feat: remove pulsing effect

Reviewed-on: #2

main.go

@@ -14,6 +14,22 @@ import (
 
 var templates = make(map[string]*template.Template)
 
+// pageTitles maps each edition page to its SEO title.
+var pageTitles = map[string]string{
+	"server":      "Arcline Server — Hardened SOC / Production Host",
+	"workstation": "Arcline Workstation — Security Analyst / Blue-Team Desktop",
+	"cloud":       "Arcline Cloud — Security-First Cloud Images",
+}
+
+// mustParse parses a template set and fails fast at startup on any error.
+func mustParse(name string, files ...string) *template.Template {
+	t, err := template.ParseFiles(files...)
+	if err != nil {
+		log.Fatalf("failed to parse %s template: %v", name, err)
+	}
+	return t
+}
+
 // contextKey is used to pass per-request log extras from handlers to the logging middleware.
 type contextKey struct{}
 type logContext struct{ extra string }
@@ -25,11 +41,23 @@ func main() {
 	}
 
 	// Parse templates once at startup.
-	index, err := template.ParseFiles("templates/base.html", "templates/index.html")
-	if err != nil {
-		log.Fatalf("failed to parse index template: %v", err)
+	templates["index"] = mustParse("index",
+		"templates/base.html",
+		"templates/index.html",
+		"templates/partials/nav.html",
+		"templates/partials/footer.html",
+		"templates/partials/waitlist_form.html",
+	)
+
+	for _, name := range []string{"server", "workstation", "cloud"} {
+		templates[name] = mustParse(name,
+			"templates/base.html",
+			"templates/"+name+".html",
+			"templates/partials/nav.html",
+			"templates/partials/footer.html",
+			"templates/partials/waitlist_form.html",
+		)
 	}
-	templates["index"] = index
 
 	waitlist, err := template.ParseFiles("templates/partials/waitlist_confirmation.html")
 	if err != nil {
@@ -45,6 +73,9 @@ func main() {
 
 	// Page routes
 	mux.HandleFunc("/", handleIndex)
+	mux.HandleFunc("/server", handlePage("server"))
+	mux.HandleFunc("/workstation", handlePage("workstation"))
+	mux.HandleFunc("/cloud", handlePage("cloud"))
 	mux.HandleFunc("/healthz", handleHealthz)
 
 	// HTMX partial routes
@@ -163,7 +194,9 @@ func handleIndex(w http.ResponseWriter, r *http.Request) {
 
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	data := map[string]interface{}{
-		"Title": "Arcline Project",
+		"Title":   "Arcline OS — Hardened Linux for Security Practitioners",
+		"Active":  "",
+		"Edition": "server",
 	}
 	if err := templates["index"].ExecuteTemplate(w, "base", data); err != nil {
 		log.Printf("render error: %v", err)
@@ -171,6 +204,27 @@ func handleIndex(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
+// handlePage renders one of the edition pages (server, workstation, cloud).
+func handlePage(page string) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/"+page {
+			http.NotFound(w, r)
+			return
+		}
+
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		data := map[string]interface{}{
+			"Title":   pageTitles[page],
+			"Active":  page,
+			"Edition": page,
+		}
+		if err := templates[page].ExecuteTemplate(w, "base", data); err != nil {
+			log.Printf("render error: %v", err)
+			http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		}
+	}
+}
+
 func handleWaitlist(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
 		http.Error(w, "Method Not Allowed", http.StatusMethodNotAllowed)

static/favicon.svg

@@ -1,6 +1,6 @@
 <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" width="32" height="32">
   <rect width="32" height="32" fill="#0b0c0e"/>
-  <path d="M5 27L16 5L27 27" fill="none" stroke="#0acf97" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"/>
-  <path d="M9 20H23" fill="none" stroke="#0acf97" stroke-width="2.5" stroke-linecap="round"/>
+  <path d="M5 27L16 5L27 27" fill="none" stroke="#f59e0b" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M9 20H23" fill="none" stroke="#f59e0b" stroke-width="2.5" stroke-linecap="round"/>
 </svg>
 

static/js/theme-toggle.js

@@ -0,0 +1,61 @@
+// ── Theme Toggle ──
+// Dark mode is the default. No data-theme attribute means dark mode.
+// Light mode is [data-theme="light"].
+
+(function () {
+  const STORAGE_KEY = "arcline-theme";
+  const LIGHT = "light";
+  const DARK = "dark";
+
+  function applyTheme(theme) {
+    if (theme === LIGHT) {
+      document.documentElement.setAttribute("data-theme", LIGHT);
+    } else {
+      document.documentElement.removeAttribute("data-theme");
+    }
+  }
+
+  // Read saved preference, default to dark
+  function getSavedTheme() {
+    try {
+      const stored = localStorage.getItem(STORAGE_KEY);
+      if (stored === LIGHT || stored === DARK) return stored;
+    } catch (_) {
+      // localStorage unavailable — ignore
+    }
+    return DARK;
+  }
+
+  function saveTheme(theme) {
+    try {
+      localStorage.setItem(STORAGE_KEY, theme);
+    } catch (_) {
+      // localStorage unavailable — ignore
+    }
+  }
+
+  // Apply the saved theme immediately (before page render)
+  const current = getSavedTheme();
+  applyTheme(current);
+
+  // Wire up toggle button(s) once the DOM is ready
+  function initToggle() {
+    const buttons = document.querySelectorAll("[data-theme-toggle]");
+    buttons.forEach(function (btn) {
+      btn.addEventListener("click", function () {
+        const next = document.documentElement.hasAttribute("data-theme")
+          ? DARK
+          : LIGHT;
+        applyTheme(next);
+        saveTheme(next);
+      });
+    });
+  }
+
+  if (document.readyState === "loading") {
+    document.addEventListener("DOMContentLoaded", initToggle);
+  } else {
+    initToggle();
+  }
+})();
+

