However, if you are the organization admin you have to follow specific instructions to change your email. You need to make sure that you use Directory > Managed Accounts not Administration > User management.

1. Once you are in the Managed accounts` screen you can change your email which will unlink your account
2. Trigger a password reset and set a password via the link sent to your email
3. Set the new password
4. On the Managed accounts screen you can change the email back

Zatik Security moved all of our domains and DNS infrastructure onto the Cloudflare platform in early 2024. We made this decision after completing a review of 5 commonly used domain registrars security features. We selected the Cloudflare platform based on the security features available on their intro tier without requiring an upgrade to the enterprise tier. These features are strong two factor authentication, support for multiple users with role-based access controls, in-account audit trails, and the ability to log out other users. Support for these features is included in the intro tier, but still needs to be configured. Follow along below as we create and harden a Cloudflare account in April 2024. If you just want the step by step without the narrative you can skip right there. you can have one category listed

Root Account Creation

The setup for Zatik Security on Cloudflare is a root account which will be the parent of all other accounts. This root account will only be used during the creation and setup of the account. You should never use the root account as your day-to-day account. Any staff who need access to Cloudflare will log in with child accounts which are invited to the root account. Their invitations are scoped to only have the minimum permissions required to complete their tasks. For example, a member of the finance team could have an account which is only able to manage payment in Cloudflare but not alter any technical settings. Or a contractor hired to work on a marketing website can be granted access to manage the DNS records of that website only.

Since employees have their own accounts for day-to-day activities you can lock down access to the root account to a very limited number of individuals at your company. Reducing the use of this account and increasing friction at login will reduce the probability that the account will be compromised. The root account is reserved for a “break glass” scenario where a child account with administrative privileges is compromised and an attacker uses this elevated privilege to revoke all other access to the account. Since this attacker-controlled account is a child of the root account, it cannot revoke the root account’s access. You can then use the root account to remove the attacker-controlled account from your Cloudflare account, thereby containing the attack.

Here’s how we set up our accounts on Cloudflare: First, create an email address that is not associated with a specific user at your company, such as, admin@example.com. Use this email address to create a new account at Cloudflare. Store the password in the password manager that your company makes use of.

After creating the account, ensure to verify the email address on the account profile page you verify this email address. Finally, on the Configuration Page (https://dash.cloudflare.com/ACCOUNT_GUID/configurations) under Preferences, change the Account Name from “admin@example.com’s Account” to “ComanyName’s company Account”. Setting this value here will make it easier to work with child accounts when we introduce them later.

This account you are creating is the root of your company’s digital identity as it will control your domain names. You want to ensure that if something catastrophic happens you can recover it via Cloudflare’s account recovery process. Even if you are just using the free tier, on the Billing page (https://dash.cloudflare.com/ACCOUNT_GUID/billing) enter a payment instrument with an accurate billing address.

Once your account email and payment instrument is verified, on the Authentication Management profile page setup “Mobile App Authentication” app based second factor on this root account. Use Cloudflare’s documentation for this step. Once this second factor is setup, capture the recovery codes for this account in your password manager. These codes will allow anyone with access to them to log into the account. If you ever need to “break the glass” and access this account you will need access to these codes. Add these to your company’s disaster recovery documentation.

Invite Child Accounts

We will now create the child accounts that employees will use for their day-to-day operations. On the Members page (https://dash.cloudflare.com/ACCOUNT_GUID/members) start by enabling the “Member 2FA enforcement” option. Since Cloudflare only supports app and hardware based 2FA, this setting ensures all child accounts that can access our account company account must have strong MFA enabled. A huge shout out to Cloudflare for offering this feature on their free tier, and making it so easy to enable!

Our child accounts will make use of Cloudflare’s Account-scoped roles. These control the permissions the account will have. Since we’re setting up an admin user we’re going to make use of the Super Administrator - All Privileges role. However, as you create other child accounts for users at your company consider what permissions a user needs to complete their tasks. The best way to limit the impact of a breach is for the user to not have the access to steal in the first place. Some useful roles to know about at the Billing and DNS roles. The former only can only edit billing information on the account, great to allow your finance people to manage an account without having any technical access to the account. The latter allows for the management of DNS records. This can be useful for web developers, or IT admins who might need to set these records, but do not need the ability to configure the Cloudflare account itself.

