From b8df82e383664dad4d8a5fce9a3ec2e4d9293bfc Mon Sep 17 00:00:00 2001 From: Blake Ridgway Date: Sat, 22 Aug 2026 22:02:34 -0500 Subject: [PATCH] Add dedicated edition pages (server, workstation, cloud) - Add /server, /workstation, /cloud routes with per-page SEO titles - Extract shared nav, footer, and waitlist form into partials - Nav links to edition pages with active-state highlighting; swap About/Security order - Waitlist form pre-checks the current edition and adds a Cloud option - Add page-hero variant, edition switcher, and active-nav styles - Responsive fixes: nav wraps at 540px, waitlist checkboxes wrap on narrow screens --- main.go | 64 +++++++- static/css/style.css | 41 +++++- templates/cloud.html | 199 +++++++++++++++++++++++++ templates/index.html | 114 +-------------- templates/partials/footer.html | 36 +++++ templates/partials/nav.html | 47 ++++++ templates/partials/waitlist_form.html | 34 +++++ templates/server.html | 198 +++++++++++++++++++++++++ templates/workstation.html | 202 ++++++++++++++++++++++++++ 9 files changed, 816 insertions(+), 119 deletions(-) create mode 100644 templates/cloud.html create mode 100644 templates/partials/footer.html create mode 100644 templates/partials/nav.html create mode 100644 templates/partials/waitlist_form.html create mode 100644 templates/server.html create mode 100644 templates/workstation.html diff --git a/main.go b/main.go index be5a844..eac07bb 100644 --- a/main.go +++ b/main.go @@ -14,6 +14,22 @@ import ( var templates = make(map[string]*template.Template) +// pageTitles maps each edition page to its SEO title. +var pageTitles = map[string]string{ + "server": "Arcline Server — Hardened SOC / Production Host", + "workstation": "Arcline Workstation — Security Analyst / Blue-Team Desktop", + "cloud": "Arcline Cloud — Security-First Cloud Images", +} + +// mustParse parses a template set and fails fast at startup on any error. +func mustParse(name string, files ...string) *template.Template { + t, err := template.ParseFiles(files...) + if err != nil { + log.Fatalf("failed to parse %s template: %v", name, err) + } + return t +} + // contextKey is used to pass per-request log extras from handlers to the logging middleware. type contextKey struct{} type logContext struct{ extra string } @@ -25,11 +41,23 @@ func main() { } // Parse templates once at startup. - index, err := template.ParseFiles("templates/base.html", "templates/index.html") - if err != nil { - log.Fatalf("failed to parse index template: %v", err) + templates["index"] = mustParse("index", + "templates/base.html", + "templates/index.html", + "templates/partials/nav.html", + "templates/partials/footer.html", + "templates/partials/waitlist_form.html", + ) + + for _, name := range []string{"server", "workstation", "cloud"} { + templates[name] = mustParse(name, + "templates/base.html", + "templates/"+name+".html", + "templates/partials/nav.html", + "templates/partials/footer.html", + "templates/partials/waitlist_form.html", + ) } - templates["index"] = index waitlist, err := template.ParseFiles("templates/partials/waitlist_confirmation.html") if err != nil { @@ -45,6 +73,9 @@ func main() { // Page routes mux.HandleFunc("/", handleIndex) + mux.HandleFunc("/server", handlePage("server")) + mux.HandleFunc("/workstation", handlePage("workstation")) + mux.HandleFunc("/cloud", handlePage("cloud")) mux.HandleFunc("/healthz", handleHealthz) // HTMX partial routes @@ -163,7 +194,9 @@ func handleIndex(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "text/html; charset=utf-8") data := map[string]interface{}{ - "Title": "Arcline OS — Hardened Linux for Security Practitioners", + "Title": "Arcline OS — Hardened Linux for Security Practitioners", + "Active": "", + "Edition": "server", } if err := templates["index"].ExecuteTemplate(w, "base", data); err != nil { log.Printf("render error: %v", err) @@ -171,6 +204,27 @@ func handleIndex(w http.ResponseWriter, r *http.Request) { } } +// handlePage renders one of the edition pages (server, workstation, cloud). +func handlePage(page string) http.HandlerFunc { + return func(w http.ResponseWriter, r *http.Request) { + if r.URL.Path != "/"+page { + http.NotFound(w, r) + return + } + + w.Header().Set("Content-Type", "text/html; charset=utf-8") + data := map[string]interface{}{ + "Title": pageTitles[page], + "Active": page, + "Edition": page, + } + if err := templates[page].ExecuteTemplate(w, "base", data); err != nil { + log.Printf("render error: %v", err) + http.Error(w, "Internal Server Error", http.StatusInternalServerError) + } + } +} + func handleWaitlist(w http.ResponseWriter, r *http.Request) { if r.Method != http.MethodPost { http.Error(w, "Method Not Allowed", http.StatusMethodNotAllowed) diff --git a/static/css/style.css b/static/css/style.css index 4c1f2a6..8b35646 100644 --- a/static/css/style.css +++ b/static/css/style.css @@ -223,6 +223,13 @@ body { background: var(--color-bg-alt); } +/* Current page indicator */ +.nav nav a.nav-active { + color: var(--color-text); + background: var(--color-bg-alt); + box-shadow: inset 0 -2px 0 var(--color-accent); +} + .nav-cta { background: var(--color-accent) !important; color: var(--color-cta-text) !important; @@ -265,7 +272,8 @@ body { [data-theme="light"] .theme-icon-light { display: none; } /* ── Hero ── */ -.hero { +.hero, +.hero-page { position: relative; padding: 96px 28px 72px; text-align: center; @@ -278,6 +286,15 @@ body { border-bottom: 1px solid var(--color-border-light); } +/* Smaller hero variant used on the edition pages */ +.hero-page { + padding: 76px 28px 60px; +} + +.hero-page h1 { + font-size: clamp(1.9rem, 4vw, 2.7rem); +} + .hero-inner { max-width: var(--w-narrow); margin: 0 auto; @@ -609,6 +626,14 @@ body { background: var(--color-bg-alt); } +/* ── Edition Switcher (cross-links between edition pages) ── */ +.edition-switcher { + display: flex; + flex-wrap: wrap; + gap: 10px; + justify-content: center; +} + /* ── Feature Grid ── */ .features-grid { display: grid; @@ -1018,7 +1043,8 @@ body { border: none; padding: 0; display: flex; - gap: 24px; + flex-wrap: wrap; + gap: 16px 24px; justify-content: center; } @@ -1249,7 +1275,8 @@ body { --pad-section: 56px; } - .hero { + .hero, + .hero-page { padding: 60px 22px 50px; } @@ -1315,11 +1342,13 @@ body { } @media (max-width: 580px) { - .hero { + .hero, + .hero-page { padding: 44px 18px 36px; } - .hero h1 { + .hero h1, + .hero-page h1 { font-size: 1.75rem; } @@ -1391,7 +1420,7 @@ body { } /* Very small screens: wrap the nav links onto their own row */ -@media (max-width: 480px) { +@media (max-width: 540px) { .nav-inner { height: auto; flex-wrap: wrap; diff --git a/templates/cloud.html b/templates/cloud.html new file mode 100644 index 0000000..7353972 --- /dev/null +++ b/templates/cloud.html @@ -0,0 +1,199 @@ +{{define "content"}} +{{template "nav" .}} + +
+ + +
+
+