templates/base.html

@@ -5,12 +5,21 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>{{.Title}}</title>
+    <meta name="description" content="Arcline OS is a hardened Debian-based Linux distribution for security practitioners — pre-configured SIEM agent, network IDS, compliance scanning, and zero telemetry.">
+    <meta name="theme-color" content="#f59e0b">
+    <meta property="og:type" content="website">
+    <meta property="og:site_name" content="Arcline Project">
+    <meta property="og:title" content="{{.Title}}">
+    <meta property="og:description" content="A hardened Debian-based Linux OS for people who defend infrastructure — SIEM agent, network IDS, compliance scanning, and zero telemetry, from first boot.">
+    <meta property="og:url" content="https://arclineproject.org/">
+    <meta name="twitter:card" content="summary">
     <link rel="icon" type="image/svg+xml" href="/static/favicon.svg">
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=Inter:opsz,wght@14..32,400..700&amp;family=JetBrains+Mono:ital,wght@0,400..700;1,400..700&amp;display=swap" rel="stylesheet">
     <link rel="stylesheet" href="/static/css/style.css">
     <script src="/static/js/htmx.min.js"></script>
+    <script src="/static/js/theme-toggle.js"></script>
 </head>
 <body>
     {{template "content" .}}

templates/cloud.html

@@ -0,0 +1,198 @@
+{{define "content"}}
+{{template "nav" .}}
+
+<main id="main">
+
+    <!-- Hero -->
+    <section class="hero hero-page">
+        <div class="hero-inner">
+            <h1>Arcline <span class="hero-highlight">Cloud</span></h1>
+            <p class="tagline">
+                Minimal cloud images with a small attack surface — Falco runtime security
+                and CIS benchmark scanning built in. Ready for AWS, GCP, Azure, or your
+                own private cloud.
+            </p>
+            <div class="hero-actions">
+                <a href="#get-started" class="cta">Get Early Access</a>
+                <a href="/" class="cta-secondary">See all editions</a>
+            </div>
+        </div>
+    </section>
+
+    <!-- Overview -->
+    <section class="section">
+        <div class="section-inner">
+            <div class="section-label">Overview</div>
+            <h2>Small footprint. Tight posture.<br>Security-first from the image.</h2>
+            <p class="section-desc">
+                Arcline Cloud is built for workloads that need the smallest possible attack
+                surface — a minimal hardened base with runtime and compliance watching built in.
+            </p>
+            <div class="principles-grid">
+                <div class="principle">
+                    <div class="principle-icon">
+                        <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                            <circle cx="12" cy="12" r="10"/>
+                            <path d="M2 12h20"/>
+                            <path d="M12 2a15.3 15.3 0 014 10 15.3 15.3 0 01-4 10"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <h3>Minimal attack surface</h3>
+                        <p>Nothing installed that you didn't ask for. Less to run, less to exploit, less to patch.</p>
+                    </div>
+                </div>
+                <div class="principle">
+                    <div class="principle-icon">
+                        <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                            <circle cx="12" cy="12" r="3"/>
+                            <path d="M12 2L22 8.5v7L12 22 2 15.5v-7L12 2z"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <h3>Runtime security</h3>
+                        <p>Falco watches for anomalous container and syscall behavior — in production, not just at install.</p>
+                    </div>
+                </div>
+                <div class="principle">
+                    <div class="principle-icon">
+                        <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                            <rect x="3" y="3" width="18" height="18" rx="3"/>
+                            <path d="M8 12l2.5 2.5L16 9"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <h3>CIS scanning built in</h3>
+                        <p>OpenSCAP with CIS Benchmark profiles, so posture checks are part of the image — not an afterthought.</p>
+                    </div>
+                </div>
+                <div class="principle">
+                    <div class="principle-icon">
+                        <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                            <rect x="2" y="2" width="20" height="20" rx="3"/>
+                            <rect x="6" y="6" width="12" height="12" rx="1.5" stroke-dasharray="3 2"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <h3>Hardened by default</h3>
+                        <p>The same hardened Debian base — lockdown-mode kernel, seccomp, AppArmor — as every edition.</p>
+                    </div>
+                </div>
+                <div class="principle">
+                    <div class="principle-icon">
+                        <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                            <circle cx="12" cy="12" r="10"/>
+                            <path d="M2 12h20"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <h3>Zero telemetry</h3>
+                        <p>No phone-home, no analytics, no cloud integration you didn't opt into.</p>
+                    </div>
+                </div>
+                <div class="principle">
+                    <div class="principle-icon">
+                        <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                            <rect x="2" y="2" width="20" height="20" rx="3"/>
+                            <path d="M12 2v20"/>
+                            <path d="M2 12h20"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <h3>Cloud-ready images</h3>
+                        <p>Minimal images ready for AWS, GCP, Azure, or your own private cloud.</p>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </section>
+
+    <!-- What's Included -->
+    <section class="section section-alt">
+        <div class="section-inner">
+            <div class="section-label">What's Included</div>
+            <h2>A security posture you can ship.</h2>
+            <p class="section-desc">
+                Arcline Cloud images are built around a minimal footprint with runtime and
+                compliance security in the image itself.
+            </p>
+            <div class="security-grid">
+                <div class="stack-card">
+                    <div class="stack-header">Base Image</div>
+                    <ul>
+                        <li>Minimal hardened Debian base</li>
+                        <li>Small package footprint</li>
+                        <li>btrfs root + snapshots</li>
+                    </ul>
+                </div>
+                <div class="stack-card">
+                    <div class="stack-header">Runtime Security</div>
+                    <ul>
+                        <li>Falco container / syscall detection</li>
+                        <li>seccomp + AppArmor</li>
+                        <li>Default-deny nftables</li>
+                    </ul>
+                </div>
+                <div class="stack-card">
+                    <div class="stack-header">Compliance</div>
+                    <ul>
+                        <li>OpenSCAP + CIS Benchmark profiles</li>
+                        <li>syft + grype SBOM / CVE scanning</li>
+                        <li>Lynis hardening score</li>
+                    </ul>
+                </div>
+                <div class="stack-card">
+                    <div class="stack-header">Platforms</div>
+                    <ul>
+                        <li>AWS</li>
+                        <li>GCP</li>
+                        <li>Azure</li>
+                        <li>Private cloud</li>
+                    </ul>
+                </div>
+            </div>
+            <div class="compliance-callout">
+                <div class="compliance-badge">Compliance-ready by default</div>
+                <p>
+                    Arcline Cloud images ship CIS Benchmark-aligned by default, with OpenSCAP
+                    scanning mapped toward <strong>HIPAA</strong>, <strong>PCI-DSS</strong>, and
+                    <strong>SOC 2</strong> control families. The images themselves aren't certified —
+                    only audited deployments can be — but the defaults give you a running start.
+                </p>
+            </div>
+        </div>
+    </section>
+
+    <!-- Other Editions -->
+    <section class="section">
+        <div class="section-inner">
+            <div class="section-label">Other Editions</div>
+            <h2>One hardened base. Three editions.</h2>
+            <p class="section-desc">
+                Every edition shares the same hardened Debian base and zero-telemetry guarantee.
+            </p>
+            <div class="edition-switcher">
+                <a href="/server" class="card-btn card-btn-secondary">Server</a>
+                <a href="/workstation" class="card-btn card-btn-secondary">Workstation</a>
+                <a href="/cloud" class="card-btn card-btn-primary" aria-current="page">Cloud</a>
+            </div>
+        </div>
+    </section>
+
+    <!-- Get Started -->
+    <section id="get-started" class="section section-alt">
+        <div class="section-inner">
+            <div class="section-label">Get Started</div>
+            <h2>Arcline Cloud is in active development.<br>Be there at the start.</h2>
+            <p class="section-desc">
+                We're building the ISO pipeline and hardening the defaults.
+                Sign up to receive early access and help shape the first release.
+            </p>
+            {{template "waitlistForm" .}}
+        </div>
+    </section>
+
+</main>
+
+{{template "footer" .}}
+{{end}}

