jposluns · Oct 19, 2026 · Oct 19, 2026 · Oct 19, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -12,6 +12,7 @@ service can change a gate's answer, and a pull request number is only knowable f
 
 ## 2026-10-19
 
+- Twenty more guides move to the two-section layout (maintainer request, 2026-10-18), with each guide's own tool named first in its header; the header now says "1 more recorded basis" rather than "bases", and the headers of guides already in the layout are regenerated where that changes them; no guide body or digest changes. Guides: `firebase-supabase.md`, `pocketbase.md`, `ray.md`, `gitops-controllers.md`, `nomad-consul.md`, `self-hosted-ci-runners.md`, `workflow-orchestrators.md`, `kubernetes.md`, `nginx.md`, `apache.md`, `caddy.md`, `traefik.md`, `haproxy.md`, `lighttpd.md`, `free-certificates.md`, `self-signed.md`, `headers.md`, `cors.md`, `docker.md`, `container-hardening.md` (#693)
 - `authentication.md`: the fail2ban rule now cites fail2ban 1.1.1's shipped `sshd`, `nginx-http-auth` and `webmin-auth` filters and jails, which are disabled by default; enabling the relevant jails with matching log paths is labelled as this guide's advice, and coverage of any particular login panel and how easy it is to set up are stated as not established; TODO row 1.293 moves to DONE (#694)
 - `authentication.md`: the Cloudflare Access rule now cites Cloudflare's One-time PIN, identity-provider and generic OIDC pages for the login options, and its existing self-hosted web application scope now reads "published through Access", stating that use with any application unchanged is not established; no command changes; TODO row 1.292 moves to DONE (#692)
 - Twenty more guides move to the two-section layout (maintainer request, 2026-10-18), with each guide's own tool named first in its header and components listed headline tools first; no guide body or digest changes. Guides: `llm-observability.md`, `agent-builders.md`, `ai-infra-services.md`, `vector-databases.md`, `search-engines.md`, `elasticsearch.md`, `minio.md`, `object-storage.md`, `jupyter.md`, `gradio.md`, `streamlit.md`, `code-server.md`, `n8n.md`, `headless-browser-services.md`, `headless-cms-instant-api.md`, `supabase-self-hosted.md`, `observability-components.md`, `self-hosted-error-trackers.md`, `realtime-webhooks.md`, `realtime-voice-infra.md` (#691)

diff --git a/apache.md b/apache.md
diff --git a/caddy.md b/caddy.md
diff --git a/container-hardening.md b/container-hardening.md
diff --git a/cors.md b/cors.md
diff --git a/docker.md b/docker.md
diff --git a/firebase-supabase.md b/firebase-supabase.md
diff --git a/free-certificates.md b/free-certificates.md
diff --git a/gitops-controllers.md b/gitops-controllers.md
diff --git a/haproxy.md b/haproxy.md
diff --git a/headers.md b/headers.md
diff --git a/kubernetes.md b/kubernetes.md
diff --git a/lighttpd.md b/lighttpd.md
diff --git a/nginx.md b/nginx.md
diff --git a/nomad-consul.md b/nomad-consul.md
diff --git a/observability-components.md b/observability-components.md
@@ -1,6 +1,6 @@
 # Self-hosted observability components: node_exporter, Alertmanager, Pushgateway, Jaeger, and Loki
 
-Written against node_exporter v1.12.1, Alertmanager v0.34.1, Pushgateway v1.11.3, Jaeger v2.21.0, Loki v3.7.8, Exporter toolkit v0.17.1, OpenTelemetry configtls v1.66.0, and OpenTelemetry basicauth extension v0.160.0, plus 1 more recorded bases; 3 further sources are pinned to a commit and 1 carries no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 59 claims: 14 demonstrated by a check that ran and 45 reasoned from cited sources.
+Written against node_exporter v1.12.1, Alertmanager v0.34.1, Pushgateway v1.11.3, Jaeger v2.21.0, Loki v3.7.8, Exporter toolkit v0.17.1, OpenTelemetry configtls v1.66.0, and OpenTelemetry basicauth extension v0.160.0, plus 1 more recorded basis; 3 further sources are pinned to a commit and 1 carries no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 59 claims: 14 demonstrated by a check that ran and 45 reasoned from cited sources.
 
