dev: serve at dev.thermograph.org behind basic auth, bound to loopback #111

Merged

admin_emi merged 1 commit from feat/dev-public-guarded into dev

2026-07-26 07:49:45 +00:00

admin_emi commented

2026-07-26 07:49:08 +00:00

Owner

Dev was mesh-only — bound to 10.10.0.2, no DNS record, no Caddy site. A public record now exists for it, so it gets a real front door instead of a name that resolves to a timeout.

Three things keep that acceptable on a box that also runs Forgejo and its CI runner, and they only work together:

the stack binds loopback, so the site block is the only route in — not even the mesh reaches the app directly, which is what makes the guard total rather than decorative;
HTTP basic auth, so a stumbled-upon URL is not a running build;
X-Robots-Tag: noindex, so dev never competes with thermograph.org for the same content in a search index.

Applied and verified live:

no credentials              -> 401
with credentials            -> 200
x-robots-tag                -> noindex, nofollow
http://75.119.132.91:8137   -> 000   (app not directly reachable)
git / dashboard / portfolio -> 200 / 302 / 200  (unaffected)

The credential in Caddyfile.vps1 is a bcrypt hash, not a password; rotate with caddy hash-password.

Also worth noting from the same deploy: no city warm and no IndexNow ping ran, confirming #109's gate on the compose path.

Dev was mesh-only — bound to `10.10.0.2`, no DNS record, no Caddy site. A public record now exists for it, so it gets a real front door instead of a name that resolves to a timeout. Three things keep that acceptable on a box that also runs Forgejo and its CI runner, and they only work together: - the stack binds **loopback**, so the site block is the only route in — not even the mesh reaches the app directly, which is what makes the guard total rather than decorative; - **HTTP basic auth**, so a stumbled-upon URL is not a running build; - **`X-Robots-Tag: noindex`**, so dev never competes with thermograph.org for the same content in a search index. Applied and verified live: ``` no credentials -> 401 with credentials -> 200 x-robots-tag -> noindex, nofollow http://75.119.132.91:8137 -> 000 (app not directly reachable) git / dashboard / portfolio -> 200 / 302 / 200 (unaffected) ``` The credential in `Caddyfile.vps1` is a bcrypt hash, not a password; rotate with `caddy hash-password`. Also worth noting from the same deploy: no city warm and no IndexNow ping ran, confirming #109's gate on the compose path.

admin_emi added 1 commit 2026-07-26 07:49:09 +00:00

dev: serve at dev.thermograph.org behind basic auth, bound to loopback

PR build (required check) / changes (pull_request) Successful in 7s

Details

secrets-guard / encrypted (pull_request) Successful in 5s

Details

PR build (required check) / build-backend (pull_request) Has been skipped

Details

shell-lint / shellcheck (pull_request) Successful in 6s

Details

PR build (required check) / build-frontend (pull_request) Has been skipped

Details

PR build (required check) / validate-observability (pull_request) Has been skipped

Details

PR build (required check) / gate (pull_request) Successful in 2s

Details

fed307e75c

Dev was mesh-only: bound to 10.10.0.2, no DNS record, no Caddy site. A public
record now exists for it, so it gets a real front door instead of a name that
resolves to a timeout.

Three things keep that acceptable on a box that also runs Forgejo and its CI
runner, and all three are load-bearing together:

  - the stack binds LOOPBACK, so the site block is the only route in — not even
    the mesh reaches the app directly, which is what makes the guard total
    rather than decorative,
  - HTTP basic auth, so a stumbled-upon URL is not a running build,
  - X-Robots-Tag: noindex, so dev never competes with thermograph.org for the
    same content in a search index.

The credential in Caddyfile.vps1 is a bcrypt hash, not a password.