templates/index.html

@@ -1,34 +1,19 @@
 {{define "content"}}
-<header class="nav">
-    <div class="nav-inner">
-        <a href="/" class="logo">
-            <svg class="logo-icon" width="28" height="28" viewBox="0 0 32 32" fill="none">
-                <rect width="32" height="32" fill="#0b0c0e"/>
-                <path d="M5 27L16 5L27 27" fill="none" stroke="#0acf97" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"/>
-                <path d="M9 20H23" fill="none" stroke="#0acf97" stroke-width="2.5" stroke-linecap="round"/>
-            </svg>
-            <span>Arcline Project</span>
-        </a>
-        <nav>
-            <a href="#about">About</a>
-            <a href="#toolchain">Toolchain</a>
-            <a href="#contribute">Contribute</a>
-            <a href="#get-started">Get Started</a>
-        </nav>
-    </div>
-</header>
+{{template "nav" .}}
+
+<main id="main">
 
-<main>
     <!-- Hero -->
     <section class="hero">
         <div class="hero-inner">
             <h1>
                 The Linux OS for<br>
-                <span class="hero-highlight">people who run infrastructure.</span>
+                <span class="hero-highlight">people who defend infrastructure.</span>
             </h1>
             <p class="tagline">
-                Hardened Debian base. Pre-configured monitoring, auditing, and security
-                tooling. Zero telemetry. Your systems are production-ready from first boot.
+                Hardened Debian base. Pre-configured security stack — SIEM agent, network
+                IDS, compliance scanning. Zero telemetry. Your systems are defense-ready
+                from first boot.
             </p>
             <div class="hero-actions">
                 <a href="#get-started" class="cta">Get Early Access</a>
@@ -37,16 +22,77 @@
         </div>
     </section>
 
+    <!-- Editions -->
+    <section id="editions" class="section">
+        <div class="section-inner">
+            <div class="section-label">Editions</div>
+            <h2>Our flagship Arcline OS variants<br>for different use cases.</h2>
+            <p class="section-desc">
+                Pick the edition that matches your role. All share the same
+                hardened Debian base and zero-telemetry guarantee.
+            </p>
+            <div class="editions-grid">
+                <div class="edition-card">
+                    <div class="edition-icon">
+                        <svg width="32" height="32" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                            <rect x="2" y="2" width="20" height="20" rx="3"/>
+                            <rect x="6" y="6" width="12" height="12" rx="1.5"/>
+                        </svg>
+                    </div>
+                    <h3>Arcline Server</h3>
+                    <p>A hardened, production-ready host for SOC and production use — built-in SIEM agent and network IDS on top of the hardened base, with zero telemetry.</p>
+                    <div class="card-actions">
+                        <a href="#get-started" class="card-btn card-btn-primary">Get Access</a>
+                        <a href="/server" class="card-btn card-btn-secondary">Learn More</a>
+                    </div>
+                </div>
+
+                <div class="edition-card">
+                    <div class="edition-icon">
+                        <svg width="32" height="32" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                            <rect x="2" y="3" width="20" height="14" rx="2"/>
+                            <path d="M8 21h8"/>
+                            <path d="M12 17v4"/>
+                        </svg>
+                    </div>
+                    <h3>Arcline Workstation</h3>
+                    <p>A security analyst / blue-team workstation — KDE Plasma, pre-configured dev toolchains, privacy-hardened browser, forensics-friendly tooling, and secrets scanning.</p>
+                    <div class="card-actions">
+                        <a href="#get-started" class="card-btn card-btn-primary">Get Access</a>
+                        <a href="/workstation" class="card-btn card-btn-secondary">Learn More</a>
+                    </div>
+                </div>
+
+                <div class="edition-card">
+                    <div class="edition-icon">
+                        <svg width="32" height="32" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                            <circle cx="12" cy="12" r="10"/>
+                            <path d="M2 12h20"/>
+                            <path d="M12 2a15.3 15.3 0 014 10 15.3 15.3 0 01-4 10"/>
+                            <path d="M12 2a15.3 15.3 0 00-4 10 15.3 15.3 0 004 10"/>
+                        </svg>
+                    </div>
+                    <h3>Arcline Cloud</h3>
+                    <p>Minimal cloud images with a small attack surface — Falco runtime security and CIS benchmark scanning built in. Ready for AWS, GCP, Azure, or private cloud.</p>
+                    <div class="card-actions">
+                        <a href="#get-started" class="card-btn card-btn-primary">Get Access</a>
+                        <a href="/cloud" class="card-btn card-btn-secondary">Learn More</a>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </section>
+
     <!-- What is Arcline OS -->
     <section id="about" class="section section-alt">
         <div class="section-inner">
-            <div class="section-label">what is arcline os?</div>
+            <div class="section-label">What is Arcline OS?</div>
             <h2>A Debian-derived OS that doesn't<br>make you start from scratch.</h2>
             <p class="section-desc">
                 Debian gives you a rock-solid base. Arcline OS hardens it, layers on a
-                full observability stack, and ships with pre-configured container
-                infrastructure. No telemetry. No snap store. No cloud integration.
-                Just a secure, auditable OS that respects your hardware.
+                full security and observability stack, and ships with pre-configured
+                container infrastructure. No telemetry. No snap store. No cloud
+                integration. Just a secure, auditable OS that respects your hardware.
             </p>
             <div class="principles-grid">
                 <div class="principle">
@@ -58,7 +104,7 @@
                     </div>
                     <div>
                         <h3>Secure by default</h3>
-                        <p>Hardened Linux kernel with seccomp, AppArmor profiles, and restrictive nftables firewall. You opt in to exposure — never out.</p>
+                        <p>Hardened kernel with lockdown, seccomp, and AppArmor profiles. Default-deny nftables firewall. You opt in to exposure — never out.</p>
                     </div>
                 </div>
                 <div class="principle">
@@ -108,7 +154,7 @@
                     </div>
                     <div>
                         <h3>Infrastructure-aware</h3>
-                        <p>Prometheus node_exporter, Grafana dashboards, and Loki log aggregation — pre-configured out of the box.</p>
+                        <p>Observability that feeds your security stack — node_exporter, Grafana, Loki, and a pre-configured host security agent, out of the box.</p>
                     </div>
                 </div>
                 <div class="principle">
@@ -132,11 +178,11 @@
     <!-- What's Included -->
     <section class="section">
         <div class="section-inner">
-            <div class="section-label">what's included</div>
+            <div class="section-label">What's Included</div>
             <h2>Production-ready from first boot.</h2>
             <p class="section-desc">
-                Arcline OS layers pre-configured infrastructure tooling on top of a hardened
-                Debian base. Everything is documented, auditable, and yours.
+                Arcline OS layers pre-configured infrastructure and security tooling on top
+                of a hardened Debian base. Everything is documented, auditable, and yours.
             </p>
             <div class="stack-grid">
                 <div class="stack-card">
@@ -149,17 +195,6 @@
                         <li>Docker + Podman containers</li>
                     </ul>
                 </div>
-                <div class="stack-card">
-                    <div class="stack-header">Arcline Toolchain</div>
-                    <ul>
-                        <li>arcline-uptime — service monitoring</li>
-                        <li>arcline-check — privacy auditor</li>
-                        <li>arcline-audit — site health scanner</li>
-                        <li>arcline-dns — propagation checker</li>
-                        <li>arcline-vault — secrets store</li>
-                        <li>arcline-email — self-hosted mail stack</li>
-                    </ul>
-                </div>
                 <div class="stack-card">
                     <div class="stack-header">Developer Environment</div>
                     <ul>
@@ -179,79 +214,101 @@
                     </ul>
                 </div>
             </div>
-            <div class="edition-teaser">
-                <div class="edition-teaser-badge">// arcline workstation — in development</div>
-                <p>
-                    <strong>Arcline Workstation</strong> — same hardened base, with a lightweight KDE Plasma desktop,
-                    pre-configured dev toolchains, and privacy-hardened browser profiles.
-                    One ISO. Two targets. Pick yours at install time.
-                </p>
-            </div>
         </div>
     </section>
 
