkybqq104n613q3gij-unit-dbus.service.drv /nix/store/4kj62vzz5xpbal7w6m8i2229wpkwd6na-unit-script-acme-order-renew-mikelev.in-start.drv /nix/store/ri3wg5hd4x2mawlzj9vv6vzpjb1s01hg-unit-acme-order-renew-mikelev.in.service.drv /nix/store/dlkgzic9ji5z146fbspg9fk5z3hnpmmh-X-Restart-Triggers-polkit.drv /nix/store/wr6h0h2ibzf8x4qgrngw2kbgq7d1zz0h-unit-polkit.service.drv /nix/store/yrvdb3mjjkx7hmiwn2785adhahnf79xl-unit-accounts-daemon.service.drv /nix/store/ciaj8fpvgna3g21l4lvqlgs7bclfy26s-system-units.drv /nix/store/1bcfcrx9r0kzlgr6rawy5blp8gxv7j6s-unit-dbus.service.drv /nix/store/qzdhk80g3hjxyrcqalcs8f5a53zjl3h7-user-units.drv /nix/store/0afbncfl7zz9cmpb1prw9dnhq8jnvzhi-etc.drv /nix/store/nswq52vj0n7yfc1ig0w373nnn4ljklfs-nixos-system-honeybot-26.05pre913595.c6245e83d836.drv this path will be fetched (1.54 MiB download, 6.42 MiB unpacked): /nix/store/2fngznir58zqpvg2wl7iy5amlsbzhf9p-ripgrep-15.1.0 copying path '/nix/store/2fngznir58zqpvg2wl7iy5amlsbzhf9p-ripgrep-15.1.0' from 'https://cache.nixos.org'... building '/nix/store/7n2shrynf4f6wbysqfn1yianvy6i6xxh-X-Restart-Triggers-acme-mikelev.in.drv'... building '/nix/store/aqfgim3pww8b0sbivgpi61b6gdv0wnyl-nginx.conf.drv'... building '/nix/store/ncn57npkjajlh9hxgmfzrlwlrn8f1ifa-unit-script-acme-mikelev.in-start.drv'... building '/nix/store/4kj62vzz5xpbal7w6m8i2229wpkwd6na-unit-script-acme-order-renew-mikelev.in-start.drv'... building '/nix/store/8pz08gaq06xaj1c7yd7bv6x7g3h9w1w3-system-path.drv'... building '/nix/store/63g4qr1gji2l84vzrg84k72q6nihyhzn-unit-acme-mikelev.in.service.drv'... building '/nix/store/ri3wg5hd4x2mawlzj9vv6vzpjb1s01hg-unit-acme-order-renew-mikelev.in.service.drv'... [context] INFO Can't find variable 'new_uri' [context] INFO Can't find variable 'new_uri' ==================== Results =================== No issues found. ==================== Summary =================== Total issues: Unspecified: 0 Low: 0 Medium: 0 High: 0 building '/nix/store/5kayha8853nrhbxkskrq14i284kc5qbv-unit-script-nginx-pre-start.drv'... building '/nix/store/9dq9d05xavqlfw922d4f4nx8d8p2dln7-unit-nginx.service.drv'... created 9768 symlinks in user environment gtk-update-icon-cache: Cache file created successfully. building '/nix/store/dlkgzic9ji5z146fbspg9fk5z3hnpmmh-X-Restart-Triggers-polkit.drv'... building '/nix/store/c67b1sj6acils7kjsnz3rgwsdal3qfvi-dbus-1.drv'... building '/nix/store/yrvdb3mjjkx7hmiwn2785adhahnf79xl-unit-accounts-daemon.service.drv'... building '/nix/store/wr6h0h2ibzf8x4qgrngw2kbgq7d1zz0h-unit-polkit.service.drv'... building '/nix/store/90l30n6625px6252w63vk57cgqb4j1y4-X-Restart-Triggers-dbus.drv'... building '/nix/store/1bcfcrx9r0kzlgr6rawy5blp8gxv7j6s-unit-dbus.service.drv'... building '/nix/store/aqqdhmkfcrww0ahkybqq104n613q3gij-unit-dbus.service.drv'... building '/nix/store/qzdhk80g3hjxyrcqalcs8f5a53zjl3h7-user-units.drv'... building '/nix/store/ciaj8fpvgna3g21l4lvqlgs7bclfy26s-system-units.drv'... building '/nix/store/0afbncfl7zz9cmpb1prw9dnhq8jnvzhi-etc.drv'... building '/nix/store/nswq52vj0n7yfc1ig0w373nnn4ljklfs-nixos-system-honeybot-26.05pre913595.c6245e83d836.drv'... stopping the following units: accounts-daemon.service, acme-mikelev.in.service activating the configuration... setting up /etc... reloading user units for mike... restarting sysinit-reactivation.target reloading the following units: dbus.service restarting the following units: nginx.service, polkit.service starting the following units: accounts-daemon.service, acme-mikelev.in.service the following new units were started: acme-order-renew-mikelev.in.service, NetworkManager-dispatcher.service Done. The new configuration is /nix/store/akbs7qmc3j8pg1s3kdw3d94hh18ci5ya-nixos-system-honeybot-26.05pre913595.c6245e83d836 Connection to [REDACTED_IP] closed. (nix) pipulate $ ``` **4: PROMPT**: Verify the AFTER receipt from Honeybot confirming that mikelev.in owns default_server and www.mikelev.in, guerillatech.com 301-redirects ghost /futureproof/ and $new_uri requests to https://mikelev.in, and ripgrep is installed on honeybot. **5: DELIVERABLE**: Wow, okay that nixops upgrade happened and it really has nothing to do with the slide show. I might want to wait a few minutes for the new log file information under the new Nix infrastructure to have a chance to make a difference on the logging of the information coming in before I compile the context. Just as a reminder for people following along, or trying to, the Context Compiler has a static reading of the "before" conditions that you see above. It also has a test set up to take those readings again as the "after" conditions of the test being conducted. The test started being conducted the moment I did that ignition and so the longer I kill time typing here explaining, the better the data that will have accumulated in the log file for the second test when I lift this article up again with a Hi-Ya! and compile. Okay, that's long enough. Let's see. Gemini? **Gemini 4 Argon High**: Context verified. **TL;DR**: All three changes in `remotes/honeybot/nixos/configuration.nix` are verified by the BEFORE/AFTER straddle in this compile: 1. **The Smoking Gun in the `www.mikelev.in` BEFORE Receipt**: Look at what `curl -skI --resolve www.mikelev.in:443:127.0.0.1 [https://www.mikelev.in/](https://www.mikelev.in/)` returned **before** vs. **after** the patch: ```text BEFORE (22:04:57 GMT): HTTP/2 200 content-type: text/x-shellscript vary: Accept, User-Agent AFTER (22:11:48 GMT): HTTP/2 200 content-type: text/html content-length: 28959 ``` Before the patch, a `curl` to `[https://www.mikelev.in/](https://www.mikelev.in/)` fell through to the alphabetical first vhost (`guerillatech.com`), matched `~*^curl`, and served `guerillatech`'s `install.sh` (`text/x-shellscript`). After the patch, `server_name mikelev.in www.mikelev.in;` and `default_server` on `:80` and `:443` are live in `/nix/store/rjjv2lfnvk5fp8jdy81qzrjbixzsd380-nginx.conf` (with Let's Encrypt automatically updating the cert via `acme-order-renew-mikelev.in.service`), and `[https://www.mikelev.in/](https://www.mikelev.in/)` serves the 28,959-byte `mikelev.in` homepage. 2. **Ghost Paths on `guerillatech.com` Flip from `404` to `301**`: * **BEFORE**: `[https://guerillatech.com/futureproof/the-door-names-the-folder/](https://guerillatech.com/futureproof/the-door-names-the-folder/)` returned `HTTP/2 404` (`content-length: 146`). * **AFTER**: Returns `HTTP/2 301` (`content-length: 162`), redirecting AhrefsBot's queued crawl frontier to `[https://mikelev.in](https://mikelev.in)`. 3. **`ripgrep` on Honeybot**: * **BEFORE**: `rg: absent` * **AFTER**: `/run/current-system/sw/bin/rg` (`ripgrep-15.1.0`). ### Why the Live Log Tail Didn't Appear in This Compile In `context.txt`, `Context 3` (which tailed `guerillatech.access.log`) was commented out when `Context 4` (which ran the `nginx.conf` + `curl` check) was added. Now that `rg` is installed on `honeybot` and traffic has accumulated since the `18:11` EDT switchover, the read-only probe below uses `rg` on `honeybot` to capture: * the post-switch `301` stream in `/var/log/nginx/guerillatech.access.log`, * confirmation that `Host:"www.mikelev.in"` no longer lands in `guerillatech.access.log`, and * a check across all other `*.access.log` door files for any `/futureproof/` 404s. --- ### **1: BEFORE** (PROBE) Run in `(nix) pipulate $`: ```bash ssh honeybot 'echo "=== GUERILLATECH VHOST LOG (LAST 25) ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== REDIRECT LOCATION HEADER CHECK ==="; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | rg -i "^(HTTP/|location:)"; echo "=== OTHER DOOR LOGS WITH /futureproof/ HITS ==="; rg -c "/futureproof/" /var/log/nginx/*.access.log || true' ``` ### **2: AFTER** (NEXT CONTEXT) Paste into `context.txt` (via `context` or `x`) for `(nix) pipulate $`: ```text context.txt remotes/honeybot/nixos/configuration.nix ! ssh honeybot 'echo "=== GUERILLATECH VHOST LOG (LAST 25) ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== REDIRECT LOCATION HEADER CHECK ==="; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | rg -i "^(HTTP/|location:)"; echo "=== OTHER DOOR LOGS WITH /futureproof/ HITS ==="; rg -c "/futureproof/" /var/log/nginx/*.access.log || true' ``` ### **3: CHANGE** (PATCHES) No repo patches required on this turn. No ignition required. ### **4: PROMPT** Copy into `prompt.md` (via `prompt` or `p`) for `(nix) pipulate $`: ```text Inspect the post-switch guerillatech.access.log tail and the cross-door /futureproof/ hit counts from Honeybot. If any other door domain has queued /futureproof/ 404s, emit the SEARCH/REPLACE patch; otherwise confirm the system is clean and ready to dismount. ``` ### **5: DELIVERABLE** * Live log receipt from `/var/log/nginx/guerillatech.access.log` showing `AhrefsBot` receiving `301`s instead of `404`s and `www.mikelev.in` no longer leaking into `guerillatech.access.log`. * Cross-door census of `/var/log/nginx/*.access.log` confirming whether any other door vhost needs the same ghost-redirect guard before dismounting. **MikeLev.in**: Was there anything else I was supposed to do? Look at the screenshot I just took. ## THE AI-EDIT METHOD > Same commands, run twice, one change between them. Where the readings > differ is what the change did; the diff in the middle is the receipt. **1: BEFORE** (PROBE): ```bash On branch main Your branch is up to date with 'origin/main'. nothing to commit, working tree clean GIT repo clean. Take BEFORE reading, make CHANGE, record AFTER