From 036f01c6635468bd2b71bf8eb26012d9f653d013 Mon Sep 17 00:00:00 2001 From: Christian Cleberg Date: Mon, 3 Aug 2026 15:17:25 -0500 Subject: document /img/ symlink deployment prerequisite --- README.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) (limited to 'README.md') diff --git a/README.md b/README.md index a586b9e..eb3fe9a 100644 --- a/README.md +++ b/README.md @@ -99,6 +99,28 @@ ENV=prod uv run build.py uv run build.py ``` +## Deployment + +Production builds emit root-relative URLs (`/styles.min.css`, +`/img/blog/...`) instead of absolute `https://` ones so the site renders +standalone on the onion service without fetching assets off-onion. + +This means the web server must serve the image store at `/img/` on the +`cleberg.net` vhost. The images live at `/var/www/img/` (their own host, +`img.cleberg.net`); expose them under `cleberg.net/img/` with a symlink: + +``` shell +ln -s /var/www/img /var/www/cleberg.net/img +``` + +Without this, images 404 in production. Development builds keep the +absolute `img.cleberg.net` URLs, so local previews load images from the +live host and need no symlink. + +Once assets are same-origin, the vhost CSP can tighten `img-src`, +`style-src`, and `font-src` back to `'self'`. After deploying, purge the +Cloudflare cache (responses carry a 31-day `max-age`). + ## Creating New Blog Posts To add new blog content, follow this procedure within Emacs: -- cgit v1.2.3