web: disallow crawlers and quiet the game port

Adds robots.txt with Disallow: / plus noindex/X-Robots-Tag on the site and app. The v5 server treats an HTTP request as a malformed frame, closes silently before HELLO, and suppresses the common TLS scanner noise. Deploy now verifies robots.txt.

1 files changed, 11 insertions, 0 deletions

diff --git a/web/nginx.conf.example b/web/nginx.conf.example
index d440ab5..8dbde64 100644
--- a/web/nginx.conf.example
+++ b/web/nginx.conf.example
@@ -45,6 +45,7 @@ server {
     location /play/ {
         try_files $uri $uri/ /play/index.html;
         add_header Cache-Control "no-cache";
+        add_header X-Robots-Tag "noindex, nofollow, noarchive" always;
         add_header X-Frame-Options "DENY" always;
         add_header X-Content-Type-Options "nosniff" always;
     }
@@ -62,6 +63,14 @@ server {
         proxy_send_timeout 3600s;
     }
 
+    # Ask crawlers and scanners to stay out, and never index a page.
+    location = /robots.txt {
+        default_type text/plain;
+        try_files $uri =404;
+        add_header Cache-Control "public, max-age=3600";
+        add_header X-Robots-Tag "noindex, nofollow, noarchive" always;
+    }
+
     # The page rescans bin/ on every request, so don't cache it.
     location = /index.php {
         include fastcgi_params;
@@ -70,6 +79,7 @@ server {
         fastcgi_pass unix:/run/php/php-fpm.sock;
         fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
         add_header Cache-Control "no-cache";
+        add_header X-Robots-Tag "noindex, nofollow, noarchive" always;
     }
 
     # The newest-version feed read by install.sh and install.ps1.
@@ -78,6 +88,7 @@ server {
         fastcgi_pass unix:/run/php/php-fpm.sock;
         fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
         add_header Cache-Control "no-store";
+        add_header X-Robots-Tag "noindex, nofollow, noarchive" always;
     }
 
     # Stable installers: always revalidate so a fix reaches the next download.