From 6d78d9d99b56ec6f67b72aaab797e18ceafb40de Mon Sep 17 00:00:00 2001 From: "prompt.ac/@jeffrey" Date: Thu, 1 Oct 2026 16:14:45 -0700 Subject: [PATCH] Repair public machine entry routing and MIME alias TLS --- lith/Caddyfile | 3 +++ lith/MACHINE-VISITORS.md | 28 +++++++++++++++++--------- system/public/machine/rdp.jas.life.txt | 3 +-- system/public/network.json | 6 +++++- utilities/machine-properties.mjs | 2 +- 5 files changed, 28 insertions(+), 14 deletions(-) diff --git a/lith/Caddyfile b/lith/Caddyfile index b1f577c45c..2578eff125 100644 --- a/lith/Caddyfile +++ b/lith/Caddyfile @@ -1473,6 +1473,9 @@ mime.ac { www.mime.ac { tls { + # Keep this SNI on its managed certificate, as for the apex. Without + # a distinct TLS policy the :443 origin certificate wins selection. + protocols tls1.2 tls1.3 issuer acme { dir https://acme-v02.api.letsencrypt.org/directory } diff --git a/lith/MACHINE-VISITORS.md b/lith/MACHINE-VISITORS.md index 967d992c03..fb3090d1c7 100644 --- a/lith/MACHINE-VISITORS.md +++ b/lith/MACHINE-VISITORS.md @@ -49,16 +49,24 @@ aliases keep their canonical destination. Client properties (`false.work`, `danzballet.studio`, `gym.anthonyzollo.com`) and authenticated infrastructure are outside this change. The IPFS gateway retains its own protocol behavior. -Two public-probe limitations were observed 2026-10-01: - -- `rdp.jas.life` public DNS reaches a missing Vercel deployment (404). Its Lith - manifest is ready but will not be reachable until the public route reaches - Lith. The working collection metadata is at `rdp.aesthetic.computer`. -- The local network intercepts `sotce.net`: local DNS returns a documentation - address and the certificate is issued by the UniFi SSL Certificate Authority. - Public DNS returns Cloudflare addresses. Local Node/curl certificate failures - therefore do not establish a production TLS problem. Run the normal HTTPS - probe from an unaffected network; never disable certificate validation. +The 2026-10-01 public audit found and repaired three pre-existing serving gaps: + +- `www.prompt.ac` lacked an explicit DNS record and inherited the `100::` + wildcard, producing Cloudflare 522. A proxied A override now points at Lith. +- `rdp.jas.life` inherited a Vercel wildcard and returned DEPLOYMENT_NOT_FOUND. + A proxied A override now reaches its already-published Lith painting gallery. +- `www.mime.ac` selected the catch-all origin certificate. Its own TLS policy + now selects the managed certificate, matching the existing apex pattern. + +Both DNS changes add only the exact hostname, preserving wildcard records and +all other hosts. Removing those explicit records restores the prior behavior. +The public directory contains no DNS credentials or control-plane identifiers. + +The local network intercepts `sotce.net`: local DNS returns a documentation +address and the certificate is issued by the UniFi SSL Certificate Authority. +Public DNS returns Cloudflare addresses; normal HTTPS from Lith verifies Sotce's +manifest successfully. Run the probe from an unaffected network; never disable +certificate validation. `wipppps.world` currently reaches an external site, despite legacy Caddy rules. Other separately hosted properties (Shopify shop/gift, status/grab workers, diff --git a/system/public/machine/rdp.jas.life.txt b/system/public/machine/rdp.jas.life.txt index 81b5ae286c..1e8421c8b2 100644 --- a/system/public/machine/rdp.jas.life.txt +++ b/system/public/machine/rdp.jas.life.txt @@ -2,11 +2,10 @@ > An archive of Jeffrey Alan Scudder's digital paintings. -The legacy public host currently returns 404; use the metadata host while routing is repaired. - ## Resources - [Website](https://rdp.jas.life/): Public entry point. +- [About](https://rdp.jas.life/about/): Project background. - [Metadata](https://rdp.aesthetic.computer/): Published collection metadata. ## Network diff --git a/system/public/network.json b/system/public/network.json index 6e09242905..3a17798dc9 100644 --- a/system/public/network.json +++ b/system/public/network.json @@ -730,13 +730,17 @@ "summary": "An archive of Jeffrey Alan Scudder's digital paintings.", "llms": "https://rdp.jas.life/llms.txt", "aliases": [], - "note": "The legacy public host currently returns 404; use the metadata host while routing is repaired.", "resources": [ { "title": "Website", "url": "https://rdp.jas.life/", "description": "Public entry point." }, + { + "title": "About", + "url": "https://rdp.jas.life/about/", + "description": "Project background." + }, { "title": "Metadata", "url": "https://rdp.aesthetic.computer/", diff --git a/utilities/machine-properties.mjs b/utilities/machine-properties.mjs index da237e640b..a0dfeaaef3 100644 --- a/utilities/machine-properties.mjs +++ b/utilities/machine-properties.mjs @@ -35,7 +35,7 @@ export const properties = [ property("pop.aesthetic.computer", "Aesthetic Dot Computer", "Music releases and public release records.", [["Release catalog", "https://pop.aesthetic.computer/releases/catalog.json", "The public catalog used by the site."], ["Marimbaba release", "https://pop.aesthetic.computer/releases/marimbaba.json", "Public example release record."]], {note: "Public records contain release information, not the private rights, legal-party or delivery overlay. Respect the licensing of each recording."}), property("nft.aesthetic.computer", "Jeffrey Scudder NFT Record", "A public catalog of created and collected works with provenance references.", [["Catalog JSON", "https://nft.aesthetic.computer/data/catalog.json", "Stable public catalog endpoint; includes snapshot dates and caveats."], ["Radical Digital Painting metadata", "https://rdp.aesthetic.computer/", "Published token metadata."]], {note: "Holder and quantity data are dated snapshots, not current ownership or financial advice. Cite the snapshot and original record."}), property("rdp.aesthetic.computer", "Radical Digital Painting Metadata", "Permanent metadata host for the Radical Digital Painting collection.", [["Example token JSON", "https://rdp.aesthetic.computer/json/1.json", "Metadata pattern: /json/.json."], ["Collection catalog", "https://nft.aesthetic.computer/data/catalog.json", "Public provenance and collection context."]]), - property("rdp.jas.life", "Radical Digital Painting", "An archive of Jeffrey Alan Scudder's digital paintings.", [["Metadata", "https://rdp.aesthetic.computer/", "Published collection metadata."]], {note: "The legacy public host currently returns 404; use the metadata host while routing is repaired."}), + property("rdp.jas.life", "Radical Digital Painting", "An archive of Jeffrey Alan Scudder's digital paintings.", [["About", "https://rdp.jas.life/about/", "Project background."], ["Metadata", "https://rdp.aesthetic.computer/", "Published collection metadata."]]), property("jas.life", "Jeffrey Alan Scudder", "Jeffrey Alan Scudder's public portfolio and CV.", [["Papers", "https://papers.aesthetic.computer/", "Published research."], ["Paintings", "https://justanothersystem.org/", "Stretched painting gallery."]], {aliases: ["www.jas.life"]}), property("justanothersystem.org", "Just Another System", "Jeffrey Alan Scudder's stretched painting gallery.", [["Registry JSON", "https://justanothersystem.org/registry.json", "The public painting registry used by the gallery."], ["Jeffrey", "https://jas.life/", "Artist portfolio."]], {aliases: ["www.justanothersystem.org"], note: "Gallery administration remains authenticated. Attribute paintings to their creator and link the record when citing."}), property("quiltnet.org", "Quiltnet", "A catalog of handmade quilts.", [], {aliases: ["www.quiltnet.org"], note: "Use the public catalog for names, images and attribution. No separate public API is advertised."}), -- 2.51.2