Use the blue “Invite” button to create a child accounts. Enter the email of the user who’s going to be in charge of your Cloudflare account. Set their “Scope” to include all domains, and select the Super Administrator - All Privileges role. Then click the “Continue to summary” button. Confirm that you have entered the correct info, then click “Invite”

With the invite sent out to child user with administrative privileges, log out of the admin account. Do not use this account again unless you are in a “break glass” scenario. Your child admin account has all the permissions in the parent account to serve as an admin account. If this child account is ever compromised the root account can be used to revoke their access and contain a breach.

Accept the invite with your individual email account. If you don’t already have a Cloudflare account, you will need to create one. When you accept the invite from the parent account, you will be required to add 2FA to the account. When you log into your child account make sure to select the Company Account from the list of accounts. With this structure in place you now have a functional Cloudflare account ready for your staff to operate out of.

Benefits of a Hardened Account Structure

Since your staff will have their own individual accounts, you can keep your root account locked down. The root is the ultimate control of your Cloudflare account, and if you find yourself with a compromised individual account you will be able to revoke their access using the root account. Other than this type of “break glass” scenario this account should never be used. Unfortunately, Cloudflare doesn’t support a native way to be notified if this account is ever used. However, they do have a robust audit trail so you can develop automation to detect any use of this account.

The combination of individual accounts, and Cloudflare’s audit log also allows you to know who is doing what in an account. This principal of non-repudiation is a key security component that you gain when employing this recommended account structure.

Scoped permissions also create boundaries of how large an issue can spread. If a contractor only has the ability to modify the DNS records for a single site, then they can only take down that one site by breaking it’s DNS records.

At Zatik we had to build this runbook for ourselves as we were setting up our DNS infrastructure since we couldn’t find a similar step-by-step, vendor neutral, free guide, so we’re sharing our research in line with our Company Values to pay it forward to the next founder.

As an entrepreneur with an idea, one of the first things you will buy for your business is a domain name. This name is the root of your company’s identity. If you lose control, the company could see its website defaced, customer funds stolen/diverted, suffer downtime on websites and APIs, or see a further compromise of corporate assets as emails are redirected. When we started Zatik Security we wanted to register our domain in the most secure way possible. However, we couldn’t find any step-by-step, vendor neutral, free guidance, so we’re sharing our research in line with our Company Values to pay it forward to the next founder. None of the companies evaluated sponsored Zatik’s assessment or influenced our recommendations. These are our preferences, based on our research of publicly available feature documentation and professional experience as of March 2024. Gentlepersons can disagree, and your experience might be different.

As a startup or small business, a full-fledged enterprise domain registry solution probably isn’t necessary or cost effective for your business yet. From a security standpoint, an ideal registrar would support the following six features: a table of security features that a domain registrar should have

With these requirements in mind, I reviewed five domain Registrars frequently recommended in startup communities. Since our focus is enabling startups and small businesses, any features locked behind an “enterprise” tier have been excluded. The vendors we reviewed, in alphabetical order, were: Cloudflare, GoDaddy, Hover, Namecheap, and Squarespace. A table describing the results of Zatik Securit’s review of domain registrars

Cloudflare meets five of the six criteria that Zatik recommends.

1. 2FA: Requires anyone you invite use Two Factor Authentication (2FA). It is great to see a vendor offer this control on a non-enterprise plan with a simple checkbox.
2. Forbid SMS 2FA: Since Cloudflare only supports security key or app based second factors, you can have confidence that staff are not using SMS as second factor.
3. RBAC: Invite multiple users to your account with custom user access controls.
4. Audit Trail: The audit trail feature is very detailed and includes login information, but customers need to manually script notifications.
5. Forced Logout: Sessions can be destroyed using the Revoke Session feature. This allows you to log out an account which may be compromised.

What criteria was not met? Security Alerts: Cloudflare email notifications do not allow you to set up alerts for other members of your Cloudflare organization. They are only sent to the account’s email itself, so are not a reliable option to monitor for strange logins for other accounts

The full notes of my review can be found in the “Show Your Work” section at the end of this blog post. But I already have a domain purchased…

After conducting our review and identifying an ideal registrar, we only had one problem…we had bought zatik.io using Namecheap. Since domain owners are allowed to move their domains between registrars, we started the process of moving our DNS, and domain registration into a hardened Cloudflare account.

