public-web-deploy

Public Web Deploy Skill

Top Rule

Serve public sites through a real web server. Local preview binds 127.0.0.1; public sites go through nginx, Caddy, Apache, or Cloudflare Pages — fronted by HTTPS and hardened nginx config.

Never use python -m http.server, Vite, Hugo, Next dev, Flask dev, or any raw dev server as an internet-facing public service. Local preview MUST bind 127.0.0.1. Public sites MUST go through nginx / Caddy / Apache / Cloudflare Pages.

Raw dev servers are single-threaded, unauthenticated, serve the whole working directory (dotfiles, .env, .git, source, backups), carry no TLS, no rate limiting, and no request filtering. They are correct for 127.0.0.1 local preview and wrong for any internet-facing service. A companion enforcement hook blocks public binds at the tool layer; this skill is the guidance that pairs with it.

Decide public vs private first. A public site is reached by HTTPS + hardened nginx — that is the security model. Reserve auth (basic-auth, SSO) for private/internal sites, decided explicitly. Adding basic-auth to a public site breaks it for its intended audience and adds no protection to content meant to be public.

Instructions

Phase 1: DNS

Goal: The domain/subdomain resolves to the host before any web server work.

Steps:

1. Confirm the target FQDN (apex example.com, subdomain app.example.com).
2. Create an A/AAAA record pointing at the host's public IP (or CNAME for managed platforms like Cloudflare Pages).
3. Verify resolution propagated:

   dig +short A app.example.com
   dig +short AAAA app.example.com
   getent hosts app.example.com
   

Gate: dig +short returns the intended host IP. Proceed only when DNS resolves correctly — an HTTPS cert request fails if DNS does not yet point at the host.

Phase 2: Web Server Config

Goal: A production web server (not a dev server) serves the site from a defined docroot.

Steps:

1. Pick the server: nginx or Caddy (self-hosted), Apache (existing stacks), or Cloudflare Pages (managed static).
2. Define a server block bound to the FQDN with an explicit docroot:

   server {
       listen 80;
       server_name app.example.com;
       root /var/www/app.example.com;
       index index.html;
       location / { try_files $uri $uri/ =404; }
   }
   

3. If an app backend exists, proxy to it on 127.0.0.1:

   location /api/ { proxy_pass http://127.0.0.1:8000; }
   

   The backend binds 127.0.0.1, never 0.0.0.0 — only nginx faces the internet.
4. Test config and reload:

   nginx -t && systemctl reload nginx