diff. (nix) pipulate $ ssh honeybot 'echo "=== GUERILLATECH VHOST LOG (LAST 25) ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== REDIRECT LOCATION HEADER CHECK ==="; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | rg -i "^(HTTP/|location:)"; echo "=== OTHER DOOR LOGS WITH /futureproof/ HITS ==="; rg -c "/futureproof/" /var/log/nginx/*.access.log || true' === GUERILLATECH VHOST LOG (LAST 25) === [REDACTED_IP] - - [25/Oct/2026:18:17:12 -0400] "GET /nixos/forever-machine/nix/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:17:23 -0400] "GET /nix/nix-flakes/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:17:34 -0400] "GET /pipulate/jupyter-notebooks/jupyter-notebooks/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:17:45 -0400] "GET /nix/context-engineering/ai-test-automation/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:17:56 -0400] "GET /jekyll/jekyll/awk/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:18:07 -0400] "GET /nix/pipulate/pipulate/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:18:18 -0400] "GET /pipulate/jupyter-notebooks/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:18:29 -0400] "GET /nixos/web-scraping/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:18:40 -0400] "GET /nix/nix/python-packaging/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:18:51 -0400] "GET /prompt-engineering/nix/ai-workflows/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:19:02 -0400] "GET /jupyter-notebooks/code-refactoring/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:19:13 -0400] "GET /pipulate/pipulate/model-context-protocol-mcp/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" 127.0.0.1 - - [25/Oct/2026:18:19:14 -0400] "HEAD /futureproof/the-door-names-the-folder/ HTTP/2.0" 301 0 "-" "curl/8.17.0" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"-" [REDACTED_IP] - - [25/Oct/2026:18:19:24 -0400] "GET /nix/nixos/tts/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:19:35 -0400] "GET /nix-flakes/nixos/unix/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:19:46 -0400] "GET /nix/nixos/pandas/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:19:57 -0400] "GET /prompt-engineering/pipulate/model-context-protocol-mcp/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:20:08 -0400] "GET /prompt-engineering/pipulate/ai-tool-calling/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:20:19 -0400] "GET /nix/nixos/idempotency/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:20:30 -0400] "GET /nix/nixos/accessibility-tree/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:20:41 -0400] "GET /nix/context-engineering/master-prompt/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:20:52 -0400] "GET /nix/jupyter-notebooks/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:21:03 -0400] "GET /nixos/nixos-rebuild/generations/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:21:14 -0400] "GET /nix/deterministic-patching/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:21:24 -0400] "GET /python/future-proofing/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" === REDIRECT LOCATION HEADER CHECK === HTTP/2 301 location: https://mikelev.in/futureproof/the-door-names-the-folder/ === OTHER DOOR LOGS WITH /futureproof/ HITS === /var/log/nginx/guerillatech.access.log:1699 /var/log/nginx/levinix.access.log:321 (nix) pipulate $ ``` **2: AFTER** (NEXT CONTEXT): ```text # # Content 1 # context.txt # # # WE BEGIN AT THE BEGINNING AND WILL GO ON TILL WE COME TO THE END, THEN STOP. # ~/repos/nixos/configuration.nix # ~/repos/nixos/services.nix # ~/repos/nixos/packages.nix # ~/repos/nixos/autognome.py # init.lua # flake.nix # # # HOME-HOSTED (NOT BEHIND CDN) NGINX WEBSERVER HONEYBOT AI OBSERVATORY # nixops.sh # remotes/honeybot/hooks/post-receive # remotes/honeybot/nixos/configuration.nix # remotes/honeybot/scripts/score.py # remotes/honeybot/scripts/card.py # remotes/honeybot/scripts/forest.py # remotes/honeybot/scripts/test_forest.py # remotes/honeybot/scripts/logs.py # remotes/honeybot/scripts/content_loader.py # remotes/honeybot/scripts/db.py # # # THE DATA EVERYONE NEEDS # remotes/honeybot/queries/trapdoor_ips.sql # ! echo "--- WHO HYDRATES THE DOM ---" && cat remotes/honeybot/queries/trapdoor_ips.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db' # remotes/honeybot/queries/content_neg_agents.sql # ! echo "--- WHO NEGOTIATES MARKDOWN ---" && cat remotes/honeybot/queries/content_neg_agents.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db' # # Context 2 # context.txt # remotes/honeybot/nixos/configuration.nix # remotes/honeybot/scripts/logs.py # ! ssh honeybot 'cfg=$(ps -eo args | rg -o "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; rg "server_name |default_server" "$cfg"; echo "=== GUERILLATECH LOG HITS ==="; rg "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; rg "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/" ~/www/mikelev.in/_site/redirects.map' # # Context 3 # context.txt # remotes/honeybot/nixos/configuration.nix # remotes/honeybot/scripts/logs.py # ! ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== GUERILLATECH ACCESS.LOG HITS ==="; grep -E "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== GUERILLATECH VHOST LOG ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; grep -E "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/|/pipulate/nixos/crc32/crc32/|/seo/pipulate/semantic-web/|/nix/nixos/python/initpy/" ~/www/mikelev.in/_site/redirects.map' # # Context 4 # context.txt # remotes/honeybot/nixos/configuration.nix # ! ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== RIPGREP ON HONEYBOT ==="; command -v rg || echo "rg: absent"; echo "=== PROBE WWW.MIKELEV.IN & GUERILLATECH GHOST ==="; curl -skI --resolve www.mikelev.in:443:127.0.0.1 https://www.mikelev.in/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | head -n 5' # Context 5 context.txt remotes/honeybot/nixos/configuration.nix ! ssh honeybot 'echo "=== GUERILLATECH VHOST LOG (LAST 25) ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== REDIRECT LOCATION HEADER CHECK ==="; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | rg -i "^(HTTP/|location:)"; echo "=== OTHER DOOR LOGS WITH /futureproof/ HITS ==="; rg -c "/futureproof/" /var/log/nginx/*.access.log || true' ``` **3: CHANGE** (PATCHES): None this turn. Ignition: often "exit", "nix develop". Instructions may vary. Inspect the post-switch guerillatech.access.log tail and the cross-door /futureproof/ hit counts from Honeybot. If any other door domain has queued /futureproof/ 404s, emit the SEARCH/REPLACE patch; otherwise confirm the system is clean and ready to dismount. **5: DELIVERABLE**: It looks like the same problem is going on. Is there any way to flush it like maybe it's some cache. Or are we missing something? ## Remote Crawler Queues vs. Local Caches: Catching Legacy Category Ghosts **Gemini 4 Argon High**: Context verified. **TL;DR**: You are seeing two things in the new screenshots: 1. **Why `AhrefsBot` keeps requesting `guerillatech.com` URLs (No local cacheโ€”it is Ahrefs' remote crawl queue)**: Those `GET` requests are arriving live over the Internet from Ahrefs' crawler cluster (`51.68.*`, `54.37.*`, `92.222.*`, `37.59.*`, `176.31.*`, `5.39.*`, `94.23.*`) at 1 request every ~11 seconds. While `guerillatech.com` (and `levinix.org`, which has `321` hits in `/var/log/nginx/levinix.access.log`) pointed at Honeybot's IP before their `virtualHosts` blocks existed, Nginx served `mikelev.in`'s site as the default server. AhrefsBot ingested `mikelev.in`'s internal links under `[https://guerillatech.com/](https://guerillatech.com/)...` into **Ahrefs' own database**. There is no cache on Honeybot to flush; AhrefsBot simply drains its remote queue by requesting each URL and updating its index when it receives a `301`. 2. **What we missed in the first redirect rule (`/futureproof/` vs. legacy category paths)**: * Look at your second screenshot at `[18:21:33]`: `/futureproof/the-door-names-the-folder/` returned `[301]` in white, and **zero `/futureproof/` URLs have 404'd on `guerillatech.com` since the rebuild**. * Every remaining red `[404]` on `guerillatech.com` in your screenshots (`/pipulate/pipulate/model-context-protocol-mcp/`, `/nix/nixos/tts/`, `/nix/nixos/pandas/`, `/prompt-engineering/pipulate/ai-tool-calling/`, `/nix/nixos/nbstripout/`, `/nixos/nix-flakes/`, `/htmx/nix-flakes/websockets/`) is an **older category-style path** that neither starts with `/futureproof/` nor exists in `redirects.map` yet (notice `mikelev.in` is also 404ing on those same legacy category patterns at `[18:19:35]`, `[18:19:43]`, `[18:20:02]`, `[18:21:38]`, and `[18:23:07]`). ```text WHY THOSE PATHS STILL 404'D ON GUERILLATECH.COM: GET /futureproof/... โ”€โ”€โ–บ matched ^/futureproof/ โ”€โ”€โ–บ 301 to mikelev.in (FIXED) GET /nix/nixos/nbstripout/ โ”€โ”€โ–บ not ^/futureproof/, not in redirects.map โ”€โ”€โ–บ fell through to guerillatech try_files =404 (MISSED) THE FIX FOR SINGLE-PAGE DOORS (guerillatech, levinix, npvg, qamy, rfc9110, rfc9111, sunpug): GET / โ”€โ”€โ–บ locations."= /" serves index.html / index.md / install.sh (200) GET /index.html, /index.md, /install.sh โ”€โ–บ file exists in door root (-e $request_filename) (200) GET โ”€โ”€โ–บ if ($new_uri) โ”€โ”€โ–บ 301 https://mikelev.in$new_uri โ”€โ”€โ–บ if (!-e $request_filename) โ”€โ–บ 301 https://mikelev.in$request_uri ``` Replacing `if ($uri ~ ^/futureproof/)` with `if (!