Kept the prototype out of search engines in the Website service.

Services/Website/docker-compose.yml

@@ -20,33 +20,35 @@ services:
     ports:
       - "${HOST_PORT:-8080}:8080"
     environment:
+      # Empty leaves the tracker off.
+      ANALYTICS_WEBSITE_ID: ${ANALYTICS_WEBSITE_ID:-}
+      ANALYTICS_DOMAINS: ${ANALYTICS_DOMAINS:-}
+      ANALYTICS_RECORDER: ${ANALYTICS_RECORDER:-false}
+      DATABASE_DRIVER: ${DATABASE_DRIVER:-postgres}
+      DATABASE_HOST: ${DATABASE_HOST:?DATABASE_HOST is required}
+      DATABASE_PORT: ${DATABASE_PORT:-5432}
+      DATABASE_NAME: ${DATABASE_NAME:-ccn}
+      DATABASE_PASSWORD: ${DATABASE_PASSWORD:?DATABASE_PASSWORD is required}
+      DATABASE_POOL_MAX_PER_EVENT_LOOP: ${DATABASE_POOL_MAX_PER_EVENT_LOOP:-4}
+      DATABASE_TLS: ${DATABASE_TLS:-require}
+      DATABASE_USERNAME: ${DATABASE_USERNAME:-ccn}
       LOG_LEVEL: ${LOG_LEVEL:-info}
       HTTP_SERVER_NAME: ${HTTP_SERVER_NAME:-CCNWebsite}
-      # The public origin: scheme and host, no trailing slash. The HTTPS redirect and the canonical links derive from it.
-      SITE_ORIGIN: ${SITE_ORIGIN:-https://ccn.rock-n-co.de}
+      HTTPS_TRUST_FORWARDED_PROTO: "${HTTPS_TRUST_FORWARDED_PROTO:-true}"
       # The origin browsers bind passkeys to: exactly where the sign-in screen is served — same scheme, same host, no
       # `www.` either way. Left at the app's default (http://localhost:8080) every ceremony fails, so it follows
       # SITE_ORIGIN unless set apart. It must be HTTPS: browsers run WebAuthn nowhere else but localhost, and it is
       # what marks the session cookie `Secure`.
       PASSKEYS_ORIGIN: ${PASSKEYS_ORIGIN:-${SITE_ORIGIN:-https://ccn.rock-n-co.de}}
-      # Empty leaves the tracker off.
-      ANALYTICS_WEBSITE_ID: ${ANALYTICS_WEBSITE_ID:-}
-      ANALYTICS_DOMAINS: ${ANALYTICS_DOMAINS:-}
-      ANALYTICS_RECORDER: ${ANALYTICS_RECORDER:-false}
       # Falls back to the policy the app ships with; set it in `.env` to allow the analytics origin,
       # which must match `String.Analytics.origin`.
+      RATE_LIMIT_TRUST_FORWARDED_FOR: "${RATE_LIMIT_TRUST_FORWARDED_FOR:-true}"
       SECURITY_CONTENT_SECURITY_POLICY: "${SECURITY_CONTENT_SECURITY_POLICY:-default-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'}"
       SECURITY_STRICT_TRANSPORT_SECURITY: "${SECURITY_STRICT_TRANSPORT_SECURITY:-max-age=31536000; includeSubDomains}"
-      HTTPS_TRUST_FORWARDED_PROTO: "${HTTPS_TRUST_FORWARDED_PROTO:-true}"
-      RATE_LIMIT_TRUST_FORWARDED_FOR: "${RATE_LIMIT_TRUST_FORWARDED_FOR:-true}"
-      DATABASE_DRIVER: ${DATABASE_DRIVER:-postgres}
-      DATABASE_HOST: ${DATABASE_HOST:?DATABASE_HOST is required}
-      DATABASE_PORT: ${DATABASE_PORT:-5432}
-      DATABASE_NAME: ${DATABASE_NAME:-ccn}
-      DATABASE_USERNAME: ${DATABASE_USERNAME:-ccn}
-      DATABASE_PASSWORD: ${DATABASE_PASSWORD:?DATABASE_PASSWORD is required}
-      DATABASE_TLS: ${DATABASE_TLS:-require}
-      DATABASE_POOL_MAX_PER_EVENT_LOOP: ${DATABASE_POOL_MAX_PER_EVENT_LOOP:-4}
+      # The public origin: scheme and host, no trailing slash. The HTTPS redirect and the canonical links derive from it.
+      SITE_ORIGIN: ${SITE_ORIGIN:-https://ccn.rock-n-co.de}
+      # Off while the site is a prototype: every response is marked `X-Robots-Tag: noindex, nofollow`.
+      SITE_INDEXABLE: "${SITE_INDEXABLE:-false}"
     volumes:
       # The photos sellers upload. The rest of the image is read-only, and without the volume a redeploy would lose them.
       - website-uploads:/app/Resources/Static/uploads