// edition · cloud

+

Arcline Cloud

+

+ Minimal cloud images with a small attack surface — Falco runtime security + and CIS benchmark scanning built in. Ready for AWS, GCP, Azure, or your + own private cloud. +

+
+ Get Early Access + See all editions +
+
+
+ + +
+
+
Overview
+

Small footprint. Tight posture.
Security-first from the image.

+

+ Arcline Cloud is built for workloads that need the smallest possible attack + surface — a minimal hardened base with runtime and compliance watching built in. +

+
+
+
+ + + + + +
+
+

Minimal attack surface

+

Nothing installed that you didn't ask for. Less to run, less to exploit, less to patch.

+
+
+
+
+ + + + +
+
+

Runtime security

+

Falco watches for anomalous container and syscall behavior — in production, not just at install.

+
+
+
+
+ + + + +
+
+

CIS scanning built in

+

OpenSCAP with CIS Benchmark profiles, so posture checks are part of the image — not an afterthought.

+
+
+
+
+ + + + +
+
+

Hardened by default

+

The same hardened Debian base — lockdown-mode kernel, seccomp, AppArmor — as every edition.

+
+
+
+
+ + + + +
+
+

Zero telemetry

+

No phone-home, no analytics, no cloud integration you didn't opt into.

+
+
+
+
+ + + + + +
+
+

Cloud-ready images

+

Minimal images ready for AWS, GCP, Azure, or your own private cloud.

+
+
+
+
+
+ + +
+
+
What's Included
+

A security posture you can ship.

+

+ Arcline Cloud images are built around a minimal footprint with runtime and + compliance security in the image itself. +

+
+
+
Base Image
+
    +
  • Minimal hardened Debian base
    • +
  • Small package footprint
    • +
  • btrfs root + snapshots
    • +
+
+
+
Runtime Security
+
    +
  • Falco container / syscall detection
    • +
  • seccomp + AppArmor
    • +
  • Default-deny nftables
    • +
+
+
+
Compliance
+
    +
  • OpenSCAP + CIS Benchmark profiles
    • +
  • syft + grype SBOM / CVE scanning
    • +
  • Lynis hardening score
    • +
+
+
+
Platforms
+
    +
  • AWS
    • +
  • GCP
    • +
  • Azure
    • +
  • Private cloud
    • +
+
+
+
+
Compliance-ready by default
+

+ Arcline Cloud images ship CIS Benchmark-aligned by default, with OpenSCAP + scanning mapped toward HIPAA, PCI-DSS, and + SOC 2 control families. The images themselves aren't certified — + only audited deployments can be — but the defaults give you a running start. +

+
+
+
+ + +
+
+
Other Editions
+

One hardened base. Three editions.

+

+ Every edition shares the same hardened Debian base and zero-telemetry guarantee. +

+
+ Server + Workstation + Cloud +
+
+
+ + +
+
+
Get Started
+

Arcline Cloud is in active development.
Be there at the start.

+

+ We're building the ISO pipeline and hardening the defaults. + Sign up to receive early access and help shape the first release. +

+ {{template "waitlistForm" .}} +
+
+ +
+ +{{template "footer" .}} +{{end}} diff --git a/templates/index.html b/templates/index.html index ff136e7..c59eaca 100644 --- a/templates/index.html +++ b/templates/index.html @@ -1,47 +1,5 @@ {{define "content"}} - - -
-
- - -
-
+{{template "nav" .}}
@@ -86,7 +44,7 @@

A hardened, production-ready host for SOC and production use — built-in SIEM agent and network IDS on top of the hardened base, with zero telemetry.

Get Access - Learn More + Learn More
@@ -102,7 +60,7 @@

A security analyst / blue-team workstation — KDE Plasma, pre-configured dev toolchains, privacy-hardened browser, forensics-friendly tooling, and secrets scanning.

Get Access - Coming Soon + Learn More
@@ -119,7 +77,7 @@

Minimal cloud images with a small attack surface — Falco runtime security and CIS benchmark scanning built in. Ready for AWS, GCP, Azure, or private cloud.

Get Access - Learn More + Learn More
@@ -443,34 +401,7 @@ We're building the ISO pipeline and hardening the defaults. Sign up to receive early access and help shape the first release.

-
-
- I'm interested in: - - -
- - -
-
-

No spam. No tracking. We'll only email you when there's something to try.