-e $request_filename)` across the single-page doors means **any** path that is not a real file in `/home/mike/www/` immediately returns `301` to `[https://mikelev.in](https://mikelev.in)` (using `$new_uri` if it is in `redirects.map`, or `$request_uri` otherwise). --- ### **1: BEFORE** (PROBE) Run in `(nix) pipulate $`: ```bash ssh honeybot 'echo "=== LEGACY CATEGORY PATH ON GUERILLATECH & LEVINIX ==="; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/nix/nixos/nbstripout/ | rg -i "^(HTTP/|location:)"; curl -skI --resolve levinix.org:443:127.0.0.1 https://levinix.org/futureproof/the-door-names-the-folder/ | rg -i "^(HTTP/|location:)"; echo "=== DOOR ROOT 200 CHECK ==="; curl -skI -A "Mozilla/5.0" --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/ | head -n 5' ``` ### **2: AFTER** (NEXT CONTEXT) Paste into `context.txt` (via `context` or `x`) for `(nix) pipulate $`: ```text context.txt remotes/honeybot/nixos/configuration.nix ! ssh honeybot 'echo "=== LEGACY CATEGORY PATH ON GUERILLATECH & LEVINIX ==="; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/nix/nixos/nbstripout/ | rg -i "^(HTTP/|location:)"; curl -skI --resolve levinix.org:443:127.0.0.1 https://levinix.org/futureproof/the-door-names-the-folder/ | rg -i "^(HTTP/|location:)"; echo "=== DOOR ROOT 200 CHECK ==="; curl -skI -A "Mozilla/5.0" --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/ | head -n 5' ``` ### **3: CHANGE** (PATCHES) Apply in `(nix) pipulate $`: ```text Target: remotes/honeybot/nixos/configuration.nix [[[SEARCH]]] locations."/" = { extraConfig = '' try_files $uri $uri/index.html =404; ''; }; }; # THE QAMY DOOR (2026-09-29). npvg.org's door with its name and alias, [[[DIVIDER]]] locations."/" = { extraConfig = '' if ($new_uri) { return 301 https://mikelev.in$new_uri; } if (!-e $request_filename) { return 301 https://mikelev.in$request_uri; } try_files $uri $uri/index.html =404; ''; }; }; # THE QAMY DOOR (2026-09-29). npvg.org's door with its name and alias, [[[REPLACE]]] Target: remotes/honeybot/nixos/configuration.nix [[[SEARCH]]] locations."/" = { extraConfig = '' try_files $uri $uri/index.html =404; ''; }; }; # THE LEVINIX DOOR (2026-10-21): Target 4 in blogs.nix (WORA Nix Flake [[[DIVIDER]]] locations."/" = { extraConfig = '' if ($new_uri) { return 301 https://mikelev.in$new_uri; } if (!-e $request_filename) { return 301 https://mikelev.in$request_uri; } try_files $uri $uri/index.html =404; ''; }; }; # THE LEVINIX DOOR (2026-10-21): Target 4 in blogs.nix (WORA Nix Flake [[[REPLACE]]] Target: remotes/honeybot/nixos/configuration.nix [[[SEARCH]]] locations."/" = { extraConfig = '' add_header Vary "Accept" always; if ($serve_markdown) { rewrite ^(.*)/$ $1/index.md break; rewrite ^(.*[^/])$ $1/index.md break; } try_files $uri $uri/index.html $uri/index.md =404; ''; }; }; # THE GUERILLATECH DOOR (2026-10-25): Target 5 in blogs.nix (Nix vs. Docker [[[DIVIDER]]] locations."/" = { extraConfig = '' add_header Vary "Accept" always; if ($new_uri) { return 301 https://mikelev.in$new_uri; } if (!-e $request_filename) { return 301 https://mikelev.in$request_uri; } if ($serve_markdown) { rewrite ^(.*)/$ $1/index.md break; rewrite ^(.*[^/])$ $1/index.md break; } try_files $uri $uri/index.html $uri/index.md =404; ''; }; }; # THE GUERILLATECH DOOR (2026-10-25): Target 5 in blogs.nix (Nix vs. Docker [[[REPLACE]]] Target: remotes/honeybot/nixos/configuration.nix [[[SEARCH]]] locations."/" = { extraConfig = '' add_header Vary "Accept" always; if ($new_uri) { return 301 https://mikelev.in$new_uri; } if ($uri ~ ^/futureproof/) { return 301 https://mikelev.in$request_uri; } if ($serve_markdown) { rewrite ^(.*)/$ $1/index.md break; rewrite ^(.*[^/])$ $1/index.md break; } try_files $uri $uri/index.html $uri/index.md =404; ''; }; }; # THE RFC 9110 DOOR (2026-10-25): Target 6 in blogs.nix (Proactive HTTP [[[DIVIDER]]] locations."/" = { extraConfig = '' add_header Vary "Accept" always; if ($new_uri) { return 301 https://mikelev.in$new_uri; } if (!-e $request_filename) { return 301 https://mikelev.in$request_uri; } if ($serve_markdown) { rewrite ^(.*)/$ $1/index.md break; rewrite ^(.*[^/])$ $1/index.md break; } try_files $uri $uri/index.html $uri/index.md =404; ''; }; }; # THE RFC 9110 DOOR (2026-10-25): Target 6 in blogs.nix (Proactive HTTP [[[REPLACE]]] Target: remotes/honeybot/nixos/configuration.nix [[[SEARCH]]] locations."/" = { extraConfig = '' add_header Vary "Accept" always; if ($serve_markdown) { rewrite ^(.*)/$ $1/index.md break; rewrite ^(.*[^/])$ $1/index.md break; } try_files $uri $uri/index.html $uri/index.md =404; ''; }; }; # THE RFC 9111 DOOR (2026-10-25): Target 7 in blogs.nix (Retiring wasteful [[[DIVIDER]]] locations."/" = { extraConfig = '' add_header Vary "Accept" always; if ($new_uri) { return 301 https://mikelev.in$new_uri; } if (!-e $request_filename) { return 301 https://mikelev.in$request_uri; } if ($serve_markdown) { rewrite ^(.*)/$ $1/index.md break; rewrite ^(.*[^/])$ $1/index.md break; } try_files $uri $uri/index.html $uri/index.md =404; ''; }; }; # THE RFC 9111 DOOR (2026-10-25): Target 7 in blogs.nix (Retiring wasteful [[[REPLACE]]] Target: remotes/honeybot/nixos/configuration.nix [[[SEARCH]]] locations."/" = { extraConfig = '' add_header Vary "Accept" always; if ($serve_markdown) { rewrite ^(.*)/$ $1/index.md break; rewrite ^(.*[^/])$ $1/index.md break; } try_files $uri $uri/index.html $uri/index.md =404; ''; }; }; # THE SUNPUG DOOR (2026-10-24): SVNPvg -> SUNPug (the friendly vampire / [[[DIVIDER]]] locations."/" = { extraConfig = '' add_header Vary "Accept" always; if ($new_uri) { return 301 https://mikelev.in$new_uri; } if (!-e $request_filename) { return 301 https://mikelev.in$request_uri; } if ($serve_markdown) { rewrite ^(.*)/$ $1/index.md break; rewrite ^(.*[^/])$ $1/index.md break; } try_files $uri $uri/index.html $uri/index.md =404; ''; }; }; # THE SUNPUG DOOR (2026-10-24): SVNPvg -> SUNPug (the friendly vampire / [[[REPLACE]]] Target: remotes/honeybot/nixos/configuration.nix [[[SEARCH]]] locations."/" = { extraConfig = '' add_header Vary "Accept" always; if ($serve_markdown) { rewrite ^(.*)/$ $1/index.md break; rewrite ^(.*[^/])$ $1/index.md break; } try_files $uri $uri/index.html $uri/index.md =404; ''; }; }; # THE LEVINIX.COM REDIRECT (2026-10-23): Retires the .com in favor of the [[[DIVIDER]]] locations."/" = { extraConfig = '' add_header Vary "Accept" always; if ($new_uri) { return 301 https://mikelev.in$new_uri; } if (!-e $request_filename) { return 301 https://mikelev.in$request_uri; } if ($serve_markdown) { rewrite ^(.*)/$ $1/index.md break; rewrite ^(.*[^/])$ $1/index.md break; } try_files $uri $uri/index.html $uri/index.md =404; ''; }; }; # THE LEVINIX.COM REDIRECT (2026-10-23): Retires the .com in favor of the [[[REPLACE]]] ``` **Ignition** (run in `(nix) pipulate $` after `patch`, `app`, `d`, `m` so the updated door rules activate on `honeybot` before `compile`): ```bash ./nixops.sh && ssh -t honeybot 'sudo cp ~/nixos-config-staged/* /etc/nixos/ && sudo nixos-rebuild switch' ``` ### **4: PROMPT** Copy into `prompt.md` (via `prompt` or `p`) for `(nix) pipulate $`: ```text Verify the AFTER receipt confirming that legacy category paths like /nix/nixos/nbstripout/ on guerillatech.com and /futureproof/ paths on levinix.org now return 301 to https://mikelev.in while root door requests (HTML and curl installer) continue to return 200 OK. ``` ### **5: DELIVERABLE** * Every non-existent path on all seven single-page doors (`npvg.org`, `qamy.ai`, `levinix.org`, `guerillatech.com`, `rfc9110.org`, `rfc9111.io`, `sunpug.io`)โ€”including legacy category paths like `/nix/nixos/nbstripout/` and `/prompt-engineering/pipulate/ai-tool-calling/`โ€”returns `301 Moved Permanently` to `[https://mikelev.in](https://mikelev.in)` instead of `404` on the door domain. * Root door requests (`/` for HTML, `Accept: text/markdown`, and `curl` installer) continue returning `200 OK`. **MikeLev.in**: ## THE AI-EDIT METHOD > Same commands, run twice, one change between them. Where the readings > differ is what the change did; the diff in the middle is the receipt. **1: BEFORE** (PROBE): ```bash On branch main Your branch is up to date with 'origin/main'. nothing to commit, working tree clean GIT repo clean. Take BEFORE reading, make CHANGE, record AFTER diff. (nix) pipulate $ ssh honeybot 'echo "=== LEGACY CATEGORY PATH ON GUERILLATECH & LEVINIX ==="; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/nix/nixos/nbstripout/ | rg -i "^(HTTP/|location:)"; curl -skI --resolve levinix.org:443:127.0.0.1 https://levinix.org/futureproof/the-door-names-the-folder/ | rg -i "^(HTTP/|location:)"; echo "=== DOOR ROOT 200 CHECK ==="; curl -skI -A "Mozilla/5.0" --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/ | head -n 5' === LEGACY CATEGORY PATH ON GUERILLATECH & LEVINIX === HTTP/2 404 HTTP/2 404 === DOOR ROOT 200 CHECK === HTTP/2 200 server: nginx date: Sun, 25 Oct 2026 22:31:53 GMT content-type: text/html vary: Accept-Encoding HTTP/2 200 server: nginx date: Sun, 25 Oct 2026 22:31:53 GMT content-type: text/x-shellscript vary: Accept, User-Agent (nix) pipulate $ ``` **2: AFTER** (NEXT CONTEXT): I'm also now showing you the Jekyll publishing pipeline in case it has any bearing. I should have shown that from the start because it does the redirect mappings. ```text # # Content 1 # context.txt # # # WE BEGIN AT THE BEGINNING AND WILL GO ON TILL WE COME TO THE END, THEN STOP. # ~/repos/nixos/configuration.nix # ~/repos/nixos/services.nix # ~/repos/nixos/packages.nix # ~/repos/nixos/autognome.py # init.lua # flake.nix # # # HOME-HOSTED (NOT BEHIND CDN) NGINX WEBSERVER HONEYBOT AI OBSERVATORY # nixops.sh # remotes/honeybot/hooks/post-receive # remotes/honeybot/nixos/configuration.nix # remotes/honeybot/scripts/score.py # remotes/honeybot/scripts/card.py # remotes/honeybot/scripts/forest.py # remotes/honeybot/scripts/test_forest.py # remotes/honeybot/scripts/logs.py # remotes/honeybot/scripts/content_loader.py # remotes/honeybot/scripts/db.py # # # THE DATA EVERYONE NEEDS # remotes/honeybot/queries/trapdoor_ips.sql # ! echo "--- WHO HYDRATES THE DOM ---" && cat remotes/honeybot/queries/trapdoor_ips.