Site Deploy Pipeline
Developer
Local Dev Machine
Hugo v0.158.0 extended · PaperMod theme (git submodule) · Content authored in Markdown · Local preview at localhost:1313
hugo server
zsh / fish / git bash
macOS · CachyOS · Windows
Version Control
GitHub — thestrad031487/cybergrind
Single branch strategy. PaperMod as git submodule. Daily news bot auto-commits to main — always pull before pushing to avoid conflicts.
main branch
git submodule
auto-commit (news bot)
Static Hosting
Cloudflare Pages
Build command: hugo --minify. Output directory: public/. Deploys globally to Cloudflare CDN within ~90 seconds of a push. HTTP headers (CSP, HSTS, X-Frame-Options) served from static/_headers.
auto-deploy
global CDN
static/_headers
www → apex redirect
Visitor
Browser
Static pages served instantly from CDN edge. Tool pages make JS fetch() calls to Cloudflare Workers and the CTI pipeline API at runtime — no page rebuild required for fresh data.
cybergrind.org
Fuse.js search
live JS fetch
Cloudflare Workers — API Proxy Layer
Workers sit between the browser and upstream APIs. They hold API keys in Cloudflare Secrets (never in code), cache responses at the edge, and enforce rate limit boundaries. Every Worker URL must be added to connect-src in static/_headers or the browser will silently block requests.
EPSS Worker
- Upstream
- FIRST EPSS API + NVD CVE API
- Cache
- Per request
- Used in
- CVE Research, EPSS Scanner
- Auth
- None (public APIs)
IP Reputation Worker
- Upstream
- AbuseIPDB
- Cache
- None (live lookup)
- Used in
- IP Reputation Check
- Auth
- API key (Worker Secret)
KEV Worker
- Upstream
- CISA KEV Catalog
- Cache
- 1 hour
- Used in
- KEV Checker, Blue Team
- Auth
- None (public feed)
Threat Map Worker
- Upstream
- AbuseIPDB Blacklist
- Cache
- 6 hours
- Used in
- Global Threat Map
- Auth
- API key (Worker Secret)
OSINT Feeds Worker
- Upstream
- IPsum + Emerging Threats + Feodo Tracker
- Cache
- 1 hour
- Used in
- Threat Map (OSINT tab)
- Auth
- None (public feeds)
Recent KEV Worker
- Upstream
- CISA KEV (10 most recent)
- Cache
- 1 hour
- Used in
- Blue Team widget
- Auth
- None (public feed)
Self-Hosted CTI Pipeline
Feed
CISA KEV
Public JSON. No auth required.
every 24h
Feed
URLhaus (abuse.ch)
Public CSV export. Malware distribution URLs.
every 1h
Feed
RSS Feeds
Krebs · BleepingComputer · THN · CISA · SANS ISC
every 2h
Feed
MalwareBazaar
Sample metadata. Free API key required.
every 6h
Python collectors (APScheduler)
Containerized Backend
Docker Compose — Windows Workstation
FastAPI + uvicorn serves the REST API. APScheduler runs collectors on their respective schedules. SQLite database stored in a Docker volume (gitignored). CORS configured for cybergrind.org and localhost:1313.
FastAPI
SQLite
APScheduler
Docker Compose
/api/health
outbound tunnel (no port forwarding)
Cloudflare Tunnel
cloudflared → api.cybergrind.org
Outbound connection from workstation to Cloudflare edge. No firewall ports opened. No public IP exposed. Runs as a Windows service (auto-starts on boot). Requires --protocol http2 when behind a VPN that blocks UDP/QUIC.
cloudflared
Windows service
http2 protocol
HTTPS termination at edge
Tool
Live CVEs
Filterable CISA KEV table. Overdue deadlines highlighted.
Tool
Threat Intel Feeds
Tabbed view: security news + live IOCs.
Tool
VT Hash Lookup
VirusTotal reports proxied via pipeline. MalwareBazaar samples.
Daily News Automation
Pipeline — fires daily at 11am CT via cron
📰
NewsAPI
Fetch cybersecurity headlines
🤖
Ollama
Llama 3.2 (local) generates commentary from headlines only
📝
Hugo Post
Markdown file written with frontmatter
🔀
Git Push
Auto-commit + push to main
🚀
Deploy
Cloudflare Pages builds + deploys (~90s)
Design System
Color Palette
- Cyber Orange
- #FF8C00 — primary accent
- Amber Glow
- #FFAD33 — secondary highlight
- Deep Charcoal
- #1A1C1E — page background
- Steel Gray
- #8E9297 — body text
Typography
- Display
- Syne — geometric, authoritative
- Monospace
- Space Mono — terminal aesthetic
- System
- -apple-system stack for body text in tool pages
Hugo Config
- Theme
- PaperMod (git submodule)
- env
- production — enables OG/Schema tags
- Search
- Fuse.js (JSON index output)
- Raw HTML
- goldmark unsafe = true
Infographic System
- HTML files
- static/infographics/
- Hugo stubs
- content/orange-book/ with layout: infographic
- Rendering
- iframe (auto-height via scrollHeight)
- Styling
- Self-contained, PaperMod CSS vars matched
Full Article
How We Built CyberGrind
Mid-level technical walkthrough covering every layer of this architecture — design decisions, code snippets, and gotchas learned in production.
READ THE ARTICLE →