From 54a6e37d094f34ff90fa40a1f169569350849203 Mon Sep 17 00:00:00 2001
From: openhands <openhands@all-hands.dev>
Date: Tue, 1 Sep 2026 09:54:58 +0000
Subject: [PATCH] chore: prepare Vercel deployment

Co-authored-by: openhands <openhands@all-hands.dev>
---
 README.md      | 12 ++++++++++++
 main_test.go   |  2 ++
 nixpacks.toml  |  5 -----
 static/healthz |  1 +
 vercel.json    | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 63 insertions(+), 5 deletions(-)
 delete mode 100644 nixpacks.toml
 create mode 100644 static/healthz
 create mode 100644 vercel.json

diff --git a/README.md b/README.md
index 83a637b..bb80463 100644
--- a/README.md
+++ b/README.md
@@ -25,6 +25,18 @@ PORT=3001 go run . # any port you like
 
 One Go binary, all assets embedded, no runtime dependencies, no database, no analytics, no network calls except serving itself.
 
+## Deploying
+
+The production site deploys the `static` directory directly to Vercel. Import this repository in the Vercel dashboard and keep the detected framework preset as **Other**; `vercel.json` sets the output directory and production security headers. No build command or environment variables are required.
+
+`htp.kastro.is` is served through BunnyCDN. After the first Vercel deployment:
+
+1. Add `htp.kastro.is` to the Vercel project.
+2. Change the BunnyCDN pull-zone origin from Coolify to the Vercel deployment hostname.
+3. Purge the BunnyCDN cache and verify `/`, `/.well-known/security.txt`, and `/healthz` before removing the Coolify service.
+
+The Go server remains available for local development and self-hosting.
+
 ## Stack
 
 - **Server:** Go standard library only (`embed` + `net/http`), ~100 lines.
diff --git a/main_test.go b/main_test.go
index 5bd529a..8e58526 100644
--- a/main_test.go
+++ b/main_test.go
@@ -11,6 +11,8 @@ import (
 func TestEmbeddedAssets(t *testing.T) {
 	required := []string{
 		"static/index.html",
+		"static/healthz",
+		"static/.well-known/security.txt",
 		"static/css/style.css",
 		"static/js/main.js",
 		"static/js/data.js",
diff --git a/nixpacks.toml b/nixpacks.toml
deleted file mode 100644
index ad36078..0000000
--- a/nixpacks.toml
+++ /dev/null
@@ -1,5 +0,0 @@
-[phases.build]
-cmds = ["go build -o hacktheplanet ."]
-
-[start]
-cmd = "./hacktheplanet"
diff --git a/static/healthz b/static/healthz
new file mode 100644
index 0000000..763cf77
--- /dev/null
+++ b/static/healthz
@@ -0,0 +1 @@
+ok — no packets harmed
diff --git a/vercel.json b/vercel.json
new file mode 100644
index 0000000..2470378
--- /dev/null
+++ b/vercel.json
@@ -0,0 +1,48 @@
+{
+  "$schema": "https://openapi.vercel.sh/vercel.json",
+  "outputDirectory": "static",
+  "headers": [
+    {
+      "source": "/healthz",
+      "headers": [
+        {
+          "key": "Content-Type",
+          "value": "text/plain; charset=utf-8"
+        }
+      ]
+    },
+    {
+      "source": "/(.*)",
+      "headers": [
+        {
+          "key": "Strict-Transport-Security",
+          "value": "max-age=31536000"
+        },
+        {
+          "key": "X-Content-Type-Options",
+          "value": "nosniff"
+        },
+        {
+          "key": "X-Frame-Options",
+          "value": "DENY"
+        },
+        {
+          "key": "Referrer-Policy",
+          "value": "strict-origin-when-cross-origin"
+        },
+        {
+          "key": "Permissions-Policy",
+          "value": "camera=(), microphone=(), geolocation=()"
+        },
+        {
+          "key": "Content-Security-Policy",
+          "value": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self'; upgrade-insecure-requests"
+        },
+        {
+          "key": "X-No-Packets-Were-Harmed",
+          "value": "true"
+        }
+      ]
+    }
+  ]
+}