Document developer config, modify landing page

app.config.ts

@@ -2,6 +2,7 @@ export default defineAppConfig({
   docus: {
     title: "BountyHub Docs",
     description: "Documentation for bounty hub",
+    image: "https://docs.bountyhub.org/preview.png",
     socials: {
       github: "bountyhub-org/docs",
     },
@@ -22,11 +23,8 @@ export default defineAppConfig({
       fluid: true,
     },
     header: {
-      logo: false,
-      title: "BountyHub Docs",
-      showLinkIcon: true,
-      exclude: [],
-      fluid: true,
+      logo: true,
+      navigation: true
     },
   },
 });

components/Logo.vue

@@ -0,0 +1,8 @@
+<template>
+  <div class="flex">
+    <img height="50" width="50" src="/logo.png">
+    <h3 class="text-2xl py-4 ml-2">
+      <span class="">BountyHub </span><span class="text-indigo-500">Docs</span>
+    </h3>
+  </div>
+</template>

content/0.index.md

@@ -19,11 +19,21 @@ secondary:
 ---
 
 #title
-BountyHub Docs
+BountyHub [Docs]{.text-indigo-500 .text-stroke-thin}
 
 #description
 Find out about different parts of the platform
 
+#extra
+::list
+- Automated workflows
+- Workflow templates
+- Self-hosted runners
+- Callback servers
+- Payload management
+- Developer tools and CLI
+::
+
 ::
 
 ::card-grid
@@ -48,26 +58,32 @@ What's included
   Learn more about the agent running your workflows
   ::
 
+  ::card{icon=heroicons-outline:code}
+  #title
+  [Developer](/developer/about)
+  #description
+  Build your own stuff on top of BountyHub!
+  ::
+
   ::card{icon=heroicons-outline:server-stack}
   #title
   [Callback Servers](/callback-servers/about)
   #description
   Have listener registered for blind attacks
   ::
 
-  ::card{icon=heroicons-outline:code}
+  ::card{icon=heroicons:bug-ant}
   #title
-  [Developer (soon)](/developer/about)
+  [Payloads](/payloads/about)
   #description
-  Build your own stuff on top of BountyHub!
+  Store and quickly retrieve payloads you commonly use
   ::
 
   ::card{icon=heroicons-outline:bell}
   #title
   [Notifications](/notifications/about)
   #description
   Supported notifications and triggers installed so you are notified
-  about all changes to your runs
+  about all changes to your runs.
   ::
-
 ::

content/2.runners/1.about.md

@@ -47,7 +47,9 @@ On your own machine, the runner registration information is stored in the `.runn
 
 ### Running the runner
 
-The runner should be long-running process. You can run it in the foreground, or in the background.
+The runner should be long-running process. When it runs, it keeps the session alive, continuously asking for jobs.
+
+The pre-condition for runner to ask for the job is that the runner is configured.
 
