The theweft.org website: a static placeholder for now. Plain HTML and CSS in public/, no build step, no external resources, no tracking.
| Path | Content |
|---|---|
/ |
What weft is, status, links |
/security/ |
How to report vulnerabilities (GitHub private reporting first, then security@theweft.org) |
/.well-known/security.txt |
Machine-readable security contact (RFC 9116) |
/brand/ |
Logo, wordmark, lockups, icons and social preview; see brand/README.md |
_headers |
Strict Content-Security-Policy and other security headers, applied by Cloudflare |
Cloudflare builds from this GitHub repository on every push to main; nothing to build.
- Push this repository to
github.com/theweft/weft-website. - Cloudflare dashboard: Workers & Pages > Create > Import a repository, pick
weft-website. wrangler.jsonc tells Cloudflare to servepublic/. Leave the build command empty; the deploy command isnpx wrangler deploy. - In the new Worker: Settings > Domains & Routes > Add > Custom domain:
theweft.organdwww.theweft.org. Cloudflare creates the DNS records and certificate (the zone is already on Cloudflare). - Check
https://theweft.org/.well-known/security.txtreturns the file as plain text. - Optional: redirect the other domains (theweft.dev, weftfleet.org/.dev/.com) to theweft.org with a Redirect Rule or Bulk Redirects in each zone.
Alternative: a Cloudflare Pages project with build output directory public serves the same
files, including _headers.
nix develop (or direnv) provides just, wrangler and the checks.
just serve: preview with a plain file server.just dev: preview with Cloudflare's runtime (applies_headers).just ci: link check, security.txt expiry, spelling, licences.
security.txt carries an Expires date; CI fails 60 days before it, and runs weekly so this
is noticed. Update the date (at most a year ahead) when it does.
MIT. See LICENSE.