From dd437203b210bf16d5af556bbf28e366b58a8137 Mon Sep 17 00:00:00 2001
From: Teodor Calin <teodor@vulturelabs.io>
Date: Wed, 16 Sep 2026 18:25:01 +0300
Subject: [PATCH] Open public visitors on authentication and hide operational
 endpoints

---
 deploy/Caddyfile.community        | 10 +++++++++-
 docs/COMMUNITY.md                 | 13 +++++++++++++
 internal/community/server.go      |  2 ++
 internal/community/web/app.js     |  6 ++++--
 internal/community/web/index.html |  2 +-
 5 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/deploy/Caddyfile.community b/deploy/Caddyfile.community
index b320e50..21e476a 100644
--- a/deploy/Caddyfile.community
+++ b/deploy/Caddyfile.community
@@ -15,7 +15,15 @@ cosift.pilotprotocol.network, origin.cosift.pilotprotocol.network {
  handle /debug/* {
   respond "not found" 404
  }
- @community path / /app.js /style.css /sample.csv /api/*
+ @operations path /stats /stats/* /metrics /metrics/* /queue /queue/* /domains /domains/* /verify /verify/* /sla /sla/*
+ handle @operations {
+  respond "not found" 404
+ }
+ @legacy_ui path /chat /chat/*
+ handle @legacy_ui {
+  redir /login 302
+ }
+ @community path / /login /signup /app.js /style.css /sample.csv /api/*
  handle @community {
   reverse_proxy 127.0.0.1:7780 {
    header_up X-Forwarded-For {client_ip}
diff --git a/docs/COMMUNITY.md b/docs/COMMUNITY.md
index 22705b3..6db8368 100644
--- a/docs/COMMUNITY.md
+++ b/docs/COMMUNITY.md
@@ -225,3 +225,16 @@ rollout also requires preserving the old binary, backend config and Caddy config
 Signed release assets include Linux ARM64/AMD64, macOS ARM64/AMD64 and Windows
 AMD64. Install the matching binary and use the same public server URL for both
 `contribute` and `request`. Payment purchase flows remain disabled.
+
+
+## Public entry and operations visibility
+
+Anonymous visitors land on the signup/sign-in screen. `/login` opens sign-in,
+`/signup` opens account creation, and an existing session opens the workspace.
+Guest browsing remains an explicit choice with the same 30-minute allowance.
+Signing out returns to authentication.
+
+The production proxy denies public access to `/stats`, `/metrics`, `/queue`,
+`/domains`, `/verify`, and `/sla` (including subpaths). Operators can still use
+these endpoints over SSH on the loopback engine listener. The old `/chat` UI
+redirects to `/login`. `/healthz` retains its minimal health response.
diff --git a/internal/community/server.go b/internal/community/server.go
index d11b5cd..3878624 100644
--- a/internal/community/server.go
+++ b/internal/community/server.go
@@ -101,6 +101,8 @@ func Open(cfg Config) (*Server, error) {
 	}
 	mux := http.NewServeMux()
 	mux.HandleFunc("GET /{$}", s.asset("index.html", "text/html; charset=utf-8"))
+	mux.HandleFunc("GET /login", s.asset("index.html", "text/html; charset=utf-8"))
+	mux.HandleFunc("GET /signup", s.asset("index.html", "text/html; charset=utf-8"))
 	mux.HandleFunc("GET /app.js", s.asset("app.js", "text/javascript; charset=utf-8"))
 	mux.HandleFunc("GET /style.css", s.asset("style.css", "text/css; charset=utf-8"))
 	mux.HandleFunc("GET /sample.csv", func(w http.ResponseWriter, r *http.Request) {
diff --git a/internal/community/web/app.js b/internal/community/web/app.js
index 6d723ba..611aad4 100644
--- a/internal/community/web/app.js
+++ b/internal/community/web/app.js
@@ -312,7 +312,7 @@ $("logout").onclick = async () => {
     $("search-heading").hidden = true;
     $("search-empty").hidden = false;
     $("query").value = "";
-    await enter();
+    showScreen("auth");
   } catch (e) {
     notify(e.message, true);
   }
@@ -597,7 +597,9 @@ $("refresh-contributions").onclick = () =>
     user = null;
   }
   try {
-    await enter();
+    if (location.pathname === "/login" && signingUp) $("auth-toggle").click();
+    if (user) await enter();
+    else showScreen("auth");
   } catch (e) {
     showScreen("auth");
     notify(e.message, true);
diff --git a/internal/community/web/index.html b/internal/community/web/index.html
index efa8ea9..24efd60 100644
--- a/internal/community/web/index.html
+++ b/internal/community/web/index.html
@@ -9,7 +9,7 @@
   </head>
   <body>
     <div id="notice" role="status" aria-live="polite" hidden></div>
-    <section id="auth" class="entry" hidden>
+    <section id="auth" class="entry">
       <div class="entry-story">
         <a class="brand" href="/">cosift<span>●</span></a>
         <div>