Credits

Almost everything here was made by other people and given away. This page names it, because a consultancy that will not say what it runs is asking for a trust it has not offered.

It is also the shortest honest answer to “what do you actually work with”. The list below is not a capability brochure — it is this site’s own bill of materials, and you can check every line of it from your own browser.

What reaches your browser

Five things, and nothing else: HTML, one stylesheet, two webfonts, images, and one small script of our own.

• HTML, written out in full before you asked for it. Every page is a file on disk, not a template assembled per request.
• One CSS bundle, concatenated and fingerprinted at build time and served with a Subresource Integrity hash, so your browser can verify it arrived unmodified. Inside it rides neat-annotations by Max Syabro (MIT) — the hand-drawn arrows and margin notes, drawn in CSS alone.
• The Ubuntu typeface, by Dalton Maag for Canonical, under the Ubuntu Font Licence. Served from our own machine — a webfont from someone else’s CDN is a third party watching you read.
• The Shantell Sans typeface, based on the artist Shantell Martin’s felt-marker handwriting, by Arrow Type / Stephen Nixon, under the SIL Open Font License. It writes the margin notes, is served the same way, and loads only on the pages that carry one.
• WebP and PNG images, sized at build time. The walls these pages are built on are photographs. Two are from Unsplash: Tim Mossholder shot the dark plaster, Joe Woods the white brick. Three more are John Snow’s, shot on a Galaxy S22 Ultra and given to this site: the pale plaster, the painted brick and the tiled wall. The light theme wears one of its four walls, drawn while the page is built, so the site is dressed afresh each time it is published. The licence does not ask for a credit; a page that names a typeface’s designer should not need asking. The mark, the cog, the mascot in every pose you will meet it in, the portrait and the two overlapped photographs of our own Copenhagen office on the about page are ours, shot or drawn here and stripped of their metadata before they were committed.
• One borrowed icon. The Mastodon mark in the colophon comes from Font Awesome Free by Fonticons, under CC BY 4.0. Every other mark here was drawn for this site, and this one is the exception deliberately: a brand mark stands for somebody else’s service, so an approximation redrawn to match our own set would be worse than an exact borrowed one. The credit sits on this page rather than in the file, because the build minifies its HTML and strips the comment the icon ships its attribution in.

One script runs on this site: ours, about a kilobyte, on the portfolio page only, where it filters the list as you type. It talks to nobody and remembers nothing. No cookies are set. Nothing is requested from another company’s server — no analytics, no fonts, no embedded video, no consent banner, because there is nothing to consent to. Open your browser’s network panel and count the hosts: there is one.

How the pages are made

• Hugo — the static site generator, written in Go. Templates, taxonomies, every language and the feeds are its work.
• Markdown and Go templates for the hand-written pages and the layouts.
• SQLite — the portfolio is not authored here. It lives in a multilingual CV database and is exported into this site by a Python script, so a fact is written once and appears wherever it belongs.
• Python for that exporter, and for generating the icon set with ImageMagick from a single drawing of the mark.

How it is proved

There is no hosted build service; the quality gate runs on the machine the site is written on, and every diagnostic is an error rather than a warning.

• vnu validates the HTML, Stylelint the CSS.
• axe-core audits every built page against WCAG 2.2 A and AA, in both colour schemes, and it is in the gate — not beside it.
• Puppeteer drives headless Chromium for the checks a validator cannot make: measured contrast, focus order, target size, reading measure, viewport overflow, print pagination, and a pixel-for-pixel visual regression via pixelmatch. It also takes the picture other sites show when a link here is shared, so that card is this page’s own stylesheet and typeface rather than a drawing of them.
• Lighthouse holds the performance budgets; lychee checks that every link still resolves.
• Prettier, markdownlint, ESLint, Ruff, basedpyright, yamllint, ShellCheck and codespell keep the source honest; gitleaks makes sure no secret is ever committed.
• Task runs all of it under one name per job, and pre-commit runs the file-level half again on every commit, so the gate is not something anyone has to remember.

Where it runs

One small machine does all of it: a single-core DigitalOcean server with 512 MB of memory and a 10 GB disk, standing in Toronto, Canada, answering at 165.227.39.206. That address is what DNS already hands to anyone who asks, so printing it here saves you the lookup rather than telling you anything new. What the machine records while it answers is on the privacy page.

