Migrate hosting from Coolify to Vercel

README.md

@@ -25,6 +25,18 @@ PORT=3001 go run . # any port you like
 
 One Go binary, all assets embedded, no runtime dependencies, no database, no analytics, no network calls except serving itself.
 
+## Deploying
+
+The production site deploys the `static` directory directly to Vercel. Import this repository in the Vercel dashboard and keep the detected framework preset as **Other**; `vercel.json` sets the output directory and production security headers. No build command or environment variables are required.
+
+`htp.kastro.is` is served through BunnyCDN. After the first Vercel deployment:
+
+1. Add `htp.kastro.is` to the Vercel project.
+2. Change the BunnyCDN pull-zone origin from Coolify to the Vercel deployment hostname.
+3. Purge the BunnyCDN cache and verify `/`, `/.well-known/security.txt`, and `/healthz` before removing the Coolify service.
+
+The Go server remains available for local development and self-hosting.
+
 ## Stack
 
 - **Server:** Go standard library only (`embed` + `net/http`), ~100 lines.

main_test.go

@@ -11,6 +11,8 @@ import (
 func TestEmbeddedAssets(t *testing.T) {
 	required := []string{
 		"static/index.html",
+		"static/healthz",
+		"static/.well-known/security.txt",
 		"static/css/style.css",
 		"static/js/main.js",
 		"static/js/data.js",

static/healthz

@@ -0,0 +1 @@
+ok — no packets harmed

vercel.json

@@ -0,0 +1,48 @@
+{
+  "$schema": "https://openapi.vercel.sh/vercel.json",
+  "outputDirectory": "static",
+  "headers": [
+    {
+      "source": "/healthz",
+      "headers": [
+        {
+          "key": "Content-Type",
+          "value": "text/plain; charset=utf-8"
+        }
+      ]
+    },
+    {
+      "source": "/(.*)",
+      "headers": [
+        {
+          "key": "Strict-Transport-Security",
+          "value": "max-age=31536000"
+        },
+        {
+          "key": "X-Content-Type-Options",
+          "value": "nosniff"
+        },
+        {
+          "key": "X-Frame-Options",
+          "value": "DENY"
+        },
+        {
+          "key": "Referrer-Policy",
+          "value": "strict-origin-when-cross-origin"
+        },
+        {
+          "key": "Permissions-Policy",
+          "value": "camera=(), microphone=(), geolocation=()"
+        },
+        {
+          "key": "Content-Security-Policy",
+          "value": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self'; upgrade-insecure-requests"
+        },
+        {
+          "key": "X-No-Packets-Were-Harmed",
+          "value": "true"
+        }
+      ]
+    }
+  ]
+}