diff --git a/public/banners/authentik-css-greater-than-bug.png b/public/banners/authentik-css-greater-than-bug.png
new file mode 100644
index 0000000..891abea
Binary files /dev/null and b/public/banners/authentik-css-greater-than-bug.png differ
diff --git a/public/og/authentik-css-greater-than-bug.png b/public/og/authentik-css-greater-than-bug.png
new file mode 100644
index 0000000..b4f355e
Binary files /dev/null and b/public/og/authentik-css-greater-than-bug.png differ
diff --git a/scripts/banner-gen/generate.mjs b/scripts/banner-gen/generate.mjs
index b4e60fa..1ca03f0 100644
--- a/scripts/banner-gen/generate.mjs
+++ b/scripts/banner-gen/generate.mjs
@@ -1220,6 +1220,74 @@ BANNERS['five-step-ai-roadmap-what-i-actually-run'] = {
],
};
+BANNERS['calibrating-intel-quick-sync-hevc-quality'] = {
+ titlebar: "unraid - qsv calibration",
+ lines: [
+ { t: 'prompt', text: "$" }, { t: 'cmd', text: "library_run.py --tier qsv --force-tier qsv" },
+ { t: 'dim', text: "host UHD 770 idle - the Win11 VM only has the 3060" }, { t: 'dim', text: "sources read-only over SMB - sha256 unchanged" },
+ { t: 'err', text: "ICQ 18/20/22 FAIL size: 176.8% / 141.8% / 107.6%" }, { t: 'prompt', text: "$" },
+ { t: 'cmd', text: "ICQ 26 -preset medium" }, { t: 'ok', text: "61.0% of source video - mean SSIM 0.9960 - 5.6x realtime" },
+ { t: 'hl', text: "cliff between 28 and 30 - fast == medium, byte for byte" }, { t: 'dim', text: "shipped: qsv_quality = 26, qsv_preset = medium" },
+ ],
+ flow: [
+ { n: '1', label: "prove the iGPU" },
+ { n: '2', label: "rank on excerpts" },
+ { n: '3', label: "confirm full files" },
+ { n: '4', label: "ship 26 / medium" },
+ ],
+};
+
+BANNERS['docker-reported-exit-0-the-oom-killer-disagreed'] = {
+ titlebar: "root@nas - the oom killer",
+ lines: [
+ { t: 'prompt', text: "$" }, { t: 'cmd', text: "docker logs traefik-hide-v2ray" },
+ { t: 'dim', text: "notification: container stopped unexpectedly" }, { t: 'err', text: "docker inspect: ExitCode 0, OOMKilled=false" },
+ { t: 'prompt', text: "$" }, { t: 'cmd', text: "dmesg | grep -i oom-killer" },
+ { t: 'ok', text: "Memory cgroup out of memory: Kill process 615 (traefik)" }, { t: 'hl', text: "25,976 IPs / 50k lines - 33,636x403 - 16,082x429" },
+ { t: 'dim', text: "512M -> 2g + memswap_limit 2g (swap off on purpose)" }, { t: 'dim', text: "peak 18 min later: 210 MB - a stopgap, not a fix" },
+ ],
+ flow: [
+ { n: '1', label: "read Docker state" },
+ { n: '2', label: "read dmesg" },
+ { n: '3', label: "count the flood" },
+ { n: '4', label: "raise the cap" },
+ ],
+};
+
+BANNERS['the-dialog-opened-in-7-seconds-my-script-waited-5'] = {
+ titlebar: "root@win11 - the dialog was open",
+ lines: [
+ { t: 'prompt', text: "$" }, { t: 'cmd', text: "cron linkedin-daily-post" },
+ { t: 'dim', text: "dialog +1.8s - buttons +2.8s - editor +7.2s" }, { t: 'err', text: "script slept 5s, looked once: 'dialog did not open'" },
+ { t: 'prompt', text: "$" }, { t: 'cmd', text: "poll(node=editor, timeout=40s)" },
+ { t: 'ok', text: "submitted - the composer closing is the proof" }, { t: 'hl', text: "click ignored 75s, identical click accepted in 2s" },
+ { t: 'dim', text: "13 tests pin the staged mount + the swallowed click" }, { t: 'dim', text: "72h approval TTL vs a 12-day queue: silent ticks" },
+ ],
+ flow: [
+ { n: '1', label: "click start a post" },
+ { n: '2', label: "poll for the editor" },
+ { n: '3', label: "submit once" },
+ { n: '4', label: "confirm it closed" },
+ ],
+};
+
+BANNERS['authentik-css-greater-than-bug'] = {
+ titlebar: "auth.hoelee.com - brand css",
+ lines: [
+ { t: 'prompt', text: "$" }, { t: 'cmd', text: "authentik - System - Brands - Custom CSS" },
+ { t: 'dim', text: "rule accepted, stored, injected, served, parsed" }, { t: 'err', text: "ul.pf-c-list > li:last-child - no effect" },
+ { t: 'prompt', text: "$" }, { t: 'cmd', text: "document.styleSheets brand-css cssRules" },
+ { t: 'ok', text: "ul.pf-c-list u003e li - the > became literal text" }, { t: 'hl', text: "invalid selector in a list = the whole rule is discarded" },
+ { t: 'dim', text: "fix: a descendant selector, one character deleted" },
+ ],
+ flow: [