+ {{template "waitlistForm" .}} @@ -490,39 +421,6 @@
- +{{template "footer" .}} {{end}} diff --git a/templates/partials/footer.html b/templates/partials/footer.html new file mode 100644 index 0000000..5d79904 --- /dev/null +++ b/templates/partials/footer.html @@ -0,0 +1,36 @@ +{{define "footer"}} + +{{end}} diff --git a/templates/partials/nav.html b/templates/partials/nav.html new file mode 100644 index 0000000..1a2ea31 --- /dev/null +++ b/templates/partials/nav.html @@ -0,0 +1,47 @@ +{{define "nav"}} + + +
+
+ + +
+
+{{end}} diff --git a/templates/partials/waitlist_form.html b/templates/partials/waitlist_form.html new file mode 100644 index 0000000..a80dd0c --- /dev/null +++ b/templates/partials/waitlist_form.html @@ -0,0 +1,34 @@ +{{define "waitlistForm"}} +
+
+ I'm interested in: + + + +
+ + +
+
+

No spam. No tracking. We'll only email you when there's something to try.

+{{end}} diff --git a/templates/server.html b/templates/server.html new file mode 100644 index 0000000..635e74b --- /dev/null +++ b/templates/server.html @@ -0,0 +1,198 @@ +{{define "content"}} +{{template "nav" .}} + +
+ + +
+
+

// edition · server

+

Arcline Server

+

+ A hardened, production-ready host for SOC and production use — built-in + SIEM agent and network IDS on top of the hardened Debian base, with + zero telemetry. +

+
+ Get Early Access + See all editions +
+
+
+ + +
+
+
Overview
+

A production host that starts
defense-ready.

+

+ Arcline Server gives SOC teams and production workloads a hardened base and the + tooling to watch it — configured the way you'd do it yourself, if you had the weekend. +

+
+
+
+ + + + +
+
+

Hardened by default

+

Lockdown-mode kernel, seccomp, AppArmor profiles, and a default-deny nftables firewall. You opt in to exposure — never out.

+
+
+
+
+ + + + +
+
+

SIEM-ready

+

A pre-configured Wazuh agent ships host and integrity telemetry straight to your SIEM out of the box.

+
+
+
+
+ + + + +
+
+

Network IDS

+

Suricata (or Zeek) watches for malicious traffic — not just uptime.

+
+
+
+
+ + + + +
+
+

Rollback built in

+

btrfs root with subvolume snapshots, compression, and boot-to-snapshot rollback.

+
+
+
+
+ + + + +
+
+

Observable

+

Prometheus node_exporter, Grafana dashboards, and Loki log aggregation — pre-configured.

+
+
+
+
+ + + + +
+
+

Zero telemetry

+

No analytics, no phone-home, no cloud integration you didn't ask for. Your host talks to you, and no one else.

+
+
+
+
+
+ + +
+
+
What's Included
+

Everything a defended server needs.

+

+ Arcline Server ships the base, the watchdogs, and the dashboards — pre-configured and documented. +

+
+
+
Base System
+
    +
  • Hardened Debian base
    • +
  • Lockdown-mode kernel + seccomp
    • +
  • btrfs root + snapshot rollback
    • +
  • nftables firewall (default-deny)
    • +
+
+
+
Security Stack
+
    +
  • Wazuh agent (pre-configured)
    • +
  • Suricata / Zeek network IDS
    • +
  • OpenSCAP + CIS Benchmark profiles
    • +
  • Lynis hardening score
    • +
+
+
+
Observability
+
    +
  • Prometheus node_exporter
    • +
  • Grafana dashboards
    • +
  • Loki log aggregation
    • +
  • Pre-built alerting rules
    • +
+
+
+
Containers
+
    +
  • Docker + Podman
    • +
  • syft + grype SBOM / CVE scanning
    • +
  • ClamAV baseline scanning
    • +
+
+
+
+
Compliance-ready by default
+

+ Arcline Server ships CIS Benchmark-aligned by default, with OpenSCAP + scanning mapped toward HIPAA, PCI-DSS, and + SOC 2 control families. The OS itself isn't certified — + only audited deployments can be — but the defaults give you a running start. +

+
+
+
+ + +
+
+
Other Editions
+

One hardened base. Three editions.

