GitLab

Drops support for the last few `TLS_RSA_*` ciphers, specifically:

- TLS_RSA_WITH_AES_128_GCM_SHA256
- TLS_RSA_WITH_AES_256_GCM_SHA384
- TLS_RSA_WITH_AES_128_CBC_SHA256

Which at this point in history, should not impact many systems.

And move CAA block towards the top of DNS stuff.

Actually been running this configuration for a year or so, but never
committed it.

`viewer-response` Lambdas are invoked for every response from CloudFront
-> user, so the response after processing by the Lambda is not stored in
CloudFront. Good for highly dynamic stuff. But also means the Lambda
gets invoked on *every* response from CloudFront, which can add
latency (and monetary cost).

`origin-response` Lambdas are invoked for every response from the origin
-> CloudFront, so the output *is* cached in CloudFront. This means the
cost of the Lambda is only paid when CloudFront needs to reach back to
the origin for a resource. But it also means if there are changes made
the Lambda, will need to invalidate everything in CloudFront in order to
pick up the changes uniformly.

Since the current deploy process invalidates updated paths in
CloudFront, we can set the cache control header for files that are not
versioned by name, e.g., the HTML pages, to have a long cache lifetime
in CloudFront (`s-maxage`), while ensuring browsers/users also check
they are getting the latest content (`max-age=0,must-revalidate`)
CloudFront has. Goal being to help CloudFront have to check with the
origin as little as possible, should serve from it's cache immediately.

Nix flakes are still experimental, but why not experiment.

Maintain the old URL for now. May add redirect(s) later.

https://github.com/edwardtufte/tufte-css/commit/c6e436bba2bf92f75c7eb7ae6415ed08bf69ac4d

https://github.com/edwardtufte/tufte-css/commit/1678e9ea127b06897fa662e23e66b47687e92d10

Most of these domains are now defunct or owned by someone different than
when I wrote the post.

In particular the link checker is not happy with a relative path, but
good practice anyway.

Previously nix code would used bash/shell highlighting (the bash
definition lists `*.nix` as a supported extension), which is wrong and
looks broken.

This new definition is minimal, but at least differentiates comments,
strings, and some built-ins. It can grow over time. Eventually hope to
make it back up stream unless some else beats me to it.

And break out the history link item into it's own template to prevent
this kind of breakage in the future and maintain consistency.