Link the project page from the readme

The page on asger.weirsøe.dk tells the story behind ahfail and links back here. Claude-Session: https://claude.ai/code/session_012LCTmU2ewo8tnM1dByYAoG
Point the AUR upstream URL at the project page
2026-10-18 20:12:00 +02:00 · 2026-10-04 07:29:48 +02:00 · 2026-10-01 17:42:00 +02:00 · 2026-10-01 17:15:00 +02:00
4 changed files with 10 additions and 6 deletions
@@ -116,7 +116,7 @@ jobs:
          printf '%s\n' "$TARBALLZ_SSH_KEY" > ~/.ssh/tarballz
          chmod 600 ~/.ssh/tarballz
          ssh -i ~/.ssh/tarballz -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
-            root@192.168.10.148 < aur-pkg/PKGBUILD
+            "${{ secrets.TARBALLZ_TARGET }}" < aur-pkg/PKGBUILD

  # ahfail-bin: the same release, prebuilt. The binary is built from the TAG
  # (also when this runs by hand from master), staged as a `meson install` tree,
@@ -186,7 +186,7 @@ jobs:
          # Forced command on the web host: this key may only write ahfail-*.tar.*
          # and ahfail-bin.PKGBUILD, and keeps the newest three tarballs.
          ssh -i ~/.ssh/tarballz-bin -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
-            root@192.168.10.148 "tarball ${{ steps.tarball.outputs.name }}" < "${{ steps.tarball.outputs.name }}"
+            "${{ secrets.TARBALLZ_TARGET }}" "tarball ${{ steps.tarball.outputs.name }}" < "${{ steps.tarball.outputs.name }}"

      - name: Verify the public URL serves the same bytes
        run: |
@@ -244,4 +244,4 @@ jobs:
        continue-on-error: true
        run: |
          ssh -i ~/.ssh/tarballz-bin -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
-            root@192.168.10.148 < aur-bin-pkg/PKGBUILD
+            "${{ secrets.TARBALLZ_TARGET }}" < aur-bin-pkg/PKGBUILD
@@ -33,7 +33,7 @@ pkgver=0.0.0
 pkgrel=1
 pkgdesc="Screen locker that says 'ah ah ah, you didn't say the magic word' on a wrong password (prebuilt binary)"
 arch=('x86_64')
-url="https://gitea.weircon.dk/agw/gtk-ahfail"
+url="https://asger.weirsøe.dk/en/projects/ahfail"
 license=('AGPL-3.0-only')
 # gst-plugins-bad-libs: libgstplayer. gst-plugins-base/-good are runtime plugins
 # (audio conversion, the mpg123 mp3 decoder) that namcap cannot see being used.
@@ -1,4 +1,5 @@
 # Maintainer: Asger Geel Weirsoe <asger at weircon dot dk>
+#   build recipe:  https://gitea.weircon.dk/agw/gtk-ahfail
 #
 # DISCLAIMER
 #
@@ -23,7 +24,8 @@ pkgver=0.0.0
 pkgrel=1
 pkgdesc="Screen locker that says 'ah ah ah, you didn't say the magic word' on a wrong password"
 arch=('x86_64')
-url="https://gitea.weircon.dk/agw/gtk-ahfail"
+url="https://asger.weirsøe.dk/en/projects/ahfail"
+_repo="https://gitea.weircon.dk/agw/gtk-ahfail"
 license=('AGPL-3.0-only')
 # gst-plugins-bad-libs: libgstplayer. gst-plugins-base/-good are runtime plugins
 # (audio conversion, the mpg123 mp3 decoder) that namcap cannot see being used.
@@ -38,7 +40,7 @@ optdepends=('pipewire-pulse: raise the volume to 100% on a failed attempt (or li
 backup=('etc/pam.d/ahfail')
 install=ahfail.install
 options=('!lto')
-source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz")
+source=("$pkgname-$pkgver.tar.gz::$_repo/archive/v$pkgver.tar.gz")
 sha256sums=('SKIP')

 prepare() {
@@ -10,6 +10,8 @@ ahfail doctor   # check this machine and explain what is missing

 One command on Linux: `ahfail` works out whether you run Wayland or X11 and does the right thing. On macOS the effect comes from a PAM hook on the system lock screen (see below).

+Project page, with the story behind it: [asger.weirsøe.dk/en/projects/ahfail](https://asger.xn--weirse-fya.dk/en/projects/ahfail)
+
 ---

 > **Security disclaimer**
Author	SHA1	Message	Date
Asger Geel Weirsøe	fc73c3c808	Link the project page from the readme The page on asger.weirsøe.dk tells the story behind ahfail and links back here. Claude-Session: https://claude.ai/code/session_012LCTmU2ewo8tnM1dByYAoG	2026-10-18 20:12:00 +02:00
Asger Geel Weirsøe	57f59845b8	Point the AUR upstream URL at the project page url= now goes to the project's page on asger.weirsøe.dk, which links back to the source here. The source tarball no longer derives from $url: it comes from a separate _repo variable, so the build still downloads from Gitea. Claude-Session: https://claude.ai/code/session_012LCTmU2ewo8tnM1dByYAoG	2026-10-04 07:29:48 +02:00
Asger Geel Weirsøe	e6dfd7814c	Read the tarball host from a secret, not a variable Run logs of a public repository are public, and Gitea prints variables in them in clear text; only secrets are masked. Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9	2026-10-01 17:42:00 +02:00
Asger Geel Weirsøe	630cb54332	Take the tarball host address from a repository variable The upload steps named the web host by its internal address. It now comes from the TARBALLZ_TARGET repository variable, so the public workflow carries no infrastructure details. Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9	2026-10-01 17:15:00 +02:00