-    <!-- Toolchain deep-dive -->
-    <section id="toolchain" class="section section-alt">
+    <!-- Security Stack -->
+    <section id="security" class="section">
         <div class="section-inner">
-            <div class="section-label">the toolchain</div>
-            <h2>11 Go tools. Built in production.<br>Yours to use.</h2>
+            <div class="section-label">Security Stack</div>
+            <h2>Defense-in-depth, pre-configured<br>from first boot.</h2>
             <p class="section-desc">
-                Every Arcline tool was built to solve real infrastructure problems.
-                They run in production at Arcline IT. Now they ship with Arcline OS.
+                Beyond the hardened base, Arcline OS ships a named security tooling layer —
+                host and network detection, malware and secrets scanning, compliance and
+                runtime checks. Pre-configured, documented, and yours.
             </p>
-            <div class="tool-grid">
-                <div class="tool">
-                    <code>arcline-uptime</code>
-                    <span>HTTP, TCP, TLS, DNS monitoring with Prometheus metrics export</span>
+            <div class="security-grid">
+                <div class="stack-card">
+                    <div class="stack-header">Host IDS / SIEM</div>
+                    <ul>
+                        <li>Wazuh agent, pre-configured</li>
+                        <li>Host + integrity telemetry to your SIEM</li>
+                    </ul>
                 </div>
-                <div class="tool">
-                    <code>arcline-check</code>
-                    <span>CDN and transparency auditor — verifies sites aren't leaking data</span>
+                <div class="stack-card">
+                    <div class="stack-header">Network IDS</div>
+                    <ul>
+                        <li>Suricata (or Zeek)</li>
+                        <li>Detects malicious traffic, not just uptime</li>
+                    </ul>
                 </div>
-                <div class="tool">
-                    <code>arcline-audit</code>
-                    <span>Full site health scanner — SSL, headers, performance, accessibility</span>
+                <div class="stack-card">
+                    <div class="stack-header">Malware Scanning</div>
+                    <ul>
+                        <li>ClamAV baseline scanning</li>
+                        <li>Scheduled and on-demand</li>
+                    </ul>
                 </div>
-                <div class="tool">
-                    <code>arcline-dns</code>
-                    <span>DNS propagation checker across multiple resolvers</span>
+                <div class="stack-card">
+                    <div class="stack-header">Compliance Scanning</div>
+                    <ul>
+                        <li>OpenSCAP + CIS Benchmark profiles</li>
+                        <li>Mapped toward HIPAA, PCI-DSS, SOC 2</li>
+                    </ul>
                 </div>
-                <div class="tool">
-                    <code>arcline-vault</code>
-                    <span>Encrypted secrets store with REST API and CLI</span>
+                <div class="stack-card">
+                    <div class="stack-header">Runtime Security</div>
+                    <ul>
+                        <li>Falco — container / syscall anomalies</li>
+                        <li>Cloud edition</li>
+                    </ul>
                 </div>
-                <div class="tool">
-                    <code>arcline-email</code>
-                    <span>Self-hosted SMTP/IMAP stack — OpenSMTPD + Dovecot + Rspamd</span>
+                <div class="stack-card">
+                    <div class="stack-header">Secrets Scanning</div>
+                    <ul>
+                        <li>gitleaks + trufflehog</li>
+                        <li>Workstation / dev edition</li>
+                    </ul>
                 </div>
-                <div class="tool">
-                    <code>arcline-migrate</code>
-                    <span>cPanel and Plesk to Arcline migration tool</span>
+                <div class="stack-card">
+                    <div class="stack-header">Supply Chain / SBOM</div>
+                    <ul>
+                        <li>syft + grype</li>
+                        <li>Know what's installed, catch known CVEs</li>
+                    </ul>
                 </div>
-                <div class="tool">
-                    <code>arcline-billing</code>
-                    <span>Stripe-powered subscription management</span>
-                </div>
-                <div class="tool">
-                    <code>arcline-portal</code>
-                    <span>Customer dashboard with SSL monitoring and ticketing</span>
-                </div>
-                <div class="tool">
-                    <code>arcline-website</code>
-                    <span>Go HTTP server powering arcline.it</span>
-                </div>
-                <div class="tool">
-                    <code>arcline-status</code>
-                    <span>Static status page generator</span>
+                <div class="stack-card">
+                    <div class="stack-header">System Auditing</div>
+                    <ul>
+                        <li>Lynis hardening score</li>
+                        <li>Continuous, post-install</li>
+                    </ul>
                 </div>
             </div>
+
+            <div class="compliance-callout">
+                <div class="compliance-badge">Compliance-ready by default</div>
+                <p>
+                    Arcline OS ships CIS Benchmark-aligned by default, with compliance scanning
+                    mapped toward <strong>HIPAA</strong>, <strong>PCI-DSS</strong>, and
+                    <strong>SOC 2</strong> control families. The OS itself isn't certified —
+                    only audited deployments can be — but the defaults give you a running start.
+                </p>
+            </div>
+
+            <p class="security-note">
+                The Wazuh agent pairs naturally with
+                <a href="https://arcline.it" class="inline-link">Arcline IT's</a>
+                Wazuh-based managed monitoring. Want the whole stack run and watched for you?
+                Arcline IT's managed security services cover hardening, monitoring, and response.
+            </p>
         </div>
     </section>
 