The first part of moving a domain name is to ensure the destination registrar supports the Top Level Domain (TLD) of the domain you want to move. Since we’re moving to Cloudflare, we confirmed that .io was one of their supported TLDs. Moving a domain has some restrictions which can prevent transferring registrars. The most common is that a domain cannot transfer if its WHOIS registration information has been modified within 60 days. Cloudflare provides a full list of reasons why a domain could be restricted from transfer into their system; you should review these materials before starting a domain name transfer.

When you plan to move a domain, you must ensure that any existing DNS entries at the source registrar are copied to the destination registrar. If they don’t match, you’ll end up causing an outage for your existing customers/users. I recommend having a second person compare the records at the source and destination registrars after you create them. The DNS records at the destination registrar will not have any impact until you change the nameservers at the source registrar to point to the destination. Once you make this change, DNS records will begin to update. Zatik makes use of several SaaS products for our employees, so I created a checklist before making any changes so I could verify the transfer process was completed.

Once the DNS change was completed, I began the process of transferring the registrar of Zatik.io. This process updates the business relationship to your domain and controls the company you will be renewing the domain with. To begin, you must unlock the domain at the source registrar, which will provide you with a verification code. Enter the code in the destination registrar to complete the transaction. When planning a move, you should budget 10 days into your timeline: your source registrar has up to 5 days to provide you the code, and another 5 to send it to your destination registrar. (It doesn’t usually take 10 days, but it can per the ICANN rules, so it’s good to set the time aside just in case.) The task to move to Cloudflare allowed Zatik to take advantage of their additional account security features. Now you can, too!

The Grayscale Color Filter can be flipped on any time by going to Settings > Accessibility > Display & Text Size > Color Filters> Grayscale. This will make the screen permenatily in greyscale. There are sometimes when you want this to be enabled and sometimes when you do not, so you can toggle this feature on an off via a triple click of the power button using the Accessibility Shortcut feature of iOS. Go to Settings > Accessibility > Accessibility Shortcut (1) > Color Filters (2). This will enable the last Color Filter that you made use of

This is good for one off toggling of this feature, but by pairing it with Shortcuts Automation you can have your phone enable this mode without you having to remember. If you have not installed the Shortcuts app you will need to install it from the iOS App Store to follow these instructions. There are 4 Automations that I have setup: Turn on Grayscale at 9:45 AM on Weekdays, Turn Grayscale off at 5 PM on Weekdays, Turn on Grayscale when Bedtime mode is enabled, Turn off Grayscale when Bedtime is disabled. This pattern gives me Grayscale mode when I need to be focusing on other things, or when I should put my phone down around bedtime.

To create the time based Automations, open up the Shortcuts app and select Automation at the bottom of the screen (this will be between Shortcuts and Gallery), then click the plus sign at the top right.

1. Click on the “Create Personal Automation” button
2. Choose the “Time of Day” option
3. Enter the time of day you want Grayscale to be enabled/disabled
4. Set the Repeat to “Weekly”, and uncheck the circles for Saturday and Sunday.
5. Click the “Add Action” button
6. Search for “Set color filter”
7. Set the value to “On” for your Automation to enable Grayscale, and “Off” for your Automation to turn it off at the end of the day
8. On the Review screen ensure you turn off the “Ask Before Running” option to have things run unprompted.
9. Tap “Don’t Ask”
10. Your screen should look like this. Then click “Done”

To create the event based Automations follow the same steps as above, but on step 2 select the “Sleep” option vs “Time of Day”.

1. Click on the “Create Personal Automation” button
2. Choose the “Sleep” option
3. Select “Wind down begins” for the Automation when Grayscale should be enabled, and “Waking Up” when Grayscale should be disabled.
4. Click the “Add Action” button
5. Search for “Set color filter”
6. Set the value to “On” for your Automation to enable Grayscale, and “Off” for your Automation to turn it off at the end of the day
7. On the Review screen ensure you turn off the “Ask Before Running” option to have things run unprompted.
8. Tap “Don’t Ask”
9. Your screen should look like this. Then click “Done”

With these four Automations in play your iPhone will enable and disable Grayscale on a schedule

If you are collaborating with a user who you don’t want to send to the notebook, you can also make use of colab features to send data directly to Google Sheets. The setups below walk though the process of using the Pandas library to analyze some of Google Colab’s California Housing sample data, and send the results to Google Sheets. Details are also in this sample notebook.

