From 8681fcf565643f67a36cb1fe571fac7843d2b6af Mon Sep 17 00:00:00 2001
From: salmonik <salmonik@tuta.io>
Date: Sun, 8 Nov 2026 12:28:48 +0100
Subject: web: disallow crawlers and quiet the game port

Adds robots.txt with Disallow: / plus noindex/X-Robots-Tag on the site and app. The v5 server treats an HTTP request as a malformed frame, closes silently before HELLO, and suppresses the common TLS scanner noise. Deploy now verifies robots.txt.
---
 src/bin/server/handler.rs | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

(limited to 'src/bin/server/handler.rs')

diff --git a/src/bin/server/handler.rs b/src/bin/server/handler.rs
index e6b623f..55df244 100644
--- a/src/bin/server/handler.rs
+++ b/src/bin/server/handler.rs
@@ -32,13 +32,19 @@ pub fn handle_client_tls(mut stream: TlsStream) {
 
     let mut state = ConnectionState::default();
     let mut event_seq = 0u64;
-    println!("[TLS Client connected] {client_addr}");
+    // Port scanners reach the TLS listener too. Do not write a connection log
+    // until they send a valid frame; v5 drops their HTTP request silently.
+    let mut announced = false;
 
     'connection: loop {
         let mut frame = String::new();
         match stream.read_frame(&mut frame) {
             Ok(0) => break,
             Ok(_) => {
+                if !announced {
+                    println!("[TLS Client connected] {client_addr}");
+                    announced = true;
+                }
                 let user = state.user().unwrap_or("guest").to_string();
                 println!("[{user} @ {client_addr}] Received: {frame}");
                 match parse_request(&frame) {
@@ -70,6 +76,15 @@ pub fn handle_client_tls(mut stream: TlsStream) {
             {
                 // No request yet: fall through and let timed games advance.
             }
+            Err(error) if error.kind() == std::io::ErrorKind::InvalidData => {
+                // A crawler or port scanner speaking HTTP hits a frame length
+                // far over the cap. Close without a reply or a log line; a
+                // real game client that has already greeted is worth logging.
+                if state.greeted() {
+                    eprintln!("Protocol error from {client_addr}: {error}");
+                }
+                break;
+            }
             Err(error) => {
                 eprintln!("Read error: {error}");
                 break;
@@ -92,5 +107,7 @@ pub fn handle_client_tls(mut stream: TlsStream) {
     }
 
     core.disconnect(&state);
-    println!("[TLS Client disconnected] {client_addr}");
+    if announced || state.greeted() {
+        println!("[TLS Client disconnected] {client_addr}");
+    }
 }
-- 
cgit v1.2.3