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db' # remotes/honeybot/queries/content_neg_agents.sql # ! echo "--- WHO NEGOTIATES MARKDOWN ---" && cat remotes/honeybot/queries/content_neg_agents.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db' # # Context 2 # context.txt # remotes/honeybot/nixos/configuration.nix # remotes/honeybot/scripts/logs.py # ! ssh honeybot 'cfg=$(ps -eo args | rg -o "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; rg "server_name |default_server" "$cfg"; echo "=== GUERILLATECH LOG HITS ==="; rg "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; rg "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/" ~/www/mikelev.in/_site/redirects.map' # # Context 3 # context.txt # remotes/honeybot/nixos/configuration.nix # remotes/honeybot/scripts/logs.py # ! ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== GUERILLATECH ACCESS.LOG HITS ==="; grep -E "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== GUERILLATECH VHOST LOG ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; grep -E "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/|/pipulate/nixos/crc32/crc32/|/seo/pipulate/semantic-web/|/nix/nixos/python/initpy/" ~/www/mikelev.in/_site/redirects.map' # # Context 4 # context.txt # remotes/honeybot/nixos/configuration.nix # ! ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== RIPGREP ON HONEYBOT ==="; command -v rg || echo "rg: absent"; echo "=== PROBE WWW.MIKELEV.IN & GUERILLATECH GHOST ==="; curl -skI --resolve www.mikelev.in:443:127.0.0.1 https://www.mikelev.in/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | head -n 5' # # Context 5 # context.txt # remotes/honeybot/nixos/configuration.nix # ! ssh honeybot 'echo "=== GUERILLATECH VHOST LOG (LAST 25) ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== REDIRECT LOCATION HEADER CHECK ==="; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | rg -i "^(HTTP/|location:)"; echo "=== OTHER DOOR LOGS WITH /futureproof/ HITS ==="; rg -c "/futureproof/" /var/log/nginx/*.access.log || true' # Context 6 context.txt # THE JEKYLL BLOG LIKE A HACKER (INVENTED SKILL.md & AGENTS.md FORMAT) PUBLISHING PIPELINE ~/repos/nixos/blogs.nix ~/.config/pipulate/blogs.json scripts/articles/publishizer.py scripts/articles/common.py scripts/articles/articleizer.py scripts/articles/link_injector.py scripts/articles/build_knowledge_graph.py scripts/articles/editing_prompt.txt scripts/articles/sanitizer.py scripts/articles/contextualizer.py scripts/articles/generate_llms_txt.py scripts/articles/generate_post_nav.py remotes/honeybot/nixos/configuration.nix ! ssh honeybot 'echo "=== LEGACY CATEGORY PATH ON GUERILLATECH & LEVINIX ==="; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/nix/nixos/nbstripout/ | rg -i "^(HTTP/|location:)"; curl -skI --resolve levinix.org:443:127.0.0.1 https://levinix.org/futureproof/the-door-names-the-folder/ | rg -i "^(HTTP/|location:)"; echo "=== DOOR ROOT 200 CHECK ==="; curl -skI -A "Mozilla/5.0" --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/ | head -n 5' ``` **3: CHANGE** (PATCHES): I'm still forging ahead with the changes though. We can always revert. ```diff On branch main Your branch is up to date with 'origin/main'. nothing to commit, working tree clean GIT repo clean. Take BEFORE reading, make CHANGE, record AFTER diff. (nix) pipulate $ patch (nix) pipulate $ app โœ… DETERMINISTIC PATCH APPLIED: Successfully mutated 'remotes/honeybot/nixos/configuration.nix'. โœ… DETERMINISTIC PATCH APPLIED: Successfully mutated 'remotes/honeybot/nixos/configuration.nix'. โœ… DETERMINISTIC PATCH APPLIED: Successfully mutated 'remotes/honeybot/nixos/configuration.nix'. โœ… DETERMINISTIC PATCH APPLIED: Successfully mutated 'remotes/honeybot/nixos/configuration.nix'. โœ… DETERMINISTIC PATCH APPLIED: Successfully mutated 'remotes/honeybot/nixos/configuration.nix'. โœ… DETERMINISTIC PATCH APPLIED: Successfully mutated 'remotes/honeybot/nixos/configuration.nix'. โœ… DETERMINISTIC PATCH APPLIED: Successfully mutated 'remotes/honeybot/nixos/configuration.nix'. (nix) pipulate $ d diff --git a/remotes/honeybot/nixos/configuration.nix b/remotes/honeybot/nixos/configuration.nix index de61e9b..e225ada 100644 --- a/remotes/honeybot/nixos/configuration.nix +++ b/remotes/honeybot/nixos/configuration.nix @@ -320,6 +320,12 @@ locations."/" = { extraConfig = '' + if ($new_uri) { + return 301 https://mikelev.in$new_uri; + } + if (!-e $request_filename) { + return 301 https://mikelev.in$request_uri; + } try_files $uri $uri/index.html =404; ''; }; @@ -360,6 +366,12 @@ locations."/" = { extraConfig = '' + if ($new_uri) { + return 301 https://mikelev.in$new_uri; + } + if (!-e $request_filename) { + return 301 https://mikelev.in$request_uri; + } try_files $uri $uri/index.html =404; ''; }; @@ -400,6 +412,12 @@ locations."/" = { extraConfig = '' add_header Vary "Accept" always; + if ($new_uri) { + return 301 https://mikelev.in$new_uri; + } + if (!-e $request_filename) { + return 301 https://mikelev.in$request_uri; + } if ($serve_markdown) { rewrite ^(.*)/$ $1/index.md break; rewrite ^(.*[^/])$ $1/index.md break; @@ -443,7 +461,7 @@ if ($new_uri) { return 301 https://mikelev.in$new_uri; } - if ($uri ~ ^/futureproof/) { + if (!-e $request_filename) { return 301 https://mikelev.in$request_uri; } if ($serve_markdown) { @@ -486,6 +504,12 @@ locations."/" = { extraConfig = '' add_header Vary "Accept" always; + if ($new_uri) { + return 301 https://mikelev.in$new_uri; + } + if (!-e $request_filename) { + return 301 https://mikelev.in$request_uri; + } if ($serve_markdown) { rewrite ^(.*)/$ $1/index.md break; rewrite ^(.*[^/])$ $1/index.md break; @@ -526,6 +550,12 @@ locations."/" = { extraConfig = '' add_header Vary "Accept" always; + if ($new_uri) { + return 301 https://mikelev.in$new_uri; + } + if (!-e $request_filename) { + return 301 https://mikelev.in$request_uri; + } if ($serve_markdown) { rewrite ^(.*)/$ $1/index.md break; rewrite ^(.*[^/])$ $1/index.md break; @@ -568,6 +598,12 @@ locations."/" = { extraConfig = '' add_header Vary "Accept" always; + if ($new_uri) { + return 301 https://mikelev.in$new_uri; + } + if (!-e $request_filename) { + return 301 https://mikelev.in$request_uri; + } if ($serve_markdown) { rewrite ^(.*)/$ $1/index.md break; rewrite ^(.*[^/])$ $1/index.md break; (nix) pipulate $ m ๐Ÿ“ Committing: chore: Improve Nix configuration with 301 redirects [main 11eaed7] chore: Improve Nix configuration with 301 redirects 1 file changed, 37 insertions(+), 1 deletion(-) (nix) pipulate $ git push Enumerating objects: 11, done. Counting objects: 100% (11/11), done. Delta compression using up to 48 threads Compressing objects: 100% (4/4), done. Writing objects: 100% (6/6), 580 bytes | 580.00 KiB/s, done. Total 6 (delta 3), reused 0 (delta 0), pack-reused 0 (from 0) remote: Resolving deltas: 100% (3/3), completed with 3 local objects. To github.com:pipulate/pipulate.git b96f24c..11eaed7 main -> main (nix) pipulate $ ``` Ignition: often "exit", "nix develop". Instructions may vary. ```bash On branch main Your branch is up to date with 'origin/main'. nothing to commit, working tree clean GIT repo clean. Take BEFORE reading, make CHANGE, record AFTER diff. (nix) pipulate $ ./nixops.sh && ssh -t honeybot 'sudo cp ~/nixos-config-staged/* /etc/nixos/ && sudo nixos-rebuild switch' ๐Ÿš€ Syncing Hooks... post-receive 100% 3080 585.6KB/s 00:00 ๐Ÿš€ Syncing Scripts (New Location)... sending incremental file list deleting __pycache__/content_loader.cpython-313.pyc __pycache__/ sent 684 bytes received 62 bytes 1,492.00 bytes/sec total size is 317,322 speedup is 425.36 sending incremental file list sent 68 bytes received 12 bytes 160.00 bytes/sec total size is 140,366 speedup is 1,754.58 sending incremental file list sent 59 bytes received 12 bytes 47.33 bytes/sec total size is 645,230 speedup is 9,087.75 ๐Ÿš€ Syncing NPvg pad (one address, two bodies)... sending incremental file list sent 232 bytes received 16 bytes 496.00 bytes/sec total size is 5,440 speedup is 21.94 ๐Ÿš€ Syncing qamy.ai door (npvg.org's shape, its own tree)... sending incremental file list sent 232 bytes received 16 bytes 496.00 bytes/sec total size is 4,646 speedup is 18.73 ๐Ÿš€ Syncing installer to the home-hosted doors (npvg.org qamy.ai levinix.org sunpug.io guerillatech.com rfc9110.org rfc9111.io)... sending incremental file list sent 62 bytes received 12 bytes 148.00 bytes/sec total size is 25,724 speedup is 347.62 sending incremental file list sent 62 bytes received 12 bytes 148.00 bytes/sec total size is 25,724 speedup is 347.62 sending incremental file list sent 62 bytes received 12 bytes 148.00 bytes/sec total size is 25,724 speedup is 347.62 sending incremental file list sent 62 bytes received 12 bytes 148.00 bytes/sec total size is 25,724 speedup is 347.62 