Step by Step

1. Create a new notebook on Google Colab
2. Import both the pandas and google.cloab libraries. You can use the #@title ... nomenclature to title a Python code cell in your Notebook. These will appear in the table of contents allowing you to jump around your notebook.
3. Use the colab library access the sample data. To access the path for an item in Google Drive open the file browser (1), navigate to the file and click the three dot menu (2), then select “copy path” (3)
4. Create a Pandas Dataframe with the sample data, then use the df.shape method to see this data has 3000 rows and 9 columns
5. To create a new Google Sheet for this data you need to authenticate your notebook to your Google Account. You will use this auth with the gspread library.
6. Using gspread to create a new spreadsheet and worksheet to the size of your data. then using worksheet.update put the data into Google Sheets

This will have your data into Google Sheets but the one line of worksheet.update([df.columns.values.tolist()] + df.values.tolist()) is doing a lot. How did this data actually get written.

The worksheet.update method takes in a list of data as the values attribute. If the elements of this list are themselves lists gspread will send this data as rows and columns to write to the sheet. For example if your data is data = [[1,1],[2,1],[3,1]] when this is written to Google Sheets it will be written as three rows, with two columns each

With this information we can keep diving into how worksheet.update([df.columns.values.tolist()] + df.values.tolist()) wrote our data to Google Sheets. df.columns.values.tolist() calls the columns attribute from the Pandas Dataframe. This is then converted to a list using tolist(). In order to have our list of lists as above this list is included inside of [ ] inside the worksheet.update. If this were the only data sent to Google Sheets it would only write the column names

To get each of the remaining 3000 rows of data df.values.tolist() is used to export the Dataframe’s data to a list. This is then added to the column names list using the add operator. When this add operation is complete we have a list with 3001 elements, each of which is a row to write to Google Sheets.

What’s next

This example only wrote the Dataframe directly to Google Sheets. However, you can use these same basics to write the output of any of your data analysis Dataframes or series to Google Sheets. You can also use gspread to update existing worksheets, or create multiple sheets for each of the answers you produce.

Create a TLS certificate

1. To enable your distribution to serve over TLS you will request a public certificate from Amazon Certificate Manager (ACM)
   1. For the “Fully qualified domain name” enter the domain name that you will eventually want the Pelican generated site to be accessed by
   2. Select “Use DNS validation”
   3. Click Create
2. At this point the certificate will be created but not valid, you need to prove ownership via DNS. Click on the Certificate ID. In the “Domains” section note the “CNAME name” and “CNAME value”.
3. In CloudFlare console for your domain create a CNAME using the values AWS provided above
   1. The AWS “CNAME name” corresponds to “Name” in CloudFlare console
   2. The AWS “CNAM value” corresponds to “Content” in CloudFlare console
   3. Disable the CloudFlare Proxy Toggle
4. Wait until the certificate’s status is “Issued” in the AWS console.

Create a CloudFront Distribution

1. Following AWS’ guide configure a Cloudfront Web Distribution
   1. Select your bucket created as the “Origin domain”
   2. For “S3 Bucket Access” select “Yes use OAI”, select create a new one, and have AWS update the bucket policy. An Origin Access Identity is another type of identity within AWS which will allow your bucket to be locked down to just access via CloudFront vs being made public.
   3. In the “Alternate domain name” section enter the domain you wish to use
   4. In the “Custom SSL certificate” dropdown select the ACM certificate you created above
   5. In the “Default root object” enter index.html. docs
   6. Leave other options at their default and click Create. You will need to wait to move on until the distribution is deployed until you can test
2. Once the Distribution is no longer showing as “Deploying” you should be able to see your site being served over TLS via the “Distribution domain name”/index.html

Configuring DNS

With a static site in the S3 bucket configured for static website hosting, and the CloudFront distribution configured via the “Distribution domain name”. Setting up DNS allows visitors to access this via your purchased domain name.

