web: disallow crawlers and quiet the game port

Adds robots.txt with Disallow: / plus noindex/X-Robots-Tag on the site and app. The v5 server treats an HTTP request as a malformed frame, closes silently before HELLO, and suppresses the common TLS scanner noise. Deploy now verifies robots.txt.

2 files changed, 37 insertions, 4 deletions

diff --git a/src/bin/server/handler.rs b/src/bin/server/handler.rs
index e6b623f..55df244 100644
--- a/src/bin/server/handler.rs
+++ b/src/bin/server/handler.rs
@@ -32,13 +32,19 @@ pub fn handle_client_tls(mut stream: TlsStream) {
 
     let mut state = ConnectionState::default();
     let mut event_seq = 0u64;
-    println!("[TLS Client connected] {client_addr}");
+    // Port scanners reach the TLS listener too. Do not write a connection log
+    // until they send a valid frame; v5 drops their HTTP request silently.
+    let mut announced = false;
 
     'connection: loop {
         let mut frame = String::new();
         match stream.read_frame(&mut frame) {
             Ok(0) => break,
             Ok(_) => {
+                if !announced {
+                    println!("[TLS Client connected] {client_addr}");
+                    announced = true;
+                }
                 let user = state.user().unwrap_or("guest").to_string();
                 println!("[{user} @ {client_addr}] Received: {frame}");
                 match parse_request(&frame) {
@@ -70,6 +76,15 @@ pub fn handle_client_tls(mut stream: TlsStream) {
             {
                 // No request yet: fall through and let timed games advance.
             }
+            Err(error) if error.kind() == std::io::ErrorKind::InvalidData => {
+                // A crawler or port scanner speaking HTTP hits a frame length
+                // far over the cap. Close without a reply or a log line; a
+                // real game client that has already greeted is worth logging.
+                if state.greeted() {
+                    eprintln!("Protocol error from {client_addr}: {error}");
+                }
+                break;
+            }
             Err(error) => {
                 eprintln!("Read error: {error}");
                 break;
@@ -92,5 +107,7 @@ pub fn handle_client_tls(mut stream: TlsStream) {
     }
 
     core.disconnect(&state);
-    println!("[TLS Client disconnected] {client_addr}");
+    if announced || state.greeted() {
+        println!("[TLS Client disconnected] {client_addr}");
+    }
 }
diff --git a/src/bin/server/main.rs b/src/bin/server/main.rs
index f42574d..4f188a3 100644
--- a/src/bin/server/main.rs
+++ b/src/bin/server/main.rs
@@ -73,8 +73,24 @@ fn main() {
             Ok(tls_stream) => {
                 handler::handle_client_tls(tls_stream);
             }
-            Err(e) => {
-                eprintln!("TLS handshake failed: {}", e);
+            Err(error) => {
+                // Public ports get a constant stream of scanners and resets.
+                // Keep the useful failures, drop the background noise.
+                let message = error.to_string().to_ascii_lowercase();
+                let noise = [
+                    "unexpected eof",
+                    "connection reset",
+                    "broken pipe",
+                    "handshake failure",
+                    "received fatal alert",
+                    "bad record mac",
+                    "timed out",
+                ]
+                .iter()
+                .any(|needle| message.contains(needle));
+                if !noise {
+                    eprintln!("TLS handshake failed: {error}");
+                }
             }
         });
     }