 A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
 

diff --git a/plugin/skills/secure-deployment-config/references/MANIFEST.sha256 b/plugin/skills/secure-deployment-config/references/MANIFEST.sha256
@@ -1,7 +1,7 @@
 16d5e01fa7dc8355dd64b44f09923711070b47cd66686feef7e0bfe2adf63f2e  README.md
 0396b6b7ea6cd394bf147ada54efce3154d905ed8b40a36982eb5a1da0a98b2a  controls-reference.md
-4d0b98575e43b08c7e48fc43ff25808c2ef519e8c1463ea11e317199a694f8b4  free-certificates.md
-5b574d7594d46b674e77bb1deceed3137489f0b0650f07475eff57bfa761ab72  self-signed.md
+63dbab66d2ee6a851368cc772aff88eed98760b747b3735c746d3a8a828263e5  free-certificates.md
+4e48558c75fe443cb3023ede38f621c4bfe5d966c6861ab57dd47ce89954a46f  self-signed.md
 86eca64127b4dca3510677732af318246214e54c8bcfd7662cf8d532520564ab  cloudflare.md
 c63b3c46f99d8d1d5c60ef527994618c97a0300629692719ddba0e3eba4403d7  tailscale.md
 57dc02171106069655b1ecf67ce77cd86ba505cd306469f48f544ed83482e845  tunnels.md
@@ -15,20 +15,20 @@ a4bd1d507a1f15812717e44ed1426892aa789a7b3a955128945bd1930618c453  mfa.md
 7eeae8824af359d1f95222759dfb152c38bfb44c5e0e20b79fd3c5c4de1898f8  cloud-identity-proxies.md
 4e117acb25a74b2661a719c99da0ef8714108beaddfb56271716670d4092b1fd  machine-auth.md
 f6cf36352de1b4acbed5850f7bec89dd40358e7f521507930e091f80d17915e8  fronting-auth.md
-8a6515e4952389d459e63c277b280be9210ae0573628b6cd6e5ac5db12845b91  apache.md
-a9a2db65552dc21482fdc9ba4ee9e5e03bdbb628154ac7e6e06a71f9f5ec63b8  nginx.md
-987cf540fc9f27d3d04ef231e74bb75cbae4b046662d49c76bc6944c0a14c80b  lighttpd.md
-27eb98787e1ec79f9595b9623a9119f9f0469287e60927c9d980de958aa257e0  caddy.md
-c476017eb77d93e355aea9b75ebc3cb80a23b416c6a256ae19b379aeb8acf5b5  haproxy.md
-c99c2a44e1e38466e91a646fcfb66ed9ec80d7f57bbfea68c9e0af3b3a917039  traefik.md
+56f8e29ff170027e675d042f22199b544b0bbf779b108926d18a900e222af1b5  apache.md
+c8c900792380e7a1428660f9c3bcee688e760d59f6e1da55d9b6eb9f32619381  nginx.md
+e294462aeb6ce1498c97d8198598f79b3b8d7c0930fad5538e687587cf76887b  lighttpd.md
+2faf447eb185932b48165a9492f8f90ee58ab8dcf21e82fbf3f2ad1e513758af  caddy.md
+123465d2fd41e0e4c7017bd8d71ca4ae11fc4df11110773ffac4080bc447c7ee  haproxy.md
+3ae6e4a8a38c6bd114821364c11b50468595278ffba1ac0715651a4d634325af  traefik.md
 c49d2f39236c17b583cc1455b9665f647940609ecd79670e834d15753d263f3e  nodejs.md
 5fd9b83e3bec71386ffa2da831a70c57e0225aa1ca3d969a0737b8a28aaf5e62  python.md
-674fabf5ccd8e290b06485ca5b46a4102091f70c5905655c4d955f6f637b1768  docker.md
-9812d284347c4ede6beca1405e74cbf4d7bef964684e48a450f434566f92bffd  kubernetes.md
-f77b4c6c8fd3ae12480d7751d5a5e4b30d6f1b6decd080d299bbf82303450309  gitops-controllers.md
-d2a89cacc8ff8bddd36967d11d975dd0360c00dbdb5bf9b31a210b5f9decb974  self-hosted-ci-runners.md
+d03313bfa0afb1e9a960c070516b5f5f1d328d7b41aba215b52619f328395138  docker.md
+1b8445e0dc25fb843829d1b2fdc2c67ee64b1e63b4a89b8518f1a994e722143f  kubernetes.md
+7c35f943796e0cfcba3c327a1c7c6e3dba385de4d90000a64ceaf09da81e5746  gitops-controllers.md
+4d831688e4658d37dd10f2729397f3d225fdac03d8861f20a850a8ffc9962662  self-hosted-ci-runners.md
 b6e114b214938bb50a6bf20beb8ff87eab438a61bb328cc40abda0341d8e507e  frontend-frameworks.md
-b7bad14349ca3f07934272bbe1f88b6f26abbd55a1642419d4fe6b95c5007b78  container-hardening.md
+3cc39b499774d04e366810d1aedd7e9c88dcf2534040d81c021d270bf37c2fb4  container-hardening.md
 b649f885ec96782415e287e83312fbd9444d0e70ab99467f477fcf9d29196671  nextjs.md
 488b3e54ead7775aa87fc872568b05aa2a955535c64d1c117ead58fe06412494  go.md
