Kept the prototype out of search engines in the Website service.

Services/Website/Sources/Library/Public/Extensions/AbsoluteConfigKey+Constants.swift

@@ -82,6 +82,11 @@ extension AbsoluteConfigKey {
         /// The absolute configuration key for the directory the static files are served from.
         public static let staticFiles: AbsoluteConfigKey = .init(.Path.staticFiles)
     }
+    /// A namespace for the site configuration keys, as absolute keys.
+    public enum Site {
+        /// The absolute configuration key for letting search engines index the site.
+        public static let indexable: AbsoluteConfigKey = .init(.Site.indexable)
+    }
     /// A namespace for the security headers configuration keys, as absolute keys.
     public enum Security {
         /// The absolute configuration key for the `Content-Security-Policy` header value.

Services/Website/Sources/Library/Public/Extensions/ConfigKey+Constants.swift

@@ -107,5 +107,7 @@ extension ConfigKey {
     public enum Site {
         /// The configuration key for the public origin the site is served at (scheme and host, no trailing slash).
         public static let origin: ConfigKey = "site.origin"
+        /// The configuration key for letting search engines index the site.
+        public static let indexable: ConfigKey = "site.indexable"
     }
 }

Services/Website/Sources/Library/Public/Middlewares/NoIndexMiddleware.swift

@@ -0,0 +1,43 @@
+import Hummingbird
+import Infrastructure
+
+/// Keeps the site out of search engines: every response — pages, files, redirects, errors — is marked `X-Robots-Tag: noindex, nofollow`.
+///
+/// A header rather than `robots.txt`, which stays open on purpose: a crawler barred from a page never reads its `noindex`, and may still
+/// list the bare URL from links elsewhere. A header also covers what carries no markup, such as the photos sellers upload.
+public struct NoIndexMiddleware<Context: RequestContext>: RouterMiddleware {
+
+    // MARK: Constants
+
+    /// The directive stamped on every response.
+    public static var directive: String { "noindex, nofollow" }
+
+    // MARK: Initializers
+
+    /// Creates the middleware.
+    public init() {}
+
+    // MARK: Methods
+
+    public func handle(
+        _ request: Request,
+        context: Context,
+        next: (Request, Context) async throws -> Response
+    ) async throws -> Response {
+        do {
+            var response = try await next(request, context)
+
+            response.headers[.robotsTag] = Self.directive
+
+            return response
+        } catch let error as HTTPError {
+            // An error thrown past this point becomes a response further out: the mark travels with it.
+            var error = error
+
+            error.headers[.robotsTag] = Self.directive
+
+            throw error
+        }
+    }
+
+}