     <!-- Why Arcline OS -->
     <section class="section">
         <div class="section-inner">
-            <div class="section-label">why arcline os?</div>
+            <div class="section-label">Why Arcline OS?</div>
             <h2>No major Linux distro ships<br>pre-hardened for production.</h2>
             <p class="section-desc">
                 Debian gives you the packages. Arcline OS assembles them into a finished
@@ -272,9 +329,17 @@
                     <div class="compare-label">Alpine Linux</div>
                     <div class="compare-desc">Minimal and musl-based — ideal for containers, but limited as a full-featured server workstation.</div>
                 </div>
+                <div class="compare-card">
+                    <div class="compare-label">Kali Linux</div>
+                    <div class="compare-desc">A great offensive-security and pentesting toolkit — but built to break in, not to serve as a hardened daily-driver production OS.</div>
+                </div>
+                <div class="compare-card">
+                    <div class="compare-label">Security Onion</div>
+                    <div class="compare-desc">An excellent network security monitoring platform — but not a general-purpose or developer-ready OS for your day-to-day hosts.</div>
+                </div>
                 <div class="compare-card compare-highlight">
                     <div class="compare-label">Arcline OS</div>
-                    <div class="compare-desc">Hardened Debian base. Pre-configured toolchain. Built-in observability. Zero telemetry. Ready to deploy.</div>
+                    <div class="compare-desc">Hardened Debian base. Pre-configured security stack. Built-in observability. Zero telemetry. Ready to deploy.</div>
                 </div>
             </div>
         </div>
@@ -283,12 +348,12 @@
     <!-- Contribute -->
     <section id="contribute" class="section section-alt">
         <div class="section-inner">
-            <div class="section-label">community</div>
+            <div class="section-label">Community</div>
             <h2>Built in the open. Shaped by the<br>people who use it.</h2>
             <p class="section-desc">
                 Arcline OS is open-source under the GPL. The code lives on
                 <a href="https://git.arcline.it" class="inline-link">git.arcline.it</a>.
-                Every tool, every config, every build script — auditable and forkable.
+                Every config, every build script — auditable and forkable.
             </p>
             <div class="contribute-grid">
                 <a href="https://git.arcline.it" class="contribute-card">
@@ -298,7 +363,7 @@
                         </svg>
                     </div>
                     <span>Browse the source</span>
-                    <small>All 11 tools, build scripts, and infrastructure code.</small>
+                    <small>Build scripts, packaging, and infrastructure code.</small>
                 </a>
                 <a href="https://git.arcline.it" class="contribute-card">
                     <div class="contribute-icon">
@@ -329,71 +394,32 @@
     <!-- Get Started -->
     <section id="get-started" class="section">
         <div class="section-inner">
-            <div class="section-label">get started</div>
+            <div class="section-label">Get Started</div>
             <h2>Arcline OS is in active development.<br>Be there at the start.</h2>
             <p class="section-desc">
-                We're packaging the tools, building the ISO pipeline, and hardening the defaults.
+                We're building the ISO pipeline and hardening the defaults.
                 Sign up to receive early access and help shape the first release.
             </p>
-            <form
-                hx-post="/partials/waitlist"
-                hx-target="#waitlist-result"
-                hx-swap="outerHTML"
-                class="waitlist-form"
-            >
-                <fieldset class="edition-checkboxes">
-                    <legend>I'm interested in:</legend>
-                    <label class="edition-checkbox">
-                        <input type="checkbox" name="edition" value="server" checked>
-                        <span>Server</span>
-                    </label>
-                    <label class="edition-checkbox">
-                        <input type="checkbox" name="edition" value="workstation">
-                        <span>Workstation</span>
-                    </label>
-                </fieldset>
-                <input
-                    type="email"
-                    name="email"
-                    placeholder="you@example.com"
-                    required
-                    class="input"
-                >
-                <button type="submit" class="btn">Get Early Access</button>
-            </form>
-            <div id="waitlist-result"></div>
-            <p class="waitlist-note">No spam. No tracking. We'll only email you when there's something to try.</p>
+            {{template "waitlistForm" .}}
         </div>
     </section>
 
     <!-- Sponsor -->
     <section class="section section-alt sponsor-section">
         <div class="section-inner">
-            <div class="section-label">sponsored by</div>
+            <div class="section-label">Sponsored By</div>
             <div class="sponsor-content">
                 <div class="sponsor-desc">
                     <p>The Arcline Project is funded and operated by <strong>Arcline IT LLC</strong> — the same model as Red Hat and Fedora. The commercial services business at <a href="https://arcline.it" class="inline-link">arcline.it</a> keeps the lights on so the OS stays independent and sustainable.</p>
+                    <p>Arcline IT also offers managed security services — hardening, Wazuh-based monitoring, and response — for teams that want Arcline OS run and watched for them.</p>
                 </div>
                 <div class="sponsor-tagline">Secure by default. Self-hosted by principle.</div>
             </div>
         </div>
     </section>
+
 </main>
 
