From b2a61483dca297bc26971cfe08b759a888052c3f Mon Sep 17 00:00:00 2001
From: andwati <andwatiian@gmail.com>
Date: Thu, 16 Jul 2026 15:48:56 +0300
Subject: [PATCH] remove Dockerfile and .dockerignore; add security.txt,
 _headers, and _redirects for deployment

---
 .dockerignore                   | 19 -------------------
 CLAUDE.md                       |  2 +-
 Dockerfile                      |  9 ---------
 static/.well-known/security.txt |  4 ++++
 static/_headers                 |  7 +++++++
 static/_redirects               |  1 +
 6 files changed, 13 insertions(+), 29 deletions(-)
 delete mode 100644 .dockerignore
 delete mode 100644 Dockerfile
 create mode 100644 static/.well-known/security.txt
 create mode 100644 static/_headers
 create mode 100644 static/_redirects

diff --git a/.dockerignore b/.dockerignore
deleted file mode 100644
index 3023ebb..0000000
--- a/.dockerignore
+++ /dev/null
@@ -1,19 +0,0 @@
-node_modules
-pnpm-lock.yaml
-.git
-.gitignore
-.env
-.DS_Store
-*.md
-LICENSE
-Makefile
-bin/
-manimations/
-llms/
-.husky
-.github
-.vscode
-themes/
-public/
-target/
-dist/
diff --git a/CLAUDE.md b/CLAUDE.md
index 5e5b2d4..0e6f582 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -17,7 +17,7 @@ A personal blog (andwati.com — "Thoughts and Musings") built with [Zola](https
 
 There is no JS/CSS build tooling beyond Zola itself: `compile_sass = true` in `zola.toml` means Sass under `sass/` is compiled directly by Zola.
 
-Docker: `Dockerfile` does a multi-stage build — `zola build` in the `ghcr.io/getzola/zola` image, then serves `public/` via `static-web-server`.
+Deployment is via Cloudflare (`wrangler.toml`, `npm run deploy` → `zola build && wrangler deploy`), serving `public/` as static assets on `andwati.com`/`www.andwati.com`.
 
 ## Content structure
 
diff --git a/Dockerfile b/Dockerfile
deleted file mode 100644
index bcae00d..0000000
--- a/Dockerfile
+++ /dev/null
@@ -1,9 +0,0 @@
-FROM ghcr.io/getzola/zola:v0.22.1 AS zola
-
-COPY . /project
-WORKDIR /project
-RUN ["zola", "build"]
-
-FROM ghcr.io/static-web-server/static-web-server:2
-WORKDIR /
-COPY --from=zola /project/public /public
diff --git a/static/.well-known/security.txt b/static/.well-known/security.txt
new file mode 100644
index 0000000..430566d
--- /dev/null
+++ b/static/.well-known/security.txt
@@ -0,0 +1,4 @@
+Contact: mailto:andwatiian@gmail.com
+Expires: 2027-07-16T00:00:00.000Z
+Preferred-Languages: en
+Canonical: https://andwati.com/.well-known/security.txt
diff --git a/static/_headers b/static/_headers
new file mode 100644
index 0000000..9ca3f0f
--- /dev/null
+++ b/static/_headers
@@ -0,0 +1,7 @@
+/*
+  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://utteranc.es; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://www.google-analytics.com; font-src 'self'; connect-src 'self' https://www.google-analytics.com; frame-src https://www.youtube-nocookie.com https://utteranc.es; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests
+  X-Frame-Options: DENY
+  X-Content-Type-Options: nosniff
+  Referrer-Policy: strict-origin-when-cross-origin
+  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
+  Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
diff --git a/static/_redirects b/static/_redirects
new file mode 100644
index 0000000..a08d3de
--- /dev/null
+++ b/static/_redirects
@@ -0,0 +1 @@
+/security.txt /.well-known/security.txt 301