From 5f8c44925d78caebfb1df732e63fbce693940460 Mon Sep 17 00:00:00 2001 From: salmonik Date: Sun, 8 Nov 2026 12:29:05 +0100 Subject: docs: note robots.txt in the web layout and checks --- docs/TESTING.md | 3 ++- web/README.md | 4 +++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/docs/TESTING.md b/docs/TESTING.md index 0275607..0e91524 100644 --- a/docs/TESTING.md +++ b/docs/TESTING.md @@ -298,7 +298,8 @@ terminal client; a saved login from one signs in the other. 0. `./scripts/dev-web.sh` prints a local URL. Use it for the checks below; it starts a throwaway game server, gateway and static app without nginx. -1. Open `/play/` in a fresh browser. The auth card must appear; the top bar +1. Open `/play/` in a fresh browser. `curl -s https://zagan.2137697.xyz/robots.txt` + must contain `Disallow: /` for `*` and `Infrawatch`. The auth card must appear; the top bar must not claim a balance until login. 2. Register, then log in with the password. The lobby must show 1 000 Kr and every game. Refresh the page; the session cookie must reattach and the diff --git a/web/README.md b/web/README.md index 3e81468..fecb710 100644 --- a/web/README.md +++ b/web/README.md @@ -13,6 +13,7 @@ web/ releases.php shared scanner and hash cache install.sh stable Linux installer install.ps1 stable Windows installer + robots.txt disallows every crawler play/ browser app, served at /play/ bin/gui/ apps, served at /bin/gui/... bin/client/ terminal clients @@ -151,7 +152,8 @@ Then open . ``` `deploy.sh` rsyncs `web/` with `--delay-updates`, so a visitor never sees a -half-written binary, then fetches the live page and every artifact it lists — +half-written binary, then checks `robots.txt`, fetches the live page and every +artifact it lists — GUI apps, installers, terminal clients and servers — and compares the downloaded bytes with the local SHA-256. It also fetches `/play/`, `app.js` and `style.css`. `--verify-only` skips the upload and only checks the live site. -- cgit v1.2.3