sites

type Config ¶

type Config struct {
	Apex     string
	Reserved []string
	// SelfDomains are the registrable domains of OUR OWN infrastructure (e.g.
	// hanzo.ai, hanzo.app). A Host at or under any of them is never a customer
	// custom-domain candidate, so the high-traffic api/console path is never
	// subjected to a per-request binding lookup, and a customer binding can never
	// shadow a real Hanzo host. The apex is always treated as self.
	SelfDomains []string
	// FirstPartyApex is a SelfDomain (e.g. hanzo.ai) on which we serve a small set
	// of OUR OWN first-party sites (cd/flow/gallery.hanzo.ai) — the brand's own
	// pages, not customer sites. It uses the OPPOSITE security model to Apex: Apex
	// is multi-tenant, so sites are the DEFAULT and a denylist (Reserved) carves out
	// app hosts; the brand apex carries api/console/iam/kms/… and CANNOT afford a
	// denylist gap (one missing label = a project shadowing a real host → the OAuth
	// account-takeover in reserved.go), so here sites are OPT-IN: ONLY a label in
	// FirstPartySites serves, everything else falls through to the normal pipeline,
	// protected by default. Empty = no first-party sites (the multi-tenant-only
	// default). The apex itself is unaffected (hanzo.app stays the site default).
	FirstPartyApex  string
	FirstPartySites []string
	// FirstPartyOrg is the org that OWNS the first-party sites (hanzo). A first-party
	// host resolves PINNED to this org — never unique-across-orgs — so a customer's
	// same-named project can never be served on our internal apex. Empty ⇒ the
	// first-party sites cannot resolve (fail-closed), so it must be set when
	// FirstPartyApex is.
	FirstPartyOrg string
}

Config configures the site host-router. Apex is the zone whose subdomains are site hosts (hanzo.app). Reserved is the set of subdomain labels that are NOT sites (they belong to real app hosts) and must fall through to the normal pipeline — the reserved-host exclusion that stops a site from shadowing a real hanzo.app app or api.

type Purger ¶

type Purger struct {
	// contains filtered or unexported fields
}

Purger purges the Cloudflare edge cache by cache-tag so a redeploy is instantly live at the edge. It is deliberately minimal: one POST to the zone purge API with the tags we stamped onto every site object (Cache-Tag: site-<org>-<slug>).

Credentials come ONLY from the environment the operator injects from KMS (CF_API_TOKEN, CF_ZONE_ID) — never hard-coded, never logged. When either is unset the Purger is a no-op that warns once per call: a missing CF token must degrade to "stale-until-TTL", never fail a deploy.

The Cloudflare account and its purge quota are SHARED BY EVERY TENANT, so an unthrottled purge is a cross-tenant hazard: one org driving purges in a loop would exhaust the quota and silently stop every OTHER org's redeploy from reaching the edge (purge failures are non-fatal by design, so they would serve stale content with no error). Two bounds prevent that, and both live HERE so every caller — deploy, release activation, delete — inherits them:

• per-tag coalescing: at most two API calls per window per site (one on the leading edge so a normal single publish is instant, one trailing so the LAST change in a burst is always purged). Coalescing is correctness- preserving: purging tag T twice in a burst and purging it once after the burst invalidate exactly the same thing.
• a process-wide ceiling on actual API calls per minute, which is what ultimately protects the shared quota from a tenant that spreads load across many sites. Exceeding it degrades to stale-until-TTL — the same documented failure mode as an unconfigured token — and says so at Warn.

func NewPurger(log luxlog.Logger) *Purger

func (p *Purger) AssertHTMLPassthrough(ctx context.Context)

func (p *Purger) Configured() bool

func (p *Purger) PurgeTags(ctx context.Context, tags ...string) error

func (p *Purger) Stop()

type Resolver ¶

type Resolver interface {
	Resolve(ctx context.Context, slug string) (Site, bool, error)
	// ResolveOrg resolves a slug PINNED to org — the first-party-host path
	// (cd.hanzo.ai → org "hanzo"). It must NEVER fall back to unique-across-orgs, so
	// an internal host can only ever be served by OUR own project, never shadowed by
	// a customer who happens to name a project the same.
	ResolveOrg(ctx context.Context, org, slug string) (Site, bool, error)
}

Resolver maps a validated subdomain slug to its authoritative Site. It is the projects store (the ONE source of project truth). found=false ⇒ no such published subdomain (honest 404); err ⇒ a real store failure (honest 500).

type Server ¶

type Server struct {
	// contains filtered or unexported fields
}

Server is the host-routed public site edge. It holds the S3 access path (s3admin, the SAME credentials as the deploy blob store) plus the apex. The reserved-label policy is the package-level shared source (reserved.go), so serve/create/bind never disagree. It reads the resolver at request time.

func New(cfg Config, log luxlog.Logger) *Server

func (s *Server) Middleware() zip.Handler

type Site ¶

type Site struct {
	Org    string
	Slug   string
	Bucket string
	Prefix string
	Status string
	// CrossOriginIsolation, when true, makes the site server emit the cross-origin
	// isolation headers (COOP/COEP on documents, CORP on assets) so a multithreaded
	// Unity/Unreal/Godot WebGL build can use SharedArrayBuffer. It is OPT-IN per
	// site — isolation blocks embedding third-party cross-origin content, so it is
	// NEVER global. Server-owned like every other field: the resolver sets it (from
	// the project's declared WebGL game-engine framework), never the request.
	CrossOriginIsolation bool
}

Site is the authoritative binding for a published subdomain: the tenant (Org), the S3 location (Bucket + Prefix), and the publish Status. Every field is server-owned — produced by the store from the validated slug, never from the request. Prefix is the hard tenant boundary for object reads.