Hugo - Tag - arleo.euhttps://www.arleo.eu/en/tags/hugo/Hugo - Tag - arleo.euHugo -- gohugo.ioenFri, 29 May 2026 20:30:00 +0200Hugo SEO: Googlebot 404s, noindex aliases and sitemap normalizationhttps://www.arleo.eu/en/posts/debug-seo-404-broken-links/Fri, 29 May 2026 20:30:00 +0200Jmrhttps://www.arleo.eu/en/posts/debug-seo-404-broken-links/

Context

Google Search Console was reporting four categories of issues on arleo.eu:

  • Googlebot 404s: /fr/tag/cloudflare, /en/tag/nginx, /fr/tag/javascript… URLs with /fr/ prefix or singular /tag/ never served by nginx
  • 16 “Excluded by noindex tag” pages: all redirect pages generated by aliases: in Hugo frontmatter
  • Robots tag: noodp hardcoded in the LoveIt theme
  • FR/EN sitemap: 104 vs 105 URLs — a duplicate FR tag and two missing tags

Act 1: Hugo aliases → nginx 301 redirects

Why Hugo generates noindex pages

Hugo generates aliases: frontmatter entries as static HTML files:

]]>Hugo: freezing Mermaid diagrams to static dark/light SVGshttps://www.arleo.eu/en/posts/debug-mermaid-svg-freeze/Fri, 29 May 2026 20:00:00 +0200Jmrhttps://www.arleo.eu/en/posts/debug-mermaid-svg-freeze/

Problem

Mermaid diagrams on arleo.eu were rendering client-side via cdn.jsdelivr.net. Three concrete consequences:

  1. CSP constraint — script-src cdn.jsdelivr.net and worker-src cdn.jsdelivr.net become mandatory (Mermaid v11 uses Web Workers for its parsers).
  2. Render flash — the diagram appears after JS execution, creating a visible delay.
  3. Dark theme ignored — Mermaid initialized the SVG in light mode even when the site theme was dark.

The solution: generate SVGs at build time with mmdc, outside any browser context.

]]>CSP A+ on Hugo + Cloudflare: from hash-based to origin allowlist, auto-monitoring and hardeninghttps://www.arleo.eu/en/posts/csp-a-plus-hugo-cloudflare-origin-allowlist/Thu, 28 May 2026 23:45:41 +0200Jmrhttps://www.arleo.eu/en/posts/csp-a-plus-hugo-cloudflare-origin-allowlist/

Context

arleo.eu runs on Hugo (KVM VM) → OpenResty (NUC) → Cloudflare (CDN/WAF). Goal: A+ score on Mozilla Observatory with a strict CSP that resists edge-side injections.

The journey went through three strategies over a few weeks — nonces, hashes, then origin allowlist — before landing on a stable, automated solution.

Act 1: why hash-based failed

The initial idea seemed solid: Hugo Pipes externalizes all JS with SRI, we list the hashes in the CSP, clean result. In practice, two problems made the approach impossible.

]]>SRI on Hugo: automated hashes, auto-update and BetterStack alertinghttps://www.arleo.eu/en/posts/sri-cdn-hugo-automate/Sun, 17 May 2026 00:00:00 +0000Jmrhttps://www.arleo.eu/en/posts/sri-cdn-hugo-automate/

Why SRI?

When your site loads resources from a third-party CDN — FontAwesome, Mermaid, Animate.css — you’re trusting an external party you have no control over. If jsdelivr.net gets compromised, or if a supposedly immutable version is silently mutated, your site can become an attack vector.

Subresource Integrity (SRI) solves this cleanly: every <link> or <script> tag carries an integrity="sha256-…" attribute that the browser verifies before executing the resource. If the hash doesn’t match, the browser blocks the load.