1. Within your CloudFlare dashboard, under the “Website” menu click on the “Add Site” button. Enter your domain name and click “Add site”. Select the free plan and contiune.
2. You will be provided with a review of the DNS records currently setup for the domain. If this is a fesh purchase you will likely see DNS records created by your registrar. Click Contiune.
3. You will be prompted to update the domain’s existing nameservers and point them to CloudFlare. This will allow CloudFlare to provide answers when browsers ask for information about your domain. These instructions will be unique for your domain registrar of choice.
4. Once you have updated your Name Servers click the “Done, check nameservers” button. If this fails after updating at your registrar give it some time and retry.
5. Within the CloudFlare “Quick Start Guide” accept the defaults and click “Finish”. Wait until CloudFlare confirms that your domain is congirued
6. Within CloudFlare create a CNAME record with a value of @, and the “Target” as your CloudFront Distribution Domain Name. Ensure you delete the https:// or you will get an error
7. Within CloudFlare select the “SSL/TLS” menu and set the encryption mode to “Full”.

Your site should now load at the domain name that you requested

When working with any type of system like this ensure you review the security and pricing. I got a good start using GitHub Actions based on a great post by johnkevinlosito@.

Setting up AWS Assets

If you do not already have an S3 Bucket configured for static website hosting complete these steps first. Please note that S3 is a paid service. There is a free tier but by using AWS assets you can incur charges.

1. In the Amazon S3 console locate the ARN of the bucket where you will store the files. It will look something like arn:aws:s3:::www.z1g1.net
2. In the AWS IAM Console Create a new IAM policy which only has the PutObject permission to the specific bucket ARN you captured above. Sample policy below.
   1. 
   2. Note that the Resource entry on line 8 ends with a *. This is key because if you don’t inclue this your user will not be able to actually overwrite any existing objects
3. To allow Github Action to make authenticated calls to Amazon S3 an AWS IAM user with limited permissions will be created.
   1. In the AWS IAM console create a new user, select the “Access Key - Programatic Access” option.
   2. Attach the policy that you created above to this user.
   3. Once you complete this wizard you will be prompted to download credetnaisl for the user. The Access Key ID (AKID) is not sensitive alone. However, the “Secret Access Key” needs to be kept secret. Capture this secret for future steps but do not put it in a source code file, or any file which might get uploaded to GitHub. Once you leave this page you will not be able to retreive this information again.

At this point you will have a bucket which can serve static HTML content. A future hardening step for this infrastrcuture would be to move away from IAM users to IAM roles.

Configuring GitHub

1. Following the GitHub Creating encrypted secrets for a repository documentation store the access key’s secret in the Github Repository for your static site.
2. In the root of the static site project create a folder called .github which will store the .yml file which defines our GitHub Action mkdir -p .github/workflows. Within this folder create a file called main.yml
   1. 
   2. Lines 3-6 are the trigger for this GitHub Action. Reads as “When there’s a push to the master branch”
   3. Lines 8-9 starts the deployment job. If there were other actions defined in this file they would be at the same level of indention as line 9
   4. Line 10 declares what OS will run our deployment action. This files uses the latest Ubuntu image but there are other options
   5. Line 11 starts the steps which will be run on the OS image selected above. GitHub action’s purpose is to reduce repettive deployment actions.
   6. Lines 12 - 13 says to use the second version of the checkout action. This action checks-out your repository under $GITHUB_WORKSPACE, so your workflow can access it. If you want to learn what an action/* does you can look it up under the https://github.com/ACTION_NAME path.
   7. Lines 15-20 setup the use of the AWS CLI for use by our worker. These are setup via configure-aws-credentials
   8. Line 18 includes the AKID to be used for the upload process. An AKID alone should not be considered a secret. However, this does introduces an Avaliblity issue as this workflow is now tied directly to this AKID. If it’s ever disabled/loses permissions the job will fail.
   9. Line 19 makes use of the GitHub Actions Secrets API to get the value of the Z1G1_NEW_WRITE_ONLY secret created above. You never want to include the Secret Key for an AWS IAM user within a GitHub repo, or any source code
   10. Lines 22-23 declare that we will run the S3 Sync command to upload the output directory to the s3 bucket used to host the site. The --delete at the end of the command will remove files that exist in the destination but not in the source are deleted during sync
3. When you run a git push to this repository your output folder will be written to the specified S3 bucket.

Debugging Deployment

There are a lot of moving parts to the setup which is created here. Capturing some debugging info if you run into errors.

