From 8681fcf565643f67a36cb1fe571fac7843d2b6af Mon Sep 17 00:00:00 2001
From: salmonik <salmonik@tuta.io>
Date: Sun, 8 Nov 2026 12:28:48 +0100
Subject: web: disallow crawlers and quiet the game port

Adds robots.txt with Disallow: / plus noindex/X-Robots-Tag on the site and app. The v5 server treats an HTTP request as a malformed frame, closes silently before HELLO, and suppresses the common TLS scanner noise. Deploy now verifies robots.txt.
---
 src/bin/server/main.rs | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

(limited to 'src/bin/server/main.rs')

diff --git a/src/bin/server/main.rs b/src/bin/server/main.rs
index f42574d..4f188a3 100644
--- a/src/bin/server/main.rs
+++ b/src/bin/server/main.rs
@@ -73,8 +73,24 @@ fn main() {
             Ok(tls_stream) => {
                 handler::handle_client_tls(tls_stream);
             }
-            Err(e) => {
-                eprintln!("TLS handshake failed: {}", e);
+            Err(error) => {
+                // Public ports get a constant stream of scanners and resets.
+                // Keep the useful failures, drop the background noise.
+                let message = error.to_string().to_ascii_lowercase();
+                let noise = [
+                    "unexpected eof",
+                    "connection reset",
+                    "broken pipe",
+                    "handshake failure",
+                    "received fatal alert",
+                    "bad record mac",
+                    "timed out",
+                ]
+                .iter()
+                .any(|needle| message.contains(needle));
+                if !noise {
+                    eprintln!("TLS handshake failed: {error}");
+                }
             }
         });
     }
-- 
cgit v1.2.3