- Implemented QuickcheckPage component with a form for user input.
- Added validation for email and consent checkboxes.
- Integrated form submission to a specified endpoint.
- Created SCSS styles for the QuickcheckPage layout and components.
The cors() origin callback rejected disallowed origins by calling
callback(new Error(...)), which Express routes to the generic error
handler - previously hardcoded to always respond 500 and log
"Unhandled error". A rejected origin is expected, routine traffic
(bots, scanners, or a deliberate CORS test), not a server fault, and
was being reported and logged as one.
The request was already being correctly rejected either way (no data
processed, no email sent) - this only fixes the status code and log
noise, not a security gap.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The actual VPS setup has no native nginx - Forgejo and Caddy run via
docker-compose, with Caddy terminating TLS for git.sascha-bach.de and
talk.sascha-bach.de. Caddy itself sits inside that Docker network, so
127.0.0.1 from its container's point of view is not this host - it
could not reach either the audit endpoint or the webhook listener.
Both services now optionally bind an additional address via
DOCKER_BRIDGE_HOST (the Docker bridge's gateway IP), alongside their
existing 127.0.0.1 listener. Deliberately not 0.0.0.0: on a VPS with a
public IP and no confirmed firewall, that would also accept connections
arriving on the public interface, bypassing the reverse proxy's TLS
termination entirely.
DEPLOYMENT.md now documents both the nginx and the Caddy-in-Docker
path side by side, since this is the configuration actually in use.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds /de/audit and /en/audit with a lead-magnet page (WCAG audit for
free, PDF report + 15min walkthrough) and a request form (name,
company, email, URL, agency/client, motivation), including the
mandatory § 14 BGB business-only notice and confirmation checkbox.
Also, since the site turned out to run exclusively on the Bitpalast
static host rather than Vercel:
- remove vercel.json, port its security headers, agent-discovery
Link header and .well-known CORS/cache headers into public/.htaccess
- fix the .htaccess rewrite so prerendered routes are served instead of
falling back to the empty SPA shell
- self-host Comfortaa/Quicksand via Fontsource instead of Google Fonts
- add a separate backend/ Express service for the audit endpoint,
meant to run on the IONOS VPS independently of the static site
- update the privacy policy to reflect the form and font hosting
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
BREAKING CHANGES:
Remove entire backend infrastructure in favor of direct mailto links
Centralize all text content to single configuration file
Features:
Add centralized text configuration system in texts.ts
Add Privacy Policy page with GDPR compliance
Implement type-safe text management with TypeScript interfaces
Add internationalization-ready text structure
Refactoring:
Update all components to use centralized text configuration:
Navigation menu items and labels
Theme toggle icons and labels
Footer text and aria labels
Contact section content and form texts
Projects section button labels
Imprint page legal content
Replace backend contact form with direct mailto functionality
Simplify contact flow to use email client directly
Backend Removal:
Remove complete Node.js/Express backend infrastructure
Remove email service and contact form submission logic
Remove API configuration and validation middleware
Clean up package dependencies (remove express-validator, backend packages)
Style Improvements:
Standardize SCSS variables across all section files
Add consistent card styling and transitions
Improve responsive design patterns
Enhance contact section with new email-focused layout
Infrastructure:
Update routing to include Privacy Policy page
Maintain Vercel deployment configuration
Keep frontend-only architecture for static hosting
Sascha