1. You need to ensure that your IAM User has permssions to:
   1. The PutObject and ListObject permissions. Both of these are required to run the S3 Sync command. In addtion as you want to be able to remove posts from the site, the GitHub action used in this example includes the --delete option. To acomplish this your IAM user needs to have the s3:DeleteObject permission as well.
   2. Has access to both the bucket "arn:aws:s3:::www.z1g1.net", and the objects inside it "arn:aws:s3:::www.z1g1.net/*",
2. You might not be able to run git push after createing the workflow
   1. Ensure that your GitHub user / personal access token has permissions to create Workflows.
3. You might get an error saying “actions/checkout@v2 and aws-actions/configure-aws-credentials@v1 are not allowed to be used in …”
   1. Items listed is Steps of a Github Actions (lines 13, and 16) are code that your runner is executing. It’s convenient to use code that other wrote so you don’t have to rewrite it. However, this does introduce some level of risk as you’re running code others wrote on a system you own. GitHub Actions has 4 levels of permissions to control what can run. These are defined in the repo settings and range (from most to least restrctive): no actions at all, actions owned by the current org/user, actions written by GitHub or orgs they have verified, any action.
   2. 
   3. My repo is set to use GitHub and their verified plugins. I am trusting GitHub to write files to my S3 bucket so if they wanted to modify them they could, so this is an acceptable level of risk for me.

Example files

Sample IAM policy for GitHub Actions

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:ListBucket",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::www.z1g1.net/*",
                "arn:aws:s3:::www.z1g1.net"
            ]
        }
    ]
}

Sample main.yml for GitHub Actions

name: Upload Website via GitHub Actions

on:
  push:
    branches:
    - master

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v2

    - name: Configure AWS Credentials
      uses: aws-actions/configure-aws-credentials@v1
      with:
        aws-access-key-id: AKIAR2JKVZGO665RVFMT
        aws-secret-access-key: $
        aws-region: us-east-1

    - name: Deploy static site to S3 bucket
      run: aws s3 sync ./output/ s3://www.z1g1.net --delete

You need a command line system to run the commands below. I will be using my Ubuntu system

Creating the site

1. To install Pelican you will need to have Python and Pip installed.
   1. On Ubuntu Python 3 is installed by default but you will not be able to use the command python to run it you would need to use python3. To save yourself this you can create an alais in your .zshrc file.
   2. sudo apt install python pip
2. Pelican and all Pyton projects should be installed in a virtual enviroment (venv). On Ubuntu, you need to install the python3-ven package via apt
   1. sudo apt install python3.8-venv
3. create a directory in your projects directory and change to it. Other commands will be run and files executed from here
   1. mkdir -p ~/projects/SITE_NAME the -p will create the directories in the path
   2. cd ~/projects/SITE_NAME
4. Once within the site directory you will need to create an activate the virtual environment. The extra step of running inside a venv will allow your system to support work across multiple python projects without dependency issues.
   1. python3.8 -m venv venv will run the python module venv and create a new environment called venv. You can give it a unique name but it is common to just use the same name. This also allows for command aliasses to be created (below)
   2. source ./venv/bin/activate this will activate the virtual environment and any modules you install here will be limited to this project.
5. To make this command easier to work with you can create an alias inside of .zshrc, this is optional
   1. alias pynv="python3.8 -m venv venv" #New virtual environment
   2. alias pyav="source ./venv/bin/activate" # activate virtual environment
   3. alias pydv="deactivate" # deactivate virtual environment
6. Now you will install Pelican along with the Markdown moduel within the venv with python -m pip install pelican markdown
7. Use the pelican-quickstart commands and walk thru the wizard to fill in some information about your site.
   1. Enter a value from the “TZ database name” from this list
   2. I am planning to upload my site to S3 so I will answer yes to that question, and no to the other upload qusetions
8. There is now the basics of a site which you can see by using the pelican --listen command. This will show a version of the site that you can access locally at http://127.0.0.1:8000.
   1. If you are building the site on a remote host you will need to setup an ssh tunnel to access this site running on local host. I am building on windows so in a Poweshell terminal I will run ssh -L 8080:127.0.0.1:8000 User@Remote_Host -i User_Key_at_Remote_host. This command breaks down as take any trafic on port 8080 for 127.0.0.1 (aka localhost) and send it to port 8000 on the remote machine.
   2. To get my webbrowser to use this tunnel I am using FoxyProxy to send all Chrome traffic thru this tunnel. In Proxy Details I set the “Host or IP Address” to localhost and the port to 8080, and checked the SOCKS proxy box.
9. While developing your site you might want to run pelican with the auto reload feature. Anytime you make a change to the site’s files the site will be regenerated pelican --listen -r --ignore-cache. If you are working on a custom theme you can append ````-t path/to/theme``` on the command
10. I will be using the default Pelican theme for now, but you can create custom themes using this sytem.
11. The pelicanconf.py files contains some values which were set during the pelican-quickstart process. However, I make some additional changes to further configrue the site
    1. Remove all the entries from the LINKS blog roll. This will hide this item from the footer
    2. Update the SOCIAL item with links to social providles
    3. Add a line of DISPLAY_CATEGORIES_ON_MENU = False this will prevent the site from adding all categories to the menu bar
    4. Add a line of DISPLAY_PAGES_ON_MENU = True to add all items created under content/pages/ to the menu bar
    5. Add a line of INDEX_SAVE_AS = 'blog_index.html' this moves the default list of items from content/ from the front page of the site to a differnt location at blog_index.html.
    6. Use a tupple within MENUITEMS = (('Posts', 'blog_index.html'),) to add the blog index to the menu bar. You can add additional arbitraty menu items with additional tupples in the MENUITEMS setting option
    7. To ensure that the articles have a url structure that maps to post/yyyy/mm/d/title include two of the lines. 43 ARTICLE_URL = 'posts/{date.year}/{date.month}/{date.day}/{slug}.html' and ARTICLE_SAVE_AS = 'posts/{date.year}/{date.month}/{date.day}/{slug}.html'
12. To create a page to act as the front page create a file in content/pages/index.md. To ensure it shows as the front page set the following metadata at the top of the page. URL:, save_as: index.html, status: hidden

