blocking:
- confirm that .onion wildcard will work for both *.HASH.onion and *.us.HASH.onion
- encrypted partition for keys
- second tor service for SSH access
- mine a new 'archive...' onion on the NUC itself
- acquire EV cert

not blocking:
- disable NTP listening ports
- ping alec m with what we are doing
- CORS issue with bookreader? didn't exist before
- battery UPS? if available
- tweak regex to not catch things like "A blog from the team at archive.org"
- some kind of monitoring/alerting