-<footer class="footer">
-    <div class="footer-inner">
-        <div class="footer-brand">
-            <a href="/" class="footer-logo">Arcline Project</a>
-            <p>An open-source OS for people who run infrastructure.</p>
-        </div>
-        <div class="footer-links">
-            <a href="https://arcline.it">Arcline IT</a>
-            <a href="https://git.arcline.it">Git</a>
-        </div>
-    </div>
-    <div class="footer-bottom">
-        <p>&copy; 2026 Arcline IT LLC. GPL Licensed. No telemetry. No tracking.</p>
-    </div>
-</footer>
+{{template "footer" .}}
 {{end}}
 

templates/partials/footer.html

@@ -0,0 +1,36 @@
+{{define "footer"}}
+<footer class="footer">
+    <div class="footer-grid">
+        <div class="footer-col">
+            <a href="/" class="footer-logo">Arcline Project</a>
+            <p>An open-source operating system for people who defend infrastructure. Hardened Debian base. Pre-configured security stack. Zero telemetry. Defense-ready.</p>
+        </div>
+        <div class="footer-col">
+            <h4>Editions</h4>
+            <ul>
+                <li><a href="/server">Server</a></li>
+                <li><a href="/workstation">Workstation</a></li>
+                <li><a href="/cloud">Cloud</a></li>
+            </ul>
+        </div>
+        <div class="footer-col">
+            <h4>Project</h4>
+            <ul>
+                <li><a href="/#about">About</a></li>
+                <li><a href="/#contribute">Contribute</a></li>
+                <li><a href="https://git.arcline.it">Source Code</a></li>
+            </ul>
+        </div>
+        <div class="footer-col">
+            <h4>Connect</h4>
+            <ul>
+                <li><a href="https://arcline.it">Arcline IT</a></li>
+                <li><a href="https://git.arcline.it">Git</a></li>
+            </ul>
+        </div>
+    </div>
+    <div class="footer-bottom">
+        <p>&copy; 2026 Arcline IT LLC. GPL Licensed. No telemetry. No tracking.</p>
+    </div>
+</footer>
+{{end}}

templates/partials/nav.html

@@ -0,0 +1,47 @@
+{{define "nav"}}
+<a href="#main" class="skip-link">Skip to main content</a>
+
+<header class="nav">
+    <div class="nav-inner">
+        <a href="/" class="logo">
+            <svg class="logo-icon" width="28" height="28" viewBox="0 0 32 32" fill="none">
+                <rect width="32" height="32" fill="#0b0c0e"/>
+                <path d="M5 27L16 5L27 27" fill="none" stroke="#f59e0b" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"/>
+                <path d="M9 20H23" fill="none" stroke="#f59e0b" stroke-width="2.5" stroke-linecap="round"/>
+            </svg>
+            <span>Arcline Project</span>
+        </a>
+        <nav>
+            <a href="/server"{{if eq .Active "server"}} class="nav-active" aria-current="page"{{end}}>Server</a>
+            <a href="/workstation"{{if eq .Active "workstation"}} class="nav-active" aria-current="page"{{end}}>Workstation</a>
+            <a href="/cloud"{{if eq .Active "cloud"}} class="nav-active" aria-current="page"{{end}}>Cloud</a>
+            <a href="/#about">About</a>
+            <a href="/#security">Security</a>
+            <a href="/#contribute">Contribute</a>
+            <button
+                type="button"
+                data-theme-toggle
+                class="theme-toggle"
+                aria-label="Toggle theme"
+                title="Toggle light / dark mode"
+            >
+                <svg class="theme-icon theme-icon-light" width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                    <circle cx="12" cy="12" r="5"/>
+                    <line x1="12" y1="1" x2="12" y2="3"/>
+                    <line x1="12" y1="21" x2="12" y2="23"/>
+                    <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+                    <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+                    <line x1="1" y1="12" x2="3" y2="12"/>
+                    <line x1="21" y1="12" x2="23" y2="12"/>
+                    <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+                    <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+                </svg>
+                <svg class="theme-icon theme-icon-dark" width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                    <path d="M21 12.79A9 9 0 1111.21 3 7 7 0 0021 12.79z"/>
+                </svg>
+            </button>
+            <a href="#get-started" class="nav-cta">Get Started</a>
+        </nav>
+    </div>
+</header>
+{{end}}

templates/partials/waitlist_form.html

@@ -0,0 +1,34 @@
+{{define "waitlistForm"}}
+<form
+    hx-post="/partials/waitlist"
+    hx-target="#waitlist-result"
+    hx-swap="outerHTML"
+    class="waitlist-form"
+>
+    <fieldset class="edition-checkboxes">
+        <legend>I'm interested in:</legend>
+        <label class="edition-checkbox">
+            <input type="checkbox" name="edition" value="server"{{if eq .Edition "server"}} checked{{end}}>
+            <span>Server</span>
+        </label>
+        <label class="edition-checkbox">
+            <input type="checkbox" name="edition" value="workstation"{{if eq .Edition "workstation"}} checked{{end}}>
+            <span>Workstation</span>
+        </label>
+        <label class="edition-checkbox">
+            <input type="checkbox" name="edition" value="cloud"{{if eq .Edition "cloud"}} checked{{end}}>
+            <span>Cloud</span>
+        </label>
+    </fieldset>
+    <input
+        type="email"
+        name="email"
+        placeholder="you@example.com"
+        required
+        class="input"
+    >
+    <button type="submit" class="btn">Get Early Access</button>
+</form>
+<div id="waitlist-result"></div>
+<p class="waitlist-note">No spam. No tracking. We'll only email you when there's something to try.</p>
+{{end}}