]]>CSP Hash on Hugo: migrating from nonce to hash to preserve CDN cachehttps://www.arleo.eu/en/posts/csp-hash-hugo/Sat, 16 May 2026 00:00:00 +0000Jmrhttps://www.arleo.eu/en/posts/csp-hash-hugo/<div class="featured-image"> <img src="/images/csp-hash-hugo-featured.png" referrerpolicy="no-referrer"> </div>CSP nonces and CDN caching are incompatible by design. On a Hugo static site, SHA-256 hashes are the native approach: computed at build time, stable across requests, and fully compatible with Cloudflare caching.Postmortem: TypeIt broken by Mermaid in LoveIt themehttps://www.arleo.eu/en/posts/postmortem-typeit-mermaid/Thu, 14 May 2026 09:46:31 +0200Jmrhttps://www.arleo.eu/en/posts/postmortem-typeit-mermaid/

TL;DR

The LoveIt theme’s typewriter animation (TypeIt) stopped working on the home after adding Mermaid diagrams to posts. Cause: a #id-1 DOM selector shared between both libraries. When Mermaid finds an orphan block in a home summary, its initialization crashes, and the JS init chain stops before reaching TypeIt. Fix: add `

]]>hugo-mcp Cloudflare plugin: smart cache purgehttps://www.arleo.eu/en/posts/hugo-mcp-plugin-cloudflare/Thu, 14 May 2026 09:43:19 +0200Jmrhttps://www.arleo.eu/en/posts/hugo-mcp-plugin-cloudflare/

TL;DR

The Cloudflare plugin in hugo-mcp v2.0 implements 3 cache purge modes (full, partial, smart). The partial mode computes the linked URLs to invalidate (canonical + sitemap + RSS + listing + home) to preserve 95% of the CDN cache on every modification. Concretely: 6 URLs purged instead of wiping everything. This post details the computation, the pitfalls, and why smart became the default.

]]>hugo-mcp v2.0: a Python plugin-system in 200 lineshttps://www.arleo.eu/en/posts/hugo-mcp-plugins-architecture/Sat, 09 May 2026 23:52:28 +0200Jmrhttps://www.arleo.eu/en/posts/hugo-mcp-plugins-architecture/

TL;DR

hugo-mcp v2.0.0 introduces a Python plugin-system that lets anyone add hooks after each create_page / update_page / delete_page operation. 200 lines of code for the core, 3 production plugins shipped (IndexNow, Google Indexing, Cloudflare). This post explains the design, the trade-offs, the security posture, and shows how to write your own plugin in 5 minutes.

]]>Grav → Hugo migration: 2 years of blog flipped in one dayhttps://www.arleo.eu/en/posts/migration-grav-hugo/Sat, 09 May 2026 22:33:22 +0200Jmrhttps://www.arleo.eu/en/posts/migration-grav-hugo/

TL;DR

On May 9, 2026, I switched arleo.eu from Grav (PHP CMS) to Hugo (Go static site generator) in a single session. Atomic flip (≈ 0 second downtime), 22 legacy articles migrated under /posts/ with SEO aliases to preserve Google-indexed URLs, BetterStack /ping monitoring intact throughout the operation.

The code and migration script are open source: github.com/jmrGrav/grav-to-hugo-migration.

]]>MCP security sprint delivered: v1.9.0, 10 chantiers, hardened ecosystemhttps://www.arleo.eu/en/posts/sprint-securite-mcp-livre/Sat, 09 May 2026 18:44:12 +0200Jmrhttps://www.arleo.eu/en/posts/sprint-securite-mcp-livre/

TL;DR

On May 9, 2026, I delivered all 10 chantiers of the MCP security sprint that I had announced earlier in the day in a single marathon session. hugo-mcp is now at v1.9.0 (GitHub Release), commit 1404f83 GPG-signed.

Here’s the high-level recap + a pedagogical deep-dive on 2 chantiers with real value beyond my specific context: C2 token rotation and C6 internal TLS.

Recap of 10 chantiers

# Chantier Implementation
C1 Rate limiting slowapi, 60 req/min per IP
C2 Token rotation tokens.json + token_mgr.py CLI
C3 JSON audit logs structlog, machine-readable events
C4 Strict Pydantic v2 CreatePageArgs / UpdatePageArgs with constraints
C5 bcrypt cost-12 Tokens hashed in storage
C6 NUC ↔ VM TLS EC P-256 cert, uvicorn SSL, proxy verifies the cert
C7 requirements.lock SHA-256 hashes via pip-compile --generate-hashes
C8 Info disclosure Docs off, generic exception handler, proxy_hide_header
C9 nginx WAF POST + application/json enforcement on /mcp, OWASP CRS active
C10 Backup DR backup.sh GPG-encrypted, 30-day retention

Full details in the CHANGELOG v1.9.0 and commit 1404f83.

]]>