Dev was mesh-only: bound to 10.10.0.2, no DNS record, no Caddy site. A public
record now exists for it, so it gets a real front door instead of a name that
resolves to a timeout.
Three things keep that acceptable on a box that also runs Forgejo and its CI
runner, and all three are load-bearing together:
- the stack binds LOOPBACK, so the site block is the only route in — not even
the mesh reaches the app directly, which is what makes the guard total
rather than decorative,
- HTTP basic auth, so a stumbled-upon URL is not a running build,
- X-Robots-Tag: noindex, so dev never competes with thermograph.org for the
same content in a search index.
The credential in Caddyfile.vps1 is a bcrypt hash, not a password.