+

+ Every edition shares the same hardened Debian base and zero-telemetry guarantee. +

+
+ Server + Workstation + Cloud +
+
+
+ + +
+
+
Get Started
+

Arcline Server is in active development.
Be there at the start.

+

+ We're building the ISO pipeline and hardening the defaults. + Sign up to receive early access and help shape the first release. +

+ {{template "waitlistForm" .}} +
+
+ +
+ +{{template "footer" .}} +{{end}} diff --git a/templates/workstation.html b/templates/workstation.html new file mode 100644 index 0000000..255411a --- /dev/null +++ b/templates/workstation.html @@ -0,0 +1,202 @@ +{{define "content"}} +{{template "nav" .}} + +
+ + +
+
+

// edition · workstation

+

Arcline Workstation

+

+ A security analyst / blue-team workstation — KDE Plasma, pre-configured + dev toolchains, a privacy-hardened browser, forensics-friendly tooling, + and secrets scanning. +

+
+ Get Early Access + See all editions +
+
+
+ + +
+
+
Overview
+

Built for the people on
the front line.

+

+ Arcline Workstation pairs a hardened base with the tools analysts and + security-minded developers use every day — without the telemetry that + most desktops quietly ship. +

+
+
+
+ + + + + +
+
+

KDE Plasma desktop

+

A lightweight, fully configurable desktop — tuned for long working sessions.

+
+
+
+
+ + + + +
+
+

Privacy-hardened browser

+

A browser profile locked down out of the box — no tracking, no telemetry, no surprises.

+
+
+
+
+ + + + +
+
+

Secrets scanning

+

gitleaks and trufflehog pre-configured — catch leaked keys before they ship.

+
+
+
+
+ + + + + + +
+
+

Dev toolchains ready

+

Go, Rust, Python, and Node.js toolchains pre-configured. Git, Make, and LLVM/Clang included.

+
+
+
+
+ + + + +
+
+

Forensics-friendly

+

Tooling and a disk layout that make analysis and evidence handling straightforward.

+
+
+
+
+ + + + +
+
+

Hardened base

+

The same hardened Debian base, btrfs snapshots, and default-deny firewall as every edition.

+
+
+
+
+
+ + +
+
+
What's Included
+

An analyst's desk, pre-configured.

+

+ Everything a blue-team or security-conscious developer needs to be productive on day one. +

+
+
+
Desktop
+
    +
  • KDE Plasma
    • +
  • Privacy-hardened browser profile
    • +
  • Forensics-friendly tooling
    • +
+
+
+
Development
+
    +
  • Go, Rust, Python, Node.js
    • +
  • Git, Make, CMake, LLVM/Clang
    • +
  • VS Code / Helix / Vim configs
    • +
  • Docker / Podman
    • +
+
+
+
Security
+
    +
  • gitleaks + trufflehog secrets scanning
    • +
  • ClamAV baseline scanning
    • +
  • Lynis hardening score
    • +
  • OpenSCAP + CIS profiles
    • +
+
+
+
Base System
+
    +
  • Hardened Debian base
    • +
  • Lockdown-mode kernel + seccomp
    • +
  • btrfs root + snapshot rollback
    • +
  • Zero telemetry
    • +
+
+
+
+
Compliance-ready by default
+

+ Arcline Workstation ships CIS Benchmark-aligned by default, with OpenSCAP + scanning mapped toward HIPAA, PCI-DSS, and + SOC 2 control families. The OS itself isn't certified — + only audited deployments can be — but the defaults give you a running start. +

+
+
+
+ + +
+
+
Other Editions
+

One hardened base. Three editions.

+

+ Every edition shares the same hardened Debian base and zero-telemetry guarantee. +

+
+ Server + Workstation + Cloud +
+
+
+ + +
+
+
Get Started
+

Arcline Workstation is in active development.
Be there at the start.

+

+ We're building the ISO pipeline and hardening the defaults. + Sign up to receive early access and help shape the first release. +

+ {{template "waitlistForm" .}} +
+
+ +
+ +{{template "footer" .}} +{{end}}