• Debian is the operating system.
• Caddy answers every web request and renews the HTTPS certificate itself, from Let’s Encrypt.
• Agate, Gophernicus and Tor answer the other three: this site is also a Gemini capsule at gemini://engineer.company, a Gopher hole at gopher://engineer.company and an onion service at http://engineer2ezpeji52ipphljcflzyhetvy5r6tnqubtq45nzlxxv6rsqd.onion/. All four read the same folder of files, so one deploy updates all four and none of them can drift from the others. The onion is the only front door we could add without opening a port: tor dials out to introduction points, so the machine’s open ports stay exactly as they were. The web site sends an Onion-Location header too, so Tor Browser offers it without being asked. It begins engineer because we spent the CPU hours to make it readable — a convenience, not a proof. The same prefix is available to anyone willing to spend the same hours, so compare the whole address rather than the start of it.
• Ansible describes that server as code, so it can be rebuilt rather than remembered.
• Soft Serve is the git server behind the Git Hub at git.engineer.company. This site’s own source lives there.
• restic takes the backups off the box.
• Cloudflare answers DNS — and only DNS. The site is deliberately not proxied: openness is worth more to us than the protection, and a proxy would put one more company between you and us.
• Mail is Apple iCloud, which is why the address on the contact page reaches a mailbox and not a marketing platform.

Standards it follows

• WCAG 2.2 level AA, guarded rather than claimed.
• schema.org structured data, marking only what is true and visible on the page.
• Web App Manifest, so the site can be installed as an app.
• RSS, Atom and JSON Feed, all three carrying the full text. Two XML feeds rather than one because some readers take only one of the two and neither is reliably the one.
• RFC 9309 robots.txt, which allows everything, to search crawlers and AI systems alike — the writing here exists to be read, and it names the sitemap both of them follow. There is a readable index of the same pages, for anyone who would rather browse it than parse it.
• RFC 9116 security.txt, plus humans.txt, llms.txt, agents.txt and ai.txt for the machines that come asking — and ads.txt, which authorises nobody, because there are no advertisements here to sell.
• Gemini, RFC 1436 Gopher and Tor onion services: the same pages, served over all three at gemini://engineer.company, gopher://engineer.company and http://engineer2ezpeji52ipphljcflzyhetvy5r6tnqubtq45nzlxxv6rsqd.onion/, out of the same folder of files this page comes from — one deploy updates all four. Gemini and Gopher each want their own client rather than a browser; the onion wants a Tor client, and Tor Browser is the ordinary one. Gopher has no encryption layer at all, so it carries which page you read in the clear; Gemini encrypts that, but the network you read from still sees which address you asked for. Over the onion it sees neither: of the four, that is true only there. The address itself is the service’s public key, so the circuit is authenticated and encrypted before a word of HTTP is spoken — the http:// is correct rather than careless, and a certificate would only prove a name the address already proves by arithmetic.

Check it yourself

Everything above is a claim, and the section before it names the tools we run against our own machine — which is us marking our own homework. These are the same questions asked by people who have never heard of us. Every link runs a live test against this page, or the address bar of the one you are on; none of them takes our word for anything, and none of them is ours.

• The W3C Markup Validator parses this page’s HTML against the living standard. It is the same engine as the vnu above, run by the W3C rather than by us.
• The W3C CSS Validator reads the stylesheet this page is wearing. Expect it to report errors, and read them before believing them: as of August 2026 it validates against a profile that stops short of system-ui, @property, clamp() in a font-size and scroll-driven animations — all four shipped in browsers, and all four used here. Every one of its complaints is about a feature newer than the validator, which is why Stylelint is the authority we actually hold the stylesheet to.
• The W3C Feed Validator checks the Atom feed, and the same service checks the RSS one. It warns that most entries share a modification date, and that warning is correct: the dates come from git history, and most of these pages genuinely were written in the same few commits. We would rather show a warning than invent a date.
• The JSON Feed Validator checks the third feed, which the W3C service does not cover — it predates the format.
• PWABuilder reads the manifest and the rest of what makes the site installable, from Microsoft’s machines rather than ours.
• The W3C Internationalization Checker reads the language and encoding declarations that make the Danish and English versions of this site legible to the right reader.
• The Schema Markup Validator reads the structured data, and Google’s Rich Results Test says what a search engine does with it.
• PageSpeed Insights runs Lighthouse from Google’s machines rather than ours — performance, accessibility, best practices and SEO, with real-world data where enough people have visited.
• The Mozilla HTTP Observatory grades the security headers, and Qualys SSL Labs grades the HTTPS configuration behind them.
• Security Headers is a second opinion on the first of those, from someone else entirely.

What none of them can check is the accessibility claim, and we would rather say so than let a green badge imply otherwise. No automated tool finds more than about a third of WCAG failures — the rest are judgements about whether a heading describes its section or an alt text says the useful thing, and a machine cannot make them. The audits above are the floor, not the proof. If you use a screen reader here and something reads wrongly, tell us — that is the report we cannot generate.

Thank you

Every project above is maintained by people who did not have to share any of it. If you build on this stack too, that is where your money and your bug reports are worth most.

And if this stack reads like your kind of engineering, put ours to work.