The actual VPS setup has no native nginx - Forgejo and Caddy run via
docker-compose, with Caddy terminating TLS for git.sascha-bach.de and
talk.sascha-bach.de. Caddy itself sits inside that Docker network, so
127.0.0.1 from its container's point of view is not this host - it
could not reach either the audit endpoint or the webhook listener.
Both services now optionally bind an additional address via
DOCKER_BRIDGE_HOST (the Docker bridge's gateway IP), alongside their
existing 127.0.0.1 listener. Deliberately not 0.0.0.0: on a VPS with a
public IP and no confirmed firewall, that would also accept connections
arriving on the public interface, bypassing the reverse proxy's TLS
termination entirely.
DEPLOYMENT.md now documents both the nginx and the Caddy-in-Docker
path side by side, since this is the configuration actually in use.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds /de/audit and /en/audit with a lead-magnet page (WCAG audit for
free, PDF report + 15min walkthrough) and a request form (name,
company, email, URL, agency/client, motivation), including the
mandatory § 14 BGB business-only notice and confirmation checkbox.
Also, since the site turned out to run exclusively on the Bitpalast
static host rather than Vercel:
- remove vercel.json, port its security headers, agent-discovery
Link header and .well-known CORS/cache headers into public/.htaccess
- fix the .htaccess rewrite so prerendered routes are served instead of
falling back to the empty SPA shell
- self-host Comfortaa/Quicksand via Fontsource instead of Google Fonts
- add a separate backend/ Express service for the audit endpoint,
meant to run on the IONOS VPS independently of the static site
- update the privacy policy to reflect the form and font hosting
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Sascha