1 files changed, 64 insertions, 0 deletions

diff --git a/web/README.md b/web/README.md
new file mode 100644
index 0000000..3c6ee08
--- /dev/null
+++ b/web/README.md
@@ -0,0 +1,64 @@
+# Download page
+
+`index.php` scans `bin/client` and `bin/server` on every request and renders
+whatever builds it finds, with version, size and SHA-256. No database, no
+JavaScript, no dependencies. PHP 8.0+.
+
+## Layout
+
+```
+web/
+  index.php
+  bin/client/    served at /bin/client/...
+  bin/server/    served at /bin/server/...
+```
+
+Serve `web/` as the document root. Binaries in `bin/` are gitignored.
+
+## Naming
+
+The page only lists files that match the release pattern; anything else in
+those directories is ignored.
+
+```
+zagan-bet-client-<version>-<platform>-<arch>[.exe]
+zagan-bet-server-<version>-<platform>-<arch>
+```
+
+`<version>` is `MAJOR.MINOR.PATCH`, `<platform>` is `linux`, `windows` or
+`macos`, `<arch>` is `x86_64`, `i686` or `aarch64`.
+
+## Publishing a build
+
+From the repository root, with the version taken from `Cargo.toml`:
+
+```sh
+V=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -1)
+
+cargo build --release --target x86_64-unknown-linux-gnu
+cargo build --release --bin client --no-default-features --target i686-unknown-linux-gnu
+cargo build --release --bin client --target x86_64-pc-windows-gnu
+
+cp "target/x86_64-unknown-linux-gnu/release/server"   "web/bin/server/zagan-bet-server-$V-linux-x86_64"
+cp "target/x86_64-unknown-linux-gnu/release/client"   "web/bin/client/zagan-bet-client-$V-linux-x86_64"
+cp "target/i686-unknown-linux-gnu/release/client"     "web/bin/client/zagan-bet-client-$V-linux-i686"
+cp "target/x86_64-pc-windows-gnu/release/client.exe"  "web/bin/client/zagan-bet-client-$V-windows-x86_64.exe"
+```
+
+`--no-default-features` drops the server's OpenSSL dependency, which is what
+the 32-bit client build would otherwise fail on.
+
+## Preview locally
+
+```sh
+php -S 127.0.0.1:8899 -t web
+```
+
+Then open <http://127.0.0.1:8899/>.
+
+## Notes
+
+- Hashes are computed per request with `hash_file()`. That is fine for a
+  handful of builds; add an mtime-keyed cache if the directory grows.
+- The page lists every build it finds, newest version first, so old releases
+  stay downloadable until you remove them from `bin/`.