 d3c5aa76a95c369cc8a3b4c16120d68cf5fa1512d1d88a3c9e3d2ddb27ed52fa  dotnet.md
@@ -74,30 +74,30 @@ cae5895e27a2a0d08773bf3c6f346c25deee35db50f15cfaaceff1c2545eba3e  self-hosted-er
 486162b144bf6326acaf70fbc3cc912d0534a3927d21f95a5a4d61a3ccb97b1c  vector-databases.md
 75560b7ae60244f00675674a45f3aaa1c715da1adb93f37334181d35924af9e4  mcp-servers.md
 86c0dcec778ea45f122f458981177bbe1fe089867183613939570b2fde1fdff5  mcp-clients.md
-b27badebb07b6e99d62e88c3aa748112bb85b8128a57cd3fc593983a3dd7daa6  ray.md
+4ea7c2c7bc490c32fac988a7eca86353dd3b9edeca51bc805c4752e958bbb5e7  ray.md
 0d4ebac99993632db53c1a3c835bf0cc8f113d689c2e1884b317b1427570651c  mlflow.md
 b772a966100db0e2b6f1f7ba78903f1dde4fd6e351b58afb752124e55440681e  agent-builders.md
 f205ad0512c2ad45bee20f9cce6faee7eaadddc16af066c413eee316ec79efa9  ai-infra-services.md
 5448efdd90dc5fdf90429e23ef8b8dbad8cad33a36b2d056ca426a63b4d56096  realtime-voice-infra.md
 6b2981ef25b7920fae2233cb7fa2e8583b79d92af2aff8a715a585a0831dec60  image-gen-uis.md
 eedd2df7ea2844e3500579dddd9a18e57c746b7f49616bc76d9cdad0d20e235e  chat-uis.md
 de45069e092247a3e60962e15ae9e775cfcc6520a983aaf91699332f94816311  llm-observability.md
-fd733af42ee7aa2af3463fbc17f994b3053308d94f4683919d2b213df047e160  workflow-orchestrators.md
+2d5dfb319feea0917c081bcace302d67e561c91bff34565a08c1dde251e3f320  workflow-orchestrators.md
 6e808e21563913691d5e9b7f7b0ef457ad332ea9655a9e0a73bd454e4c27cc62  admin-uis.md
-9a1ba5f778f4b2a3be609c27c1fedda92c1333fa3f00ece23053fa1084ce4750  observability-components.md
+bd72febbec4b4aba89c866898fb3bc6f821985de356f733fdea356637f512cd8  observability-components.md
 8d988fc846fb6a195061ad09ae70c9ebb50654ae8f499364086233554f5163d2  devops-uis.md
-370aa067f9c7099af991a9962b2dca255e6e29d47b35302edc2f12a619b1e5b8  cors.md
-f82a021a1bf4931f6daa1e78446d4707ceca65ecb5f5a05b95475299849949b2  headers.md
-12684236218b4e669a9e21598b9b388fece93d5d09f2dae4860c80d3b3a5306f  firebase-supabase.md
+96807f276db704f93b2cf9f6a74462372e306bc727041a405e64a78e57e85dc8  cors.md
+b342da74961426bb8757064ffadaace7a802f7ea9c90d357840821f2c724918f  headers.md
+7f6a4be63fe75218a7290360d7fa05e4f3eed04e759fd2279b8f9090ef8969d4  firebase-supabase.md
 14a0db1c936d383f538b6c4be91a626020969dbd6bc5c59bafec40cdc6a8aa34  supabase-self-hosted.md
 e4ba632a7d23127a50f3ca43d06026acf696975a7eea07a4afd50709e6c41ebc  web-exposure.md
-25a2b7b0067d31825bf982b73c5ffd63e945ad8fc6d54cc7416d0685080351b1  realtime-webhooks.md
+d47b8df006d058984f8d30c5fd9345fddb9dd5449d14da83047d0d1338d2be7c  realtime-webhooks.md
 1950768370917b08e8933c138b68c762b99dcc43bf3aa7059b23523d8504d61a  transactional-email-posture.md
 c899ee328d6850c78dca030d5bb4253f3e5f037186e14bff89077992d37d11d8  bi-dashboards.md
 b336702b0aab97bc2e77ea0a67d20910f675b6c9f16b722f6e01b5dd0ada1b58  low-code-builders.md
 a8ee9cb4733666d9c13b241a92abe17df75a070295bb46a10eca9da7b17a813e  server-admin-panels.md
-ef2a792bda8518df2bf646532eb162c4aee733aad01907f37fc06d1a800249e3  nomad-consul.md
-ce95a1682bab90a857e1faf8e1223ad401ed128d016de62edea9835a6f4606b8  pocketbase.md
+57e33f986cc7430a583d4fa395fc97b46cc799414b95114a6fc66e7e46c02d26  nomad-consul.md
+e2ed2544c21ba3583b6940b45e5503dbf7c22d0a2f4dab1b77244fdf203e2d6b  pocketbase.md
 31edb9401ef4e8f4374e2036f894e47c69d3888ffebb5bc921db05ae37136c52  headless-browser-services.md
 884133e5681475d42f1a4ae96e0f4052bcad9dbca756091199e39c4e08356e6b  headless-cms-instant-api.md
 6edecfd9dd24bdaab2a9fa54f95201f451d9d3c2379454d818e0cae071a2aed7  exposure-index.md