web: disallow crawlers and quiet the game port

Adds robots.txt with Disallow: / plus noindex/X-Robots-Tag on the site and app. The v5 server treats an HTTP request as a malformed frame, closes silently before HELLO, and suppresses the common TLS scanner noise. Deploy now verifies robots.txt.

1 files changed, 18 insertions, 2 deletions

diff --git a/src/bin/server/main.rs b/src/bin/server/main.rs
index f42574d..4f188a3 100644
--- a/src/bin/server/main.rs
+++ b/src/bin/server/main.rs
@@ -73,8 +73,24 @@ fn main() {
             Ok(tls_stream) => {
                 handler::handle_client_tls(tls_stream);
             }
-            Err(e) => {
-                eprintln!("TLS handshake failed: {}", e);
+            Err(error) => {
+                // Public ports get a constant stream of scanners and resets.
+                // Keep the useful failures, drop the background noise.
+                let message = error.to_string().to_ascii_lowercase();
+                let noise = [
+                    "unexpected eof",
+                    "connection reset",
+                    "broken pipe",
+                    "handshake failure",
+                    "received fatal alert",
+                    "bad record mac",
+                    "timed out",
+                ]
+                .iter()
+                .any(|needle| message.contains(needle));
+                if !noise {
+                    eprintln!("TLS handshake failed: {error}");
+                }
             }
         });
     }