# Weft operations

## Caddy source protection

Before enabling public notes, place these matchers before `file_server` in the
site block and reload Caddy:

```caddyfile
@underscore path_regexp underscore (^|/)_[^/]*
respond @underscore 404

@templates path *.tmpl
respond @templates 404
```

The first matcher denies any URL with an underscore-prefixed path component,
including an entire `_private/` subtree. The second denies template sources.
Markdown is intentionally not denied and may remain downloadable. Validate the
active configuration with `caddy validate --config /etc/caddy/Caddyfile` before
`systemctl reload caddy`.

## Syncthing

Each device keeps this device-local, non-synchronized `.stignore` at the vault
root:

```text
#include .stignore.shared
```

The synchronized `.stignore.shared` contains:

```text
*.html
```

The local include lets every device load one shared rule without trying to
synchronize `.stignore` itself. The shared rule excludes generated HTML at
every depth in both directions while leaving Markdown synchronized.

## Scheduled build

Install the Weft binary at `/usr/local/bin/weft`, then use a cron entry like:

```cron
17 * * * * sleep 60 && flock -n /run/lock/weft.lock /usr/local/bin/weft -gitignore /srv/tjp.lol https://tjp.lol >>/var/log/weft.log 2>&1 || logger -t weft 'build failed or lock unavailable'
```

The 60-second delay gives Syncthing time to settle, `flock -n` prevents
overlapping builds, build output goes to `/var/log/weft.log`, and failure is
also recorded in the system log under the `weft` tag. Adjust the delay only
after observing the server's real sync latency. These paths assume a root
crontab; for an unprivileged account, use lock and log paths it can write.

## Rollout

- [ ] Install Weft and run one manual build on the server.
- [ ] Add and validate the Caddy matchers above before serving the source tree.
- [ ] Put the local `.stignore` on every Syncthing device and synchronize
  `.stignore.shared`.
- [ ] Connect only the deliberately selected public vault content.
- [ ] