Technical Operations FAQ
A comprehensive, detailed compilation of technical parameters, security protocols, and operational workflows deployed at SiteCraft.
SiteCraft operates under a strict key cycle lifecycle plan. Due to recent server-side virtualmin migrations designed to isolate mail server relays, we proactively revoked our pre-existing key block (ID 0x00FF87677B2876B6). The new key is GnuPG v2 compliant, using a 4096-bit RSA algorithm combined with SHA-512 digest signatures.
Clients sending encrypted project logs, telemetry records, or sensitive build parameters must import the updated key from the Sovereign Cryptography subpage before transmitting payloads. Any transit sent via revoked signatures is automatically dropped at our perimeter firewall.
Workstation sovereignty is the practice of maintaining complete logical and physical ownership over computing cycles. Corporate "SaaS" cloud integrations continuously leak telemetry, system performance snapshots, file descriptors, and behavioral patterns back to central analytical hubs.
To mitigate this exposure, SiteCraft builds custom offline systems utilizing fully-encrypted local partitions, Shamir's Secret Sharing backups, and hardware token authorization (such as Yubikeys and HSMs). Your data is processed locally, keeping diagnostic logs off commercial analytical vectors.
Standard DNS resolutions are highly susceptible to spoofing and redirection at intermediate routing hops. By routing requests through an Anycast network topography, domain queries are dynamically resolved at the geographically closest secure node, minimizing latency and transit complexity.
Furthermore, by signing our zone files with DNSSEC (Domain Name System Security Extensions), we cryptographically authenticate the origin of every DNS response. This mathematical validation completely prevents cache poisoning, DNS hijacking, and rogue zone injections.
Our Android app engineering pipeline combines high-performance Kotlin development with strict defensive security. We strip all tracking libraries, analytic beacons, and unnecessary API endpoints from build releases. We compile using custom R8 optimization configurations to obfuscate bytecode, insert root-detection routines, and bind secure parameters to isolated hardware partitions (Android Keystore System).
For high-security operations, we execute deep APK reverse-engineering and diagnostics to confirm the binary's absolute integrity before deployment, protecting users from third-party side-channel interception.
An adversary tarpit is an offensive-defensive mechanism designed to trap and neutralize unauthorized network sweeps. We deploy Endlessh on default connection ports (such as SSH Port 22). When a malicious scanning bot attempts to connect, the tarpit accepts the TCP handshake and keeps the socket open indefinitely by sending slow, endless banners of random characters.
This consumes the attacker's system memory and network bandwidth in an infinite waiting queue, keeping their automated scanners isolated and distracted while our active logs capture their source IP profiles for blocking.