templates/server.html

@@ -0,0 +1,197 @@
+{{define "content"}}
+{{template "nav" .}}
+
+<main id="main">
+
+    <!-- Hero -->
+    <section class="hero hero-page">
+        <div class="hero-inner">
+            <h1>Arcline <span class="hero-highlight">Server</span></h1>
+            <p class="tagline">
+                A hardened, production-ready host for SOC and production use — built-in
+                SIEM agent and network IDS on top of the hardened Debian base, with
+                zero telemetry.
+            </p>
+            <div class="hero-actions">
+                <a href="#get-started" class="cta">Get Early Access</a>
+                <a href="/" class="cta-secondary">See all editions</a>
+            </div>
+        </div>
+    </section>
+
+    <!-- Overview -->
+    <section class="section">
+        <div class="section-inner">
+            <div class="section-label">Overview</div>
+            <h2>A production host that starts<br>defense-ready.</h2>
+            <p class="section-desc">
+                Arcline Server gives SOC teams and production workloads a hardened base and the
+                tooling to watch it — configured the way you'd do it yourself, if you had the weekend.
+            </p>
+            <div class="principles-grid">
+                <div class="principle">
+                    <div class="principle-icon">
+                        <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                            <rect x="3" y="3" width="18" height="18" rx="3"/>
+                            <path d="M8 12l2.5 2.5L16 9"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <h3>Hardened by default</h3>
+                        <p>Lockdown-mode kernel, seccomp, AppArmor profiles, and a default-deny nftables firewall. You opt in to exposure — never out.</p>
+                    </div>
+                </div>
+                <div class="principle">
+                    <div class="principle-icon">
+                        <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                            <path d="M2 12h20"/>
+                            <path d="M12 2a15.3 15.3 0 014 10 15.3 15.3 0 01-4 10"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <h3>SIEM-ready</h3>
+                        <p>A pre-configured Wazuh agent ships host and integrity telemetry straight to your SIEM out of the box.</p>
+                    </div>
+                </div>
+                <div class="principle">
+                    <div class="principle-icon">
+                        <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                            <circle cx="12" cy="12" r="3"/>
+                            <path d="M12 2L22 8.5v7L12 22 2 15.5v-7L12 2z"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <h3>Network IDS</h3>
+                        <p>Suricata (or Zeek) watches for malicious traffic — not just uptime.</p>
+                    </div>
+                </div>
+                <div class="principle">
+                    <div class="principle-icon">
+                        <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                            <rect x="2" y="2" width="20" height="20" rx="3"/>
+                            <rect x="6" y="6" width="12" height="12" rx="1.5" stroke-dasharray="3 2"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <h3>Rollback built in</h3>
+                        <p>btrfs root with subvolume snapshots, compression, and boot-to-snapshot rollback.</p>
+                    </div>
+                </div>
+                <div class="principle">
+                    <div class="principle-icon">
+                        <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                            <circle cx="12" cy="12" r="10"/>
+                            <path d="M12 6v6l4 2"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <h3>Observable</h3>
+                        <p>Prometheus node_exporter, Grafana dashboards, and Loki log aggregation — pre-configured.</p>
+                    </div>
+                </div>
+                <div class="principle">
+                    <div class="principle-icon">
+                        <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                            <circle cx="12" cy="12" r="10"/>
+                            <path d="M2 12h20"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <h3>Zero telemetry</h3>
+                        <p>No analytics, no phone-home, no cloud integration you didn't ask for. Your host talks to you, and no one else.</p>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </section>
+
+    <!-- What's Included -->
+    <section class="section section-alt">
+        <div class="section-inner">
+            <div class="section-label">What's Included</div>
+            <h2>Everything a defended server needs.</h2>
+            <p class="section-desc">
+                Arcline Server ships the base, the watchdogs, and the dashboards — pre-configured and documented.
+            </p>
+            <div class="security-grid">
+                <div class="stack-card">
+                    <div class="stack-header">Base System</div>
+                    <ul>
+                        <li>Hardened Debian base</li>
+                        <li>Lockdown-mode kernel + seccomp</li>
+                        <li>btrfs root + snapshot rollback</li>
+                        <li>nftables firewall (default-deny)</li>
+                    </ul>
+                </div>
+                <div class="stack-card">
+                    <div class="stack-header">Security Stack</div>
+                    <ul>
+                        <li>Wazuh agent (pre-configured)</li>
+                        <li>Suricata / Zeek network IDS</li>
+                        <li>OpenSCAP + CIS Benchmark profiles</li>
+                        <li>Lynis hardening score</li>
+                    </ul>
+                </div>
+                <div class="stack-card">
+                    <div class="stack-header">Observability</div>
+                    <ul>
+                        <li>Prometheus node_exporter</li>
+                        <li>Grafana dashboards</li>
+                        <li>Loki log aggregation</li>
+                        <li>Pre-built alerting rules</li>
+                    </ul>
+                </div>
+                <div class="stack-card">
+                    <div class="stack-header">Containers</div>
+                    <ul>
+                        <li>Docker + Podman</li>
+                        <li>syft + grype SBOM / CVE scanning</li>
+                        <li>ClamAV baseline scanning</li>
+                    </ul>
+                </div>
+            </div>
+            <div class="compliance-callout">
+                <div class="compliance-badge">Compliance-ready by default</div>
+                <p>
+                    Arcline Server ships CIS Benchmark-aligned by default, with OpenSCAP
+                    scanning mapped toward <strong>HIPAA</strong>, <strong>PCI-DSS</strong>, and
+                    <strong>SOC 2</strong> control families. The OS itself isn't certified —
+                    only audited deployments can be — but the defaults give you a running start.
+                </p>
+            </div>
+        </div>
+    </section>
+
+    <!-- Other Editions -->
+    <section class="section">
+        <div class="section-inner">
+            <div class="section-label">Other Editions</div>
+            <h2>One hardened base. Three editions.</h2>
+            <p class="section-desc">
+                Every edition shares the same hardened Debian base and zero-telemetry guarantee.
+            </p>
+            <div class="edition-switcher">
+                <a href="/server" class="card-btn card-btn-primary" aria-current="page">Server</a>
+                <a href="/workstation" class="card-btn card-btn-secondary">Workstation</a>
+                <a href="/cloud" class="card-btn card-btn-secondary">Cloud</a>
+            </div>
+        </div>
+    </section>
+
+    <!-- Get Started -->
+    <section id="get-started" class="section section-alt">
+        <div class="section-inner">
+            <div class="section-label">Get Started</div>
+            <h2>Arcline Server is in active development.<br>Be there at the start.</h2>
+            <p class="section-desc">
+                We're building the ISO pipeline and hardening the defaults.
+                Sign up to receive early access and help shape the first release.
+            </p>
+            {{template "waitlistForm" .}}
+        </div>
+    </section>
+
+</main>
+
+{{template "footer" .}}
+{{end}}

