karti
6cf80747cc
CI / verify (push) Successful in 3m11s
The app is pre-launch and shared by link with a handful of people at Prime
Intellect. It should not be accumulating a search footprint yet.
Three layers, because each covers a gap the others leave:
- robots.txt asks well-behaved crawlers not to fetch at all.
- The <meta name="robots"> tag covers the HTML document for anything that
fetched anyway.
- X-Robots-Tag covers everything that is NOT the HTML document — og.png,
the manifest, the built assets — which the meta tag cannot reach.
noarchive and nosnippet are there so a cache or an excerpt cannot outlive
the page once this is reversed.
Deliberately NOT stripped: the og:/twitter: tags. Link unfurlers are not
crawlers — they fetch on behalf of the person pasting the link, and a
rendered card is exactly what we want when this is shared.
The real gate remains authentication: / returns the sign-in screen and every
/api/ route returns 401. This only stops the app being indexed.
To go public: delete robots.txt, drop the meta tag, drop the header.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
43 lines
1.9 KiB
Caddyfile
43 lines
1.9 KiB
Caddyfile
# Caddy — reverse proxy for PIG.
|
|
#
|
|
# Serve the app and the API from ONE hostname. Auth sessions live in
|
|
# per-origin browser storage, so splitting them across two hostnames makes
|
|
# sign-in loop endlessly in a way that looks like a server fault.
|
|
|
|
primeintellectgrowth.com, www.primeintellectgrowth.com {
|
|
encode zstd gzip
|
|
|
|
# The MCP endpoint, when Streamable HTTP is enabled. Same origin as the
|
|
# app so it shares the session and needs no CORS allowance.
|
|
reverse_proxy 127.0.0.1:8920
|
|
|
|
|
|
# The inline script hash covers the pre-paint theme script in index.html,
|
|
# which sets light/dark before first paint so dark-mode users do not get a
|
|
# white flash. It cannot be an external file without reintroducing that
|
|
# flash, and it cannot use 'unsafe-inline' without defeating the CSP.
|
|
#
|
|
# IMPORTANT: editing that script changes its hash and CSP will silently
|
|
# block it. The browser console says exactly which hash it wants.
|
|
header {
|
|
# Not public yet. The header covers everything served — og.png, the
|
|
# manifest, the built assets — where the <meta> tag in index.html only
|
|
# covers the HTML document. robots.txt asks crawlers not to fetch;
|
|
# this tells the ones that fetch anyway not to index.
|
|
X-Robots-Tag "noindex, nofollow, noarchive, nosnippet"
|
|
Strict-Transport-Security "max-age=31536000; includeSubDomains"
|
|
X-Content-Type-Options "nosniff"
|
|
X-Frame-Options "DENY"
|
|
Referrer-Policy "strict-origin-when-cross-origin"
|
|
# The app is entirely first-party except for the auth provider, which
|
|
# it must reach over XHR.
|
|
Content-Security-Policy "default-src 'self'; connect-src 'self' https://*.supabase.co; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'sha256-1tTDwCq+TCEyPDSZeYqW5HbmP+unUg8hrgRiZBiH/IU='; frame-ancestors 'none'; base-uri 'self'"
|
|
-Server
|
|
}
|
|
}
|
|
|
|
# Short alias. A redirect rather than a second origin, deliberately — see above.
|
|
pig.karti.ai {
|
|
redir https://primeintellectgrowth.com{uri} permanent
|
|
}
|