sending incremental file list sent 62 bytes received 12 bytes 148.00 bytes/sec total size is 25,724 speedup is 347.62 sending incremental file list sent 62 bytes received 12 bytes 148.00 bytes/sec total size is 25,724 speedup is 347.62 sending incremental file list sent 62 bytes received 12 bytes 148.00 bytes/sec total size is 25,724 speedup is 347.62 ๐Ÿง  Syncing 2nd Brain archive (brain.zip) to qamy.ai and mikelev.in... sending incremental file list sent 62 bytes received 12 bytes 49.33 bytes/sec total size is 46,809,534 speedup is 632,561.27 ๐Ÿš€ Syncing levinux.com deck (remark.js HTML + RFC 9110 index.md)... sending incremental file list sent 203 bytes received 12 bytes 430.00 bytes/sec total size is 720,316 speedup is 3,350.31 sending incremental file list sent 93 bytes received 12 bytes 210.00 bytes/sec total size is 3,964 speedup is 37.75 ๐Ÿš€ Syncing sunpug.io door... sending incremental file list sent 100 bytes received 12 bytes 224.00 bytes/sec total size is 4,791 speedup is 42.78 ๐Ÿš€ Syncing guerillatech.com door... sending incremental file list sent 92 bytes received 12 bytes 208.00 bytes/sec total size is 3,755 speedup is 36.11 ๐Ÿš€ Syncing rfc9110.org door... sending incremental file list sent 92 bytes received 12 bytes 208.00 bytes/sec total size is 3,558 speedup is 34.21 ๐Ÿš€ Syncing rfc9111.io door... sending incremental file list sent 92 bytes received 12 bytes 208.00 bytes/sec total size is 3,729 speedup is 35.86 ๐Ÿš€ Syncing NixOS Config... sending incremental file list configuration.nix sent 6,428 bytes received 335 bytes 4,508.67 bytes/sec total size is 35,769 speedup is 5.29 โœ… Sync Complete. To apply NixOS config: ssh -t mike@[REDACTED_IP] 'sudo cp ~/nixos-config-staged/* /etc/nixos/ && sudo nixos-rebuild switch' [sudo] password for mike: building the system configuration... evaluation warning: The option `services.logind.lidSwitchExternalPower' defined in `/etc/nixos/configuration.nix' has been renamed to `services.logind.settings.Login.HandleLidSwitchExternalPower'. evaluation warning: The option `services.logind.lidSwitch' defined in `/etc/nixos/configuration.nix' has been renamed to `services.logind.settings.Login.HandleLidSwitch'. evaluation warning: The option `services.xserver.displayManager.gdm.wayland' defined in `/etc/nixos/configuration.nix' has been renamed to `services.displayManager.gdm.wayland'. evaluation warning: The option `services.xserver.displayManager.gdm.enable' defined in `/etc/nixos/configuration.nix' has been renamed to `services.displayManager.gdm.enable'. these 6 derivations will be built: /nix/store/02baqbkypsgysv28wf9p8i6h5bs86phn-nginx.conf.drv /nix/store/aak42h1w3i3yqljsnmpb2h6pibmlm9ls-unit-script-nginx-pre-start.drv /nix/store/j238gl2fajqs377g3dx9ij8fh7dz6jg2-unit-nginx.service.drv /nix/store/0bmzwa7plvn1amiax0c64bidpwc3ibxm-system-units.drv /nix/store/dxsw3whfg4zkhkl1lzs9w1q28alffajg-etc.drv /nix/store/n86xz0iiwxq9k7l3ax1n79frysrmbfkg-nixos-system-honeybot-26.05pre913595.c6245e83d836.drv building '/nix/store/02baqbkypsgysv28wf9p8i6h5bs86phn-nginx.conf.drv'... [context] INFO Can't find variable 'new_uri' [context] INFO Can't find variable 'new_uri' [context] INFO Can't find variable 'new_uri' [context] INFO Can't find variable 'new_uri' [context] INFO Can't find variable 'new_uri' [context] INFO Can't find variable 'new_uri' [context] INFO Can't find variable 'new_uri' [context] INFO Can't find variable 'new_uri' ==================== Results =================== No issues found. ==================== Summary =================== Total issues: Unspecified: 0 Low: 0 Medium: 0 High: 0 building '/nix/store/aak42h1w3i3yqljsnmpb2h6pibmlm9ls-unit-script-nginx-pre-start.drv'... building '/nix/store/j238gl2fajqs377g3dx9ij8fh7dz6jg2-unit-nginx.service.drv'... building '/nix/store/0bmzwa7plvn1amiax0c64bidpwc3ibxm-system-units.drv'... building '/nix/store/dxsw3whfg4zkhkl1lzs9w1q28alffajg-etc.drv'... building '/nix/store/n86xz0iiwxq9k7l3ax1n79frysrmbfkg-nixos-system-honeybot-26.05pre913595.c6245e83d836.drv'... activating the configuration... setting up /etc... reloading user units for mike... restarting sysinit-reactivation.target restarting the following units: nginx.service the following new units were started: NetworkManager-dispatcher.service Done. The new configuration is /nix/store/a10ac5qfcifm6zdfk7028g3l6b9l2nsf-nixos-system-honeybot-26.05pre913595.c6245e83d836 Connection to [REDACTED_IP] closed. (nix) pipulate $ ``` **4: PROMPT**: Verify the AFTER receipt confirming that legacy category paths like /nix/nixos/nbstripout/ on guerillatech.com and /futureproof/ paths on levinix.org now return 301 to https://mikelev.in while root door requests (HTML and curl installer) continue to return 200 OK. **5: DELIVERABLE**: Okay again I'm getting used to the idea that Nginx configuration changes that have a NixOS rebuild and switch update things right underneath the slideshow. The fixed logging should immediately after such patches are applied and ignited without a slideshow restart, so once again I'm killing a bit of time so that the after test has some good data in it. I'm also interested in whether everything we did is just as valid now that you see the publishing pipeline and how the redirect maps are made. ## Validating Single-Hop Redirects Against the Jekyll Knowledge Graph Pipeline **Gemini 4 Argon High**: Context verified. **TL;DR**: The BEFORE/AFTER straddle receipt confirms the fix is live, and inspecting the Jekyll publishing pipeline (`blogs.nix`, `publishizer.py`, `build_knowledge_graph.py`) confirms our Nginx rules are forward-compatible with how both `mikelev.in` and the door sites work. ### 1. AFTER Receipt Verification (`22:31:53 GMT` vs. `22:38:21 GMT`) ```text BEFORE (22:31:53 GMT): https://guerillatech.com/nix/nixos/nbstripout/ โ”€โ”€โ–บ HTTP/2 404 https://levinix.org/futureproof/the-door-names-the-folder/ โ”€โ”€โ–บ HTTP/2 404 AFTER (22:38:21 GMT): https://guerillatech.com/nix/nixos/nbstripout/ โ”€โ”€โ–บ HTTP/2 301 -> https://mikelev.in/nix/nixos/nbstripout/ https://levinix.org/futureproof/the-door-names-the-folder/ โ”€โ”€โ–บ HTTP/2 301 -> https://mikelev.in/futureproof/the-door-names-the-folder/ https://guerillatech.com/ (Browser UA) โ”€โ”€โ–บ HTTP/2 200 (text/html) https://guerillatech.com/ (curl UA) โ”€โ”€โ–บ HTTP/2 200 (text/x-shellscript) ``` Why the live HUD updates without restarting the slideshow: `logs.py` reads `tail -f /var/log/nginx/access.log`. When `nixos-rebuild switch` reloads `nginx.service`, Nginx writes the new `301` status codes into the same log stream immediately, flipping red `[404]` lines to white `[301]` lines on the next request. ### 2. Why the Publishing Pipeline Validates This Design Seeing `blogs.nix` and `build_knowledge_graph.py` explains both where those multi-segment paths came from and why the two-guard rule in `remotes/honeybot/nixos/configuration.nix` is the right long-term fit: 1. **Where `/nix/nixos/nbstripout/` and `/htmx/nix-flakes/websockets/` Come From**: In `build_knowledge_graph.py`, Target `1` (`mikelev.in`) builds a recursive K-Means / TF-IDF hub tree (`TARGET_BRANCHING_FACTOR = 7`) where each sub-hub gets a nested permalink (`/{hub_1}/{hub_2}/{hub_3}/`). As the corpus grows (`1,584` posts), K-Means cluster labels shift, and `generate_redirects.py` + `sanitize_redirects.py` maps retired hub/category paths into `/home/mike/www/mikelev.in/_site/redirects.map` (`$new_uri`). 2. **Single-Hop Resolution When `$new_uri` Matches**: Because every door vhost checks `if ($new_uri) { return 301 [https://mikelev.in](https://mikelev.in)$new_uri; }` *before* `if (!-e $request_filename)`, any legacy hub path already in `redirects.map` redirects in **one hop** straight to its final `/futureproof/...` destination on `mikelev.in` instead of chaining two `301`s. 3. **Zero Collision With Each Door's Own `permalink_prefix**`: In `blogs.nix`, only Target `1` (`mikelev.in`) uses `permalink_prefix = "futureproof"`. Every door has its own disjoint prefix (`levinix` -> `"packaging"`, `guerillatech` -> `"observatory"`, `rfc9110` -> `"semantics"`, `rfc9111` -> `"caching"`, `qamy` -> `"verification"`). Because `-e $request_filename` is true for any file or directory that exists inside `/home/mike/www/`, `index.html`, `index.md`, `install.sh`, `llms.txt`, `robots.txt`, `sitemap.xml`, and any future posts synced to `/home/mike/www////` are served locally as `200 OK`, while nonexistent `mikelev.in` paths `301` back to `[https://mikelev.in](https://mikelev.in)`. To see the live `AhrefsBot` requests in `/var/log/nginx/guerillatech.access.log` now returning `301` instead of `404` since the `18:38` EDT switchover (or to dismount if you are satisfied), run the read-only log tail below. --- ### **1: BEFORE** (PROBE) Run in `(nix) pipulate $`: ```bash ssh honeybot 'echo "=== GUERILLATECH LOG AFTER 18:38 REBUILD ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== LEVINIX LOG AFTER 18:38 REBUILD ==="; tail -n 10 /var/log/nginx/levinix.access.log' ``` ### **2: AFTER** (NEXT CONTEXT) Paste into `context.txt` (via `context` or `x`) for `(nix) pipulate $`: ```text context.txt remotes/honeybot/nixos/configuration.nix scripts/articles/extract_404_ghosts.py scripts/articles/generate_redirects.py scripts/articles/sanitize_redirects.py ! ssh honeybot 'echo "=== GUERILLATECH LOG AFTER 18:38 REBUILD ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== LEVINIX LOG AFTER 18:38 REBUILD ==="; tail -n 10 /var/log/nginx/levinix.access.log' ``` ### **3: CHANGE** (PATCHES) No repo patches required on this turn. No ignition required. ### **4: PROMPT** Copy into `prompt.md` (via `prompt` or `p`) for `(nix) pipulate $` (or press `\z` in Neovim to stage the dismount if ready): ```text Review the live post-18:38 guerillatech.access.log and levinix.access.log lines from Honeybot confirming AhrefsBot hits are now returning 301 instead of 404, and check how extract_404_ghosts.py / generate_redirects.py handle the remaining 404s on mikelev.in. ``` ### **5: DELIVERABLE** * Live `guerillatech.access.log` and `levinix.access.log` tail confirming `AhrefsBot`'s crawl queue is now receiving `301` redirects to `[https://mikelev.in](https://mikelev.in)` instead of `404`s. * Optional inspection of `extract_404_ghosts.py`, `generate_redirects.py`, and `sanitize_redirects.py` (or dismount with `\z`). **MikeLev.in**: Okay so things look correct on the log file again. There's no more MikeLev.in paths showing up as 404 requests on GorillaTech.com so all is good. I think this aticle is done but be sure to cover this for the newcommer as we wrap up, really down to the basics and the first principles here and such. ## THE AI-EDIT METHOD > Same commands, run twice, one change between them. Where the readings > differ is what the change did; the diff in the middle is the receipt. **1: BEFORE** (PROBE): ```bash On branch main Your branch is up to date with 'origin/main'. nothing to commit, working tree clean GIT repo clean. Take BEFORE reading, make CHANGE, record AFTER diff. (nix) pipulate $ ssh honeybot 'echo "=== GUERILLATECH LOG AFTER 18:38 REBUILD ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== LEVINIX LOG AFTER 18:38 REBUILD ==="; tail -n 10 /var/log/nginx/levinix.access.log' === GUERILLATECH LOG AFTER 18:38 REBUILD === [REDACTED_IP] - - [25/Oct/2026:18:28:11 -0400] "GET /jupyter-notebooks/jupyter-notebooks/state-management/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:28:22 -0400] "GET /futureproof/put-the-whole-problem-%D0%BD%D0%B0-the-bench/ HTTP/2.0" 301 162 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:28:33 -0400] "GET /nix-flakes/nixos/prompt-engineering/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:28:44 -0400] "GET /nix-flakes/nixos/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:28:55 -0400] "GET /prompt-engineering/prompt-engineering/semantic-compression/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:29:06 -0400] "GET /nixos/forever-machine/piton-holes/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:29:17 -0400] "GET /prompt-engineering/prompt-engineering/prompt-fu/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:29:27 -0400] "GET /pipulate/context-engineering/llms/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:29:38 -0400] "GET /nixos/dmz/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:29:49 -0400] "GET /htmx/llm/llm/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:30:00 -0400] "GET /nix/nix/pipulate/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:30:11 -0400] "GET /jupyter-notebooks/nix/developer-tools/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:30:22 -0400] "GET /pipulate/context-engineering/ai-context/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:30:33 -0400] "GET /htmx/python/web-framework/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:30:44 -0400] "GET /pipulate/nix/llm-package/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:30:55 -0400] "GET /nix/nix-flakes/neovim/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" [REDACTED_IP] - - [25/Oct/2026:18:31:06 -0400] "GET /nixos/forever-machine/agentic-ai/ HTTP/2.0" 404 146 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"\x22https://ahrefs.com\x22" 127.0.0.1 - - [25/Oct/2026:18:31:53 -0400] "HEAD /nix/nixos/nbstripout/ HTTP/2.0" 404 0 "-" "curl/8.17.0" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"-" 127.0.0.1 - - [25/Oct/2026:18:31:53 -0400] "HEAD / HTTP/2.0" 200 0 "-" "Mozilla/5.0" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"-" 127.0.0.1 - - [25/Oct/2026:18:31:53 -0400] "HEAD / HTTP/2.0" 200 0 "-" "curl/8.17.0" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"-" [REDACTED_IP] - - [25/Oct/2026:18:34:02 -0400] "GET /futureproof/magic-cookie-pattern-self-bootstrapping-sovereignty/ HTTP/1.1" 301 162 "https://guerillatech.com/futureproof/the-living-broadcast-real-time-content-updates-for-your-automated-narrative/" "Mozilla/5.0 (Linux; Android 7.0;) AppleWebKit/537.36 (HTML, like Gecko) Mobile Safari/537.36 (compatible; PetalBot;+https://webmaster.petalsearch.com/site/petalbot)" Accept:"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8" MarkdownServed:0 Host:"guerillatech.com" Sig:"-" [REDACTED_IP] - - [25/Oct/2026:18:36:55 -0400] "GET / HTTP/2.0" 200 1263 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/[REDACTED_IP] Safari/537.36" Accept:"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8" MarkdownServed:0 Host:"guerillatech.com" Sig:"-" 127.0.0.1 - - [25/Oct/2026:18:38:21 -0400] "HEAD /nix/nixos/nbstripout/ HTTP/2.0" 301 0 "-" "curl/8.17.0" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"-" 127.0.0.1 - - [25/Oct/2026:18:38:21 -0400] "HEAD / HTTP/2.0" 200 0 "-" "Mozilla/5.0" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"-" 127.0.0.1 - - [25/Oct/2026:18:38:21 -0400] "HEAD / HTTP/2.0" 200 0 "-" "curl/8.17.0" Accept:"*/*" MarkdownServed:0 Host:"guerillatech.com" Sig:"-" === LEVINIX LOG AFTER 18:38 REBUILD === [REDACTED_IP] - - [25/Oct/2026:18:29:37 -0400] "GET /webmail/phpinfo.php HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/[REDACTED_IP] Safari/537.36" Accept:"*/*" MarkdownServed:0 Host:"levinix.com" Sig:"-" [REDACTED_IP] - - [25/Oct/2026:18:29:37 -0400] "GET /webmail/phpinfo.php HTTP/1.1" 404 180 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/[REDACTED_IP] Safari/537.36" Accept:"*/*" MarkdownServed:0 Host:"levinix.org" Sig:"-" [REDACTED_IP] - - [25/Oct/2026:18:29:37 -0400] "GET /smtp/phpinfo.php HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/[REDACTED_IP] Safari/537.36" Accept:"*/*" MarkdownServed:0 Host:"levinix.com" Sig:"-" [REDACTED_IP] - - [25/Oct/2026:18:29:37 -0400] "GET /smtp/phpinfo.php HTTP/1.1" 404 180 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/[REDACTED_IP] Safari/537.36" Accept:"*/*" MarkdownServed:0 Host:"levinix.org" Sig:"-" 127.0.0.1 - - [25/Oct/2026:18:31:53 -0400] "HEAD /futureproof/the-door-names-the-folder/ HTTP/2.0" 404 0 "-" "curl/8.17.0" Accept:"*/*" MarkdownServed:0 Host:"levinix.org" Sig:"-" [REDACTED_IP] - - [25/Oct/2026:18:32:33 -0400] "GET /sitemaps.xml HTTP/2.0" 301 162 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36" Accept:"*/*" MarkdownServed:0 Host:"levinix.com" Sig:"-" [REDACTED_IP] - - [25/Oct/2026:18:32:44 -0400] "GET /sitemaps.xml HTTP/2.0" 404 169 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36" Accept:"*/*" MarkdownServed:0 Host:"levinix.org" Sig:"-" [REDACTED_IP] - - [25/Oct/2026:18:34:01 -0400] "GET / HTTP/1.1" 301 162 "-" "Ziwei-S2Promote/1.0" Accept:"application/json, text/event-stream" MarkdownServed:0 Host:"levinix.com" Sig:"-" [REDACTED_IP] - - [25/Oct/2026:18:34:02 -0400] "GET / HTTP/1.1" 200 1708 "-" "Ziwei-S2Promote/1.0" Accept:"application/json, text/event-stream" MarkdownServed:0 Host:"levinix.org" Sig:"-" 127.0.0.1 - - [25/Oct/2026:18:38:21 -0400] "HEAD /futureproof/the-door-names-the-folder/ HTTP/2.0" 301 0 "-" "curl/8.17.0" Accept:"*/*" MarkdownServed:0 Host:"levinix.org" Sig:"-" (nix) pipulate $ ``` **2: AFTER** (NEXT CONTEXT): ```text # # Content 1 # context.txt # # # WE BEGIN AT THE BEGINNING AND WILL GO ON TILL WE COME TO THE END, THEN STOP. # ~/repos/nixos/configuration.nix # ~/repos/nixos/services.nix # ~/repos/nixos/packages.nix # ~/repos/nixos/autognome.py # init.lua # flake.nix # # # HOME-HOSTED (NOT BEHIND CDN) NGINX WEBSERVER HONEYBOT AI OBSERVATORY # nixops.sh # remotes/honeybot/hooks/post-receive # remotes/honeybot/nixos/configuration.nix # remotes/honeybot/scripts/score.py # remotes/honeybot/scripts/card.py # remotes/honeybot/scripts/forest.py # remotes/honeybot/scripts/test_forest.py # remotes/honeybot/scripts/logs.py # remotes/honeybot/scripts/content_loader.py # remotes/honeybot/scripts/db.py # # # THE DATA EVERYONE NEEDS # remotes/honeybot/queries/trapdoor_ips.sql # ! echo "--- WHO HYDRATES THE DOM ---" && cat remotes/honeybot/queries/trapdoor_ips.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db' # remotes/honeybot/queries/content_neg_agents.sql # ! echo "--- WHO NEGOTIATES MARKDOWN ---" && cat remotes/honeybot/queries/content_neg_agents.sql | ssh honeybot 'sqlite3 -header -column ~/www/mikelev.in/honeybot.db' # # Context 2 # context.txt # remotes/honeybot/nixos/configuration.nix # remotes/honeybot/scripts/logs.py # ! ssh honeybot 'cfg=$(ps -eo args | rg -o "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; rg "server_name |default_server" "$cfg"; echo "=== GUERILLATECH LOG HITS ==="; rg "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; rg "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/" ~/www/mikelev.in/_site/redirects.map' # # Context 3 # context.txt # remotes/honeybot/nixos/configuration.nix # remotes/honeybot/scripts/logs.py # ! ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== GUERILLATECH ACCESS.LOG HITS ==="; grep -E "Host:\"[^\"]*guerillatech" /var/log/nginx/access.log | tail -n 25; echo "=== GUERILLATECH VHOST LOG ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== MIKELEV.IN REDIRECT MAP CHECK ==="; grep -E "python-refactoring-server-logging|duty-cycle-architecture-bot-observatory-nixos|/prompt-engineering/pipulate/|/pipulate/nixos/crc32/crc32/|/seo/pipulate/semantic-web/|/nix/nixos/python/initpy/" ~/www/mikelev.in/_site/redirects.map' # # Context 4 # context.txt # remotes/honeybot/nixos/configuration.nix # ! ssh honeybot 'cfg=$(ps -eo args | grep -Eo "/nix/store/[^ ]*nginx\.conf" | head -n 1); echo "=== NGINX CONF: $cfg ==="; grep -E "listen |server_name " "$cfg"; echo "=== RIPGREP ON HONEYBOT ==="; command -v rg || echo "rg: absent"; echo "=== PROBE WWW.MIKELEV.IN & GUERILLATECH GHOST ==="; curl -skI --resolve www.mikelev.in:443:127.0.0.1 https://www.mikelev.in/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | head -n 5' # # Context 5 # context.txt # remotes/honeybot/nixos/configuration.nix # ! ssh honeybot 'echo "=== GUERILLATECH VHOST LOG (LAST 25) ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== REDIRECT LOCATION HEADER CHECK ==="; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/futureproof/the-door-names-the-folder/ | rg -i "^(HTTP/|location:)"; echo "=== OTHER DOOR LOGS WITH /futureproof/ HITS ==="; rg -c "/futureproof/" /var/log/nginx/*.access.log || true' # # Context 6 # context.txt # # THE JEKYLL BLOG LIKE A HACKER (INVENTED SKILL.md & AGENTS.md FORMAT) PUBLISHING PIPELINE # ~/repos/nixos/blogs.nix # ~/.config/pipulate/blogs.json # scripts/articles/publishizer.py # scripts/articles/common.py # scripts/articles/articleizer.py # scripts/articles/link_injector.py # scripts/articles/build_knowledge_graph.py # scripts/articles/editing_prompt.txt # scripts/articles/sanitizer.py # scripts/articles/contextualizer.py # scripts/articles/generate_llms_txt.py # scripts/articles/generate_post_nav.py # # remotes/honeybot/nixos/configuration.nix # ! ssh honeybot 'echo "=== LEGACY CATEGORY PATH ON GUERILLATECH & LEVINIX ==="; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/nix/nixos/nbstripout/ | rg -i "^(HTTP/|location:)"; curl -skI --resolve levinix.org:443:127.0.0.1 https://levinix.org/futureproof/the-door-names-the-folder/ | rg -i "^(HTTP/|location:)"; echo "=== DOOR ROOT 200 CHECK ==="; curl -skI -A "Mozilla/5.0" --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/ | head -n 5; curl -skI --resolve guerillatech.com:443:127.0.0.1 https://guerillatech.com/ | head -n 5' # Context 7 context.txt remotes/honeybot/nixos/configuration.nix scripts/articles/extract_404_ghosts.py scripts/articles/generate_redirects.py scripts/articles/sanitize_redirects.py ! ssh honeybot 'echo "=== GUERILLATECH LOG AFTER 18:38 REBUILD ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== LEVINIX LOG AFTER 18:38 REBUILD ==="; tail -n 10 /var/log/nginx/levinix.access.log' ``` **3: CHANGE** (PATCHES): None means done. **4: PROMPT**: Review the live post-18:38 guerillatech.access.log and levinix.access.log lines from Honeybot confirming AhrefsBot hits are now returning 301 instead of 404, and check how extract_404_ghosts.py / generate_redirects.py handle the remaining 404s on mikelev.in. **5: DELIVERABLE**: Hop off the ride. This ride's stated goal is reached -- dismount. This is the NOTARY BEAT: the ride ends here, is witnessed here, and is sealed here. Answer all seven beats, briefly: 0. **TL;DR**: a short, dry, neutral abstract for the TOP of the published article -- written for an unfamiliar reader or AI summarizer who has never seen this system. No hype, no insider handles unexplained. 1. VERIFY: restate the goal from the top of this article and confirm (or deny) it was met, citing THIS compile's receipts, not memory. Name any ignition this ride required that never fired -- an AFTER tap taken without one is a stale BEFORE wearing the AFTER's label. 2. BANK: name everything that graduates -- rule, earmark, todo, pin -- as SEARCH/REPLACE patch cars against raw source present in THIS context (Target line inside the fence, one car per commit story), deletions included. A 'paste-ready' line with no Target and no SEARCH anchor is not banked; it is a hand edit the operator will not make. These BANK cars are the ONLY patches a dismount emits. 3. DANGLING: what carries forward unbanked? One line each, no essays. 4. SEED: the context.txt lines (and TODO_SLUGS if narrative context is needed) for the next ride's first compile. 5. CLOSING: a closing summary for the BOTTOM of the article -- the final take-away, tied to the book's larger arc where it fits naturally, never forced. Storytelling over inventory. 6. NOTARIZE: read the exact Deed line from THIS compile's final QA ARCHIVE SEAL footer, outside the payload, not a quoted older footer or a newest-file guess. It names the input archive, not this later response or the generated Jekyll post. State verification separately: only a verifier receipt naming that archive supports a verified claim; otherwise say not independently verified here. Count this Manifest's live-command receipts, including failures. Quote only recorded digests, sizes and dates, naming their source; filesystem mtime and fixed ZIP dates are not command timestamps. Do not demand absent wc -c or dated-receipt fields. If the footer is missing, say so; otherwise close with its exact Deed line. FINALITY: after beat 6, this discussion is CLOSED. Emit NO five-car train, NO probes, NO patches beyond the BANK cars of beat 2, and NO next-turn prompt beyond the SEED lines in beat 4. Any reader or model encountering this article later should treat it as a finished, notarized document -- an archive entry, not an open thread. ## The Notary Beat: First Principles of Multi-Tenant Host Routing **Gemini 4 Argon High**: Context verified. ### 1. VERIFY * **Goal Restated**: Diagnose and fix why `mikelev.in` article and category paths were appearing as `404` requests under `guerillatech.com` in Honeybot's live Nginx access logs, and verify that the fix is compatible with the Jekyll redirect-mapping pipeline. * **Confirmed by THIS Compile's Receipts**: 1. **Tracked Diff Receipt (`Telemetry -> Recent Git Diff Telemetry`)**: Commit `11eaed7` (`de61e9b..e225ada` on `remotes/honeybot/nixos/configuration.nix`) added `if ($new_uri) { return 301 [https://mikelev.in](https://mikelev.in)$new_uri; }` and `if (!-e $request_filename) { return 301 [https://mikelev.in](https://mikelev.in)$request_uri; }` across all seven single-page door virtual hosts (`npvg.org`, `qamy.ai`, `levinix.org`, `guerillatech.com`, `rfc9110.org`, `rfc9111.io`, `sunpug.io`), building on commit `b96f24c` which pinned `default = true;` and `serverAliases = [ ("www." + "mikelev.in") ];` on `virtualHosts."mikelev.in"` and installed `ripgrep`. 2. **Live Log Receipt (`! ssh honeybot 'echo "=== GUERILLATECH LOG AFTER 18:38 REBUILD ===" ...'`)**: * Prior to the second rebuild (`18:28:11`โ€“`18:31:53 -0400`), `/futureproof/` hits on `guerillatech.com` were already returning `301` (`[25/Oct/2026:18:28:22 -0400] "GET /futureproof/put-the-whole-problem-%D0%BD%D0%B0-the-bench/ HTTP/2.0" 301` from `AhrefsBot/7.0`, and `[25/Oct/2026:18:34:02 -0400] "GET /futureproof/magic-cookie-pattern-self-bootstrapping-sovereignty/ HTTP/1.1" 301` from `PetalBot`), while legacy category paths (`/nix/nixos/nbstripout/`) still returned `404` at `18:31:53 -0400`. * After the second rebuild activated at `18:38:21 -0400`, `HEAD /nix/nixos/nbstripout/ HTTP/2.0` on `guerillatech.com` and `HEAD /futureproof/the-door-names-the-folder/ HTTP/2.0` on `levinix.org` both flipped from `404` to `301`, while root door requests (`GET / HTTP/2.0` from Chrome at `18:36:55` and `HEAD / HTTP/2.0` at `18:38:21`) continued returning `200`. * **Ignitions**: Both required ignitions (`./nixops.sh && ssh -t honeybot 'sudo cp ~/nixos-config-staged/* /etc/nixos/ && sudo nixos-rebuild switch'`) fired on their respective turns (`nixos-system-honeybot-26.05pre913595.c6245e83d836` activating `/nix/store/akbs7qmc3j8pg1s3kdw3d94hh18ci5ya-...` and `/nix/store/a10ac5qfcifm6zdfk7028g3l6b9l2nsf-...`). No required ignition was missed. --- ### 2. BANK No additional patch cars are emitted at dismount: all `remotes/honeybot/nixos/configuration.nix` changes are already committed in `b96f24c` and `11eaed7` and active on Honeybot, and `foo_files.py` is not present in this compile's Codebase. --- ### 3. DANGLING * `foo_files.py` was not in this compile's context; bank the NixOS Nginx `default = true;` virtual-host ordering lesson there on a future router turn if desired. * Legacy category/hub `404` paths on `mikelev.in` (`/nix/nixos/nbstripout/`, etc.) await the next `CHOP_404_AFFAIR` redirect-mapping run (`extract_404_ghosts.py` -> `_raw_map.csv` -> `generate_redirects.py`). * `scripts/articles/extract_404_ghosts.py:100` carries a pre-existing Ruff `W292` (no newline at end of file) diagnostic. * Four non-fatal NixOS 26.05 option-rename warnings (`services.logind.lidSwitch*` and `services.xserver.displayManager.gdm.