 #### Running the runner in the foreground
 

content/2.runners/3.runner-setup.md

@@ -0,0 +1,52 @@
+# Runner setup
+
+This section describes the best practices how to configure and run the runner from the system that doesn't have the runner installed. It is worth re-iterating that the runner is only available for Linux.
+
+## Setup example
+
+This setup assumes that you have a Linux machine, and you have terminal access to it. It can be your local machine, or it can be a VPS.
+
+### Step 1: Downloading assets
+To install the runner, we need to download the binary. The instructions how to download the runner are available in the [New runner](https://bountyhub.org/runners/new) page.
+
+You can see the dropdown containing runner versions. Please always pick the latest version. The platform is heavily under development, and the new features will be available on the newest runner only.
+
+If you are running on the VPS, you have the example bash script to download the runner assets using `wget` command, and to `unzip` it.
+
+If you want to run the runner on your local machine where you have GUI, you can click the download button instead.
+
+Once your runner assets are downloaded and extracted, you can proceed to the next step.
+
+### Step 2: Configuring the runner
+
+Copy the command from the UI. The token provided by the page is a single-use token valid for 15 minutes. That means that you cannot re-use the same token to configure your runners multiple times.
+
+Once the command is executed, the runner will prompt you for the name. Please assign the unique name to the runner.
+
+If you don't want to have a prompt, you can provide the name using the `--name` flag.
+
+If configuration is successful, you can see that in your current working directory, there is a new file named `.runner`. Please do not share this file with anyone. The file contains configuration information for the runner to use when restarted. If you remove this file, the runner will not be able to connect to the bountyhub back-end, and you will have to re-configure it.
+
+### Step 3: Run the runner
+
+In order to start the runner, you can run it as a service (in the background), or you can run it as long as your terminal session is open (foreground). Regardless of the method, you may want to step back at this moment and set up your machine.
+
+::alert{type="warning"}
+The runner does not come with pre-installed tools. You are in complete control over your machine, and you should make tools available to the runner in order to run it properly.
+::
+
+For this particular example, I installed required tools that I use in my workflows on the server. I also install the [bh CLI](https://github.com/bountyhub-org/bh), which I use to fetch results of my previous scans.
+
+Now that all the tools exist on `PATH`, I open the settings page and create a new PAT. The token has `job_results:read` permission. Please copy that token and open/create the new `.env` file in the directory where the runner is. You can run the following command as an example:
+
+```bash
+echo "BOUNTYHUB_TOKEN=[YOUR_TOKEN]" > .env
+```
+
+Before finally running the runner, double check that you have `bh` installed and present on path by running `which bh`.
+
+If everything is ready, then you can either:
+
+1. Simply run in the foreground by running `./runner run`.
+2. Install the runner as a service and start it: `sudo ./runner service install && sudo ./runner service start`.
+

content/5.developer/1.about.md

@@ -5,5 +5,32 @@ description: 'Build your own application using developer token'
 
 # Developer
 
-Developer is the part of the application that will generate token that you will be able to use to talk
-to the BountyHub API server. It is not currently implemented, because of the scoping rules that should be applied.
+Developer section describes authentication and authorization mechanisms used on the platform to perform automated tasks.
+
+## Authorization and Authentication
+
+In order to talk to the BountyHub back-end, you have to be authenticated. I know that you are all hackers, but let's go through these concepts just in case :).
+
+Authentication is basically allowing the back-end to know who is issuing the requests.
+
+Authorization is a mechanism that allows/rejects requests. You can be authenticated, but not authorized to perform specific action. For example, if your personal access token does not have permission to fetch the job result, even though we know your app is making the request, we will not allow it to go through.
+
+This works both ways, you can be authorized and not authenticated to perform the specific action. Let's say you are creating an account. The back-end has no idea who you are, but you are granted the permission to create this record.
+
+Having said that, BountyHub currently provides 2 ways to authorize and authenticate:
+
+1. Cookies: Meant to be used by the browser when you are using the [bountyhub.org](https://bountyhub.org) website. Although you can automate stuff using cookies, it is not recommended and supported way of using the API.
+2. Personal Access Tokens (PATs): Unique random token associated to you, that has assigned permissions to call specific APIs. This is the recommended way of talking to the API.
+
+Since PATs are the way you will (hopefully) be using to talk to the API, let's describe what is it and how it works.
+
+## Personal Access Tokens
+
+Personal Access Tokens are meant to be the authentication and authorization mechanism used by your apps to talk to the BountyHub API. Each token gets an assigned scope, and on each API call issued with this token is checked against the assigned permissions.
+
+PATs have the reserved prefix. The prefix is in form `bh[VERSION]_[RANDOM_ELEMENT]`.
+The version specifies the token version. This ensures that future changes to the PAT are handled differently, while preserving the old behavior until it is finally deprecated and removed.
+
+The random element is the unique random identifier.
+
+Personal access tokens can be used by your custom scripts, or by officially provided tools, such as [bh CLI](https://github.com/bountyhub-org/bh).

nuxt.config.ts

@@ -2,7 +2,7 @@ export default defineNuxtConfig({
   // https://github.com/nuxt-themes/docus
   extends: "@nuxt-themes/docus",
   devtools: { enabled: true },
-  modules: [],
+  modules: ["@nuxtjs/tailwindcss"],
   app: {
     head: {
       meta: [
@@ -39,6 +39,6 @@ export default defineNuxtConfig({
           content: "website",
         },
       ],
-    }
-  }
+    },
+  },
 });