+ { n: '1', label: "rule it out: shadow DOM" },
+ { n: '2', label: "grep the injected css" },
+ { n: '3', label: "blame specificity" },
+ { n: '4', label: "read cssRules" },
+ ],
+};
+
// ---------- read frontmatter ----------
const postPath = join(ROOT, 'src', 'content', 'posts', `${slug}.md`);
let category = 'devops';
diff --git a/scripts/og-gen/generate.mjs b/scripts/og-gen/generate.mjs
index 82c4a83..4316d9b 100644
--- a/scripts/og-gen/generate.mjs
+++ b/scripts/og-gen/generate.mjs
@@ -372,6 +372,26 @@ TERMINALS['five-step-ai-roadmap-what-i-actually-run'] = `
step 5: never done — my failures were bytes, mounts and licences
$3 of 5 running here · 57 s video → text in ~8 s→ transcript ✓
`;
+TERMINALS['calibrating-intel-quick-sync-hevc-quality'] = `
+ $library_run.py --tier qsv --qsv-quality 26 --keep-local
+ ICQ 18/20/22 FAIL size: 176.8% / 141.8% / 107.6%
+ $ICQ 26 -> 61.0% of source, mean SSIM 0.9960-> qsv_quality = 26
`;
+
+TERMINALS['docker-reported-exit-0-the-oom-killer-disagreed'] = `
+ $docker inspect traefik-hide-v2ray | jq .State
+ ExitCode 0 - OOMKilled false - RestartCount 6
+ $dmesg | grep -i 'killed process'-> 6 x cgroup OOM at ~480 MB / 512 MiB
`;
+
+TERMINALS['the-dialog-opened-in-7-seconds-my-script-waited-5'] = `
+ $linkedin-daily-post
+ FAILED: the composer dialog did not open
+ $dialog +1.8s, buttons +2.8s, editor +7.2s-> poll, never sleep
`;
+
+TERMINALS['authentik-css-greater-than-bug'] = `
+ $grep 'data-id="brand-css"' page.html -> rule is there
+ selector matches, computed display: list-item
+ $read the sheet back out of the CSS parser-> u003e, not >
`;
+
// ---------- read frontmatter ----------
const postPath = join(ROOT, 'src', 'content', 'posts', `${slug}.md`);
if (!existsSync(postPath)) {
diff --git a/src/content/posts/authentik-css-greater-than-bug.md b/src/content/posts/authentik-css-greater-than-bug.md
index f700094..f95515e 100644
--- a/src/content/posts/authentik-css-greater-than-bug.md
+++ b/src/content/posts/authentik-css-greater-than-bug.md
@@ -2,11 +2,12 @@
title: "The Character That Silently Broke My authentik CSS"
description: "My authentik custom CSS looked correct, matched the right elements, and did nothing. The cause was a single > character that authentik escapes into invalid text."
pubDate: 2026-09-20
+updatedDate: 2026-10-16
category: devops
tags: ["authentik", "css", "self-hosting", "debugging", "browser"]
ogImage: /og/authentik-css-greater-than-bug.png
banner: /banners/authentik-css-greater-than-bug.png
-draft: true
+draft: false
---
I spent an afternoon on a CSS rule that should have taken thirty seconds.
@@ -261,7 +262,7 @@ nothing — check for a `>` first.
If you need self-hosted SSO, a hardened login page, or someone to debug
the infrastructure you already run, that's the work I do.
-- **WhatsApp:** [011-797 2969](https://wa.me/60127972969) — tap to chat
+- **WhatsApp:** [+60 12-797 2969](https://wa.me/60127972969) — tap to chat
- **Email:** [me@hoelee.com](mailto:me@hoelee.com?subject=Self-hosted%20SSO%20enquiry)
- **Website:** [hoelee.com](https://www.hoelee.com)
diff --git a/src/content/posts/zh/authentik-css-greater-than-bug.md b/src/content/posts/zh/authentik-css-greater-than-bug.md
index 5c031d0..ed7cf93 100644
--- a/src/content/posts/zh/authentik-css-greater-than-bug.md
+++ b/src/content/posts/zh/authentik-css-greater-than-bug.md
@@ -2,11 +2,12 @@
title: "一个字符让我的 authentik CSS 静默失效"
description: "我的 authentik 自定义 CSS 看起来完全正确，也匹配到了目标元素，却毫无效果。原因是一个 > 字符被 authentik 转义成了无效文本。"
pubDate: 2026-09-20
+updatedDate: 2026-10-16
category: devops
tags: ["authentik", "css", "self-hosting", "debugging", "browser"]
ogImage: /og/authentik-css-greater-than-bug.png
banner: /banners/authentik-css-greater-than-bug.png
-draft: true
+draft: false
---
我花了一个下午去查一条本该三十秒解决的 CSS 规则。
@@ -245,7 +246,7 @@ visible: false
如果你需要自托管 SSO、加固过的登录页，或者需要有人来排查你现有的
基础设施，这正是我在做的工作。
-- **WhatsApp：** [011-797 2969](https://wa.me/60127972969) —— 点击对话
+- **WhatsApp：** [+60 12-797 2969](https://wa.me/60127972969) —— 点击对话
- **Email：** [me@hoelee.com](mailto:me@hoelee.com?subject=Self-hosted%20SSO%20enquiry)
- **网站：** [hoelee.com](https://www.hoelee.com)