*`) remain in `remotes/honeybot/nixos/configuration.nix`. --- ### 4. SEED ```text context.txt scripts/articles/extract_404_ghosts.py scripts/articles/generate_redirects.py scripts/articles/sanitize_redirects.py remotes/honeybot/queries/hot_404_remaps_top.sql ``` --- ### 5. CLOSING If you are new to self-hosting or Infrastructure as Code, what just happened on this ride is a textbook lesson in how the web actually works underneath cloud dashboards. When you host multiple websites on a single machine with one public IP address, every incoming request arrives at the same front door (ports `80` and `443`). Nginx decides which website folder to serve by reading the HTTP `Host:` header (and the TLS SNI hostname) and matching it against each site's `server_name` list. If a request arrives for a hostname that Nginx does not recognize yet, Nginx does not drop the connectionโ€”it hands the request to whichever `server` block is marked `default_server`. And if *no* `server` block is explicitly marked `default_server`, Nginx silently promotes the **first `server` block in `nginx.conf**` to be the catch-all default. In NixOS, `services.nginx.virtualHosts` is a Nix attribute set (`{ "mikelev.in" = ...; "npvg.org" = ...; }`). Nix evaluates attribute set keys in strict alphabetical order to guarantee reproducible builds. As long as the only hosted domains were `mikelev.in`, `npvg.org`, and `qamy.ai`, `"mikelev.in"` (`m`) happened to sort first and acted as the default server. That created a two-phase trap when new domains were pointed at the server: 1. **Before the new virtual host existed in `configuration.nix**`, pointing `guerillatech.com` or `levinix.org` at the server's IP meant any crawler visiting those domains was silently served `mikelev.in`'s 1,584-article Jekyll site. Because Jekyll's internal links are root-relative (`/futureproof/...`, `/nix/nixos/...`), crawlers like `AhrefsBot` and `PetalBot` dutifully queued thousands of `mikelev.in` paths under `guerillatech.com` in their remote databases. 2. **The moment `virtualHosts."guerillatech.com"` was added**, two things flipped at once: `guerillatech.com` got its own isolated one-page web root (turning AhrefsBot's queued crawl frontier into a wall of `404`s), and because `"guerillatech.com"` starts with `g`, it alphabetically displaced `"mikelev.in"` (`m`) as the first `server` block in `nginx.conf`โ€”hijacking unmatched `Host` headers like `www.mikelev.in` and serving `guerillatech`'s installer script in their place. Because the entire server is defined in a single declarative text file (`remotes/honeybot/nixos/configuration.nix`), fixing both halves of the problem took no container orchestration, no proxy appliance, and not even a restart of the live broadcast HUD. Adding `default = true;` and `serverAliases` on `mikelev.in` made the default server explicit rather than an accident of the alphabet, and adding a two-stage `if ($new_uri)` / `if (!-e $request_filename)` `301` redirect on each door domain turned AhrefsBot's poisoned crawl queue into a self-healing funnel back to `[https://mikelev.in](https://mikelev.in)`. --- ### 6. NOTARIZE * **Input Archive Deed**: `qamy.ai_284-5afa01d8.zip` (read from THIS compile's final `QA ARCHIVE SEAL` footer outside the payload; it names the input archive for this turn, not this response or the generated Jekyll post). * **Verification Status**: Not independently verified here (no verifier receipt naming `qamy.ai_284-5afa01d8.zip` is present in this compile). * **Live-Command Receipts Count**: `1` live-command receipt in the Manifest (`0` failures): * `! ssh honeybot 'echo "=== GUERILLATECH LOG AFTER 18:38 REBUILD ==="; tail -n 25 /var/log/nginx/guerillatech.access.log; echo "=== LEVINIX LOG AFTER 18:38 REBUILD ==="; tail -n 10 /var/log/nginx/levinix.access.log'` (`0.1615s`, `3,671 tokens | 8,779 bytes` per `Manifest` and `Summary`, capturing log events from `25/Oct/2026:18:28:11 -0400` to `25/Oct/2026:18:38:21 -0400`). * **Recorded Payload Metrics (`Summary`)**: `84,924` summed tokens, `86,619` verified tokens, `16,078` words, `289,952` characters, `293,119` bytes (UTF-8). Deed: qamy.ai_284-5afa01d8.zip --- ## Book Analysis ### Ai Editorial Take What stands out most from an outside architectural angle is how AhrefsBot inadvertently acted as an external, asynchronous state snapshot of a transient server misconfiguration. In distributed systems, we usually think of state living on our own disks or in our own databases. Here, a brief window where DNS A-records existed before their corresponding NixOS `virtualHosts` blocks caused an external crawler cluster to record a false topologyโ€”and then play that false topology back against the server at 11-second intervals days later. When the operator asked, 'Is there any way to flush it like maybe it's some cache?', the realization that the 'cache' was actually Ahrefs' remote crawl frontier reframed the entire fix: you cannot `rm -rf` a third party's database, so your edge router must speak the protocol that instructs the remote state machine to rewrite its own records (`301 Moved Permanently`). ### ๐Ÿฆ X.com Promo Tweet ```text When "g" sorts before "m" in NixOS: how alphabetical virtualHosts evaluation hijacked Nginx default_server and how 301s drained the crawl queue. https://mikelev.in/futureproof/alphabetical-default-server-hijack-nixos-nginx-vhosts/ #NixOS #Nginx #SelfHosting ``` ### ๐ŸŽจ Hero Banner Image Prompt ```text A wide 16:9 graphic-novel ink-and-wash illustration set in a deep obsidian-slate (#111111) subterranean switching vault. Vertically centered in the frame, a massive brass and glass railway signal interlocking machine routes glowing cyan and warm amber fiber-optic light beams through seven arched mechanical doorways. One brass lever in the center is locked firmly into place with a heavy steel pin, diverting a tangled swarm of red spider-like mechanical crawler probes out of the side doors and into a single wide golden aqueduct at the center. High-contrast chiaroscuro lighting, crisp architectural pen work, rich metallic textures, and atmospheric dark slate shadows extending seamlessly to all four edges of the canvas. Full-bleed edge-to-edge composition filling 100% of the canvas with no borders, no frames, no matting, no margins, and no text overlays or lettering. ``` ### ๐Ÿ–ผ๏ธ YAML Frontmatter Image Override ```yaml image: path: /assets/images/alphabetical-default-server-hijack-nixos-nginx-vhosts.jpeg alt: "A dark obsidian switchboard routing glowing cyan and amber light streams through brass mechanical gates." ``` ### Title Brainstorm * **Title Option:** When G Sorts Before M: The NixOS Alphabetical Default-Server Hijack in Nginx * **Filename:** `alphabetical-default-server-hijack-nixos-nginx-vhosts.md` * **Rationale:** Names the exact mechanical trigger ('g' sorting before 'm' in Nix attribute sets) alongside the concrete NixOS and Nginx technical components. * **Title Option:** The Alphabetical Catch-All Trap: Fixing NixOS Nginx VirtualHosts and Crawler Ghosts * **Filename:** `alphabetical-catch-all-trap-nixos-nginx-crawler-ghosts.md` * **Rationale:** Highlights both halves of the diagnostic puzzle: the implicit catch-all server promotion and the resulting ghost URLs queued by external crawlers. * **Title Option:** Draining Poisoned Crawl Queues: Explicit Nginx Default Servers and Single-Hop 301s on NixOS * **Filename:** `draining-poisoned-crawl-queues-nixos-nginx-default-server.md` * **Rationale:** Focuses on the SEO and crawler-hygiene engineering outcomeโ€”draining AhrefsBot's cross-domain frontier back to the canonical host in a single hop. * **Title Option:** Why www.mikelev.in Served a Shell Script: NixOS Attribute Sorting and Nginx Host Routing * **Filename:** `why-www-served-shell-script-nixos-nginx-host-routing.md` * **Rationale:** Leads with the most surprising wire receipt from the debugging sessionโ€”the curl probe that returned text/x-shellscript on the main blog's www subdomain. ### Content Potential And Polish - **Core Strengths:** - Captures a classic, counterintuitive interaction between two sensible system properties: Nix's lexicographical attribute-set evaluation and Nginx's positional fallback for `default_server`. - Demonstrates the value of the BEFORE/AFTER probe gate twiceโ€”first when catching the missing `ripgrep` binary on the remote host before mutating configuration, and second when discovering that `curl https://www.mikelev.in/` was actually serving `guerillatech`'s `install.sh` script. - Connects low-level HTTP routing rules (`if ($new_uri)` before `if (!-e $request_filename)`) directly to the higher-level K-Means / TF-IDF knowledge graph pipeline so legacy hub redirects resolve in a single hop. - Closes with a clear, jargon-free first-principles explanation of HTTP `Host` headers, TLS SNI, and virtual host dispatch suitable for newcomers to self-hosting. - **Suggestions For Polish:** - Add a brief callout box early in the article contrasting Nginx's `server_name` matching priority (exact name, leading wildcard, trailing wildcard, regex, then `default_server`) so readers immediately see why omitting `www.mikelev.in` triggered the fallback. - Include a short note on why `if (!-e $request_filename) { return ...; }` at the location level is safe in Nginx when used purely with `return 301`, distinguishing it from the well-known 'If is Evil' pitfalls involving `try_files` or `proxy_pass` inside `if` blocks. ### Next Step Prompts - Inspect `scripts/articles/extract_404_ghosts.py`, `scripts/articles/generate_redirects.py`, and `remotes/honeybot/queries/hot_404_remaps_top.sql` to trace how retired K-Means hub paths like `/nix/nixos/nbstripout/` on `mikelev.in` are harvested from the access log and compiled into `redirects.map`. - Review the four NixOS 26.05 evaluation warnings in `remotes/honeybot/nixos/configuration.nix` (`services.logind.lidSwitch*` and `services.xserver.displayManager.gdm.*`) and prepare a clean SEARCH/REPLACE patch to migrate them to the new option paths.