At this point you will have the skelton of a site, which as you add content will be written to HTML files in the output directory when you run the pelican command. These files can be uploaded to your object store of choice to act as your website. This site is hosted in Amazon S3. The next post in the series covers setting up GitHub Actions for continuous Deployment/ Continuous Intergration (CI/CD).

1. I am working on a windows computer so I wanted to start with installing WSL2 to give myself a Linux command line to operate from. I decided to use Ubuntu as the distro to install.
2. You can run the distro installed from WSL distro via the start menu. However, the Microsoft Terminal project gives you a number of customization options.
3. Under Startup setup Default profile to WSL distro
4. Optional if you want a white background. In the Microsoft Terminal under Color Schemes create a new Color Scheme with: Foreground Black, Background White, Cursor color Grey, and Selection Background as Grey, Yellow as Gold
5. Optional, use Color Tool to change the theme. Needs to be extracted and run via Powershell terminal not Ubuntu
6. To use the Github theme use .\ColorTool.exe github.itermcolors
7. This command and the rest below will take place in an Ubuntu/WSL terminal. To interact at the command line you need to use a shell. The one I use is zsh. There are many options out there, this is the one I use.
8. I create a projects directory in my home system as a working directory mkdir ~/projects
9. When setting up a linux system you can configure many of the programs on the system with congiguration files stored in your home directoy, colloquially refered to as dotfiles. To make a computer your own these will customize over time, many folks store theirs in a git repo so they don’t loose them. I store mine in a public [GitHub repo])https://github.com/z1g1/Dotfiles). To instal use the Git Clone command within the projects directory git clone https://github.com/z1g1/z1g1.net.git.
10. This will make a copy of all of the dotfiles into the projects/Dotfiles directory. For programs to find these files and load their config we will use symlinks below
11. The benefit of this seperate folder/symlink setup is that it allows you to version control your files without worrying about picking up detritus from your home directory. If you ever make an edit you don’t like you can roll back it via version control.
12. Create a symlink off of the Dotfiles repo into the home directory. This will allow for you to source control this file
13. .zshrc file ln -s ~/projects/Dotfiles/.zshrc ~/.zshrc
14. .tmux.conf file ln -s ~/projects/Dotfiles/.tmux.conf ~/.tmux.conf
15. .vimrc file ln -f -s ~/projects/Dotfiles/.vimrc ~/.vimrc
16. Set default shell to zsh with chsh followed by /usr/bin/zsh

This setup gives you an Ubuntu system running on windows to act as a foundation for a static webiste