templates/workstation.html

@@ -0,0 +1,201 @@
+{{define "content"}}
+{{template "nav" .}}
+
+<main id="main">
+
+    <!-- Hero -->
+    <section class="hero hero-page">
+        <div class="hero-inner">
+            <h1>Arcline <span class="hero-highlight">Workstation</span></h1>
+            <p class="tagline">
+                A security analyst / blue-team workstation — KDE Plasma, pre-configured
+                dev toolchains, a privacy-hardened browser, forensics-friendly tooling,
+                and secrets scanning.
+            </p>
+            <div class="hero-actions">
+                <a href="#get-started" class="cta">Get Early Access</a>
+                <a href="/" class="cta-secondary">See all editions</a>
+            </div>
+        </div>
+    </section>
+
+    <!-- Overview -->
+    <section class="section">
+        <div class="section-inner">
+            <div class="section-label">Overview</div>
+            <h2>Built for the people on<br>the front line.</h2>
+            <p class="section-desc">
+                Arcline Workstation pairs a hardened base with the tools analysts and
+                security-minded developers use every day — without the telemetry that
+                most desktops quietly ship.
+            </p>
+            <div class="principles-grid">
+                <div class="principle">
+                    <div class="principle-icon">
+                        <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                            <rect x="2" y="3" width="20" height="14" rx="2"/>
+                            <path d="M8 21h8"/>
+                            <path d="M12 17v4"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <h3>KDE Plasma desktop</h3>
+                        <p>A lightweight, fully configurable desktop — tuned for long working sessions.</p>
+                    </div>
+                </div>
+                <div class="principle">
+                    <div class="principle-icon">
+                        <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                            <circle cx="12" cy="12" r="10"/>
+                            <path d="M2 12h20"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <h3>Privacy-hardened browser</h3>
+                        <p>A browser profile locked down out of the box — no tracking, no telemetry, no surprises.</p>
+                    </div>
+                </div>
+                <div class="principle">
+                    <div class="principle-icon">
+                        <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                            <rect x="3" y="3" width="18" height="18" rx="3"/>
+                            <path d="M8 12l2.5 2.5L16 9"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <h3>Secrets scanning</h3>
+                        <p>gitleaks and trufflehog pre-configured — catch leaked keys before they ship.</p>
+                    </div>
+                </div>
+                <div class="principle">
+                    <div class="principle-icon">
+                        <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                            <path d="M4 7h16v12H4V7z"/>
+                            <path d="M8 3v4"/>
+                            <path d="M16 3v4"/>
+                            <path d="M4 13h16" stroke-dasharray="2 1"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <h3>Dev toolchains ready</h3>
+                        <p>Go, Rust, Python, and Node.js toolchains pre-configured. Git, Make, and LLVM/Clang included.</p>
+                    </div>
+                </div>
+                <div class="principle">
+                    <div class="principle-icon">
+                        <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                            <circle cx="12" cy="12" r="3"/>
+                            <path d="M12 2L22 8.5v7L12 22 2 15.5v-7L12 2z"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <h3>Forensics-friendly</h3>
+                        <p>Tooling and a disk layout that make analysis and evidence handling straightforward.</p>
+                    </div>
+                </div>
+                <div class="principle">
+                    <div class="principle-icon">
+                        <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                            <rect x="3" y="3" width="18" height="18" rx="3"/>
+                            <path d="M8 12l2.5 2.5L16 9"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <h3>Hardened base</h3>
+                        <p>The same hardened Debian base, btrfs snapshots, and default-deny firewall as every edition.</p>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </section>
+
+    <!-- What's Included -->
+    <section class="section section-alt">
+        <div class="section-inner">
+            <div class="section-label">What's Included</div>
+            <h2>An analyst's desk, pre-configured.</h2>
+            <p class="section-desc">
+                Everything a blue-team or security-conscious developer needs to be productive on day one.
+            </p>
+            <div class="security-grid">
+                <div class="stack-card">
+                    <div class="stack-header">Desktop</div>
+                    <ul>
+                        <li>KDE Plasma</li>
+                        <li>Privacy-hardened browser profile</li>
+                        <li>Forensics-friendly tooling</li>
+                    </ul>
+                </div>
+                <div class="stack-card">
+                    <div class="stack-header">Development</div>
+                    <ul>
+                        <li>Go, Rust, Python, Node.js</li>
+                        <li>Git, Make, CMake, LLVM/Clang</li>
+                        <li>VS Code / Helix / Vim configs</li>
+                        <li>Docker / Podman</li>
+                    </ul>
+                </div>
+                <div class="stack-card">
+                    <div class="stack-header">Security</div>
+                    <ul>
+                        <li>gitleaks + trufflehog secrets scanning</li>
+                        <li>ClamAV baseline scanning</li>
+                        <li>Lynis hardening score</li>
+                        <li>OpenSCAP + CIS profiles</li>
+                    </ul>
+                </div>
+                <div class="stack-card">
+                    <div class="stack-header">Base System</div>
+                    <ul>
+                        <li>Hardened Debian base</li>
+                        <li>Lockdown-mode kernel + seccomp</li>
+                        <li>btrfs root + snapshot rollback</li>
+                        <li>Zero telemetry</li>
+                    </ul>
+                </div>
+            </div>
+            <div class="compliance-callout">
+                <div class="compliance-badge">Compliance-ready by default</div>
+                <p>
+                    Arcline Workstation ships CIS Benchmark-aligned by default, with OpenSCAP
+                    scanning mapped toward <strong>HIPAA</strong>, <strong>PCI-DSS</strong>, and
+                    <strong>SOC 2</strong> control families. The OS itself isn't certified —
+                    only audited deployments can be — but the defaults give you a running start.
+                </p>
+            </div>
+        </div>
+    </section>
+
+    <!-- Other Editions -->
+    <section class="section">
+        <div class="section-inner">
+            <div class="section-label">Other Editions</div>
+            <h2>One hardened base. Three editions.</h2>
+            <p class="section-desc">
+                Every edition shares the same hardened Debian base and zero-telemetry guarantee.
+            </p>
+            <div class="edition-switcher">
+                <a href="/server" class="card-btn card-btn-secondary">Server</a>
+                <a href="/workstation" class="card-btn card-btn-primary" aria-current="page">Workstation</a>
+                <a href="/cloud" class="card-btn card-btn-secondary">Cloud</a>
+            </div>
+        </div>
+    </section>
+
+    <!-- Get Started -->
+    <section id="get-started" class="section section-alt">
+        <div class="section-inner">
+            <div class="section-label">Get Started</div>
+            <h2>Arcline Workstation is in active development.<br>Be there at the start.</h2>
+            <p class="section-desc">
+                We're building the ISO pipeline and hardening the defaults.
+                Sign up to receive early access and help shape the first release.
+            </p>
+            {{template "waitlistForm" .}}
+        </div>
+    </section>
+
+</main>
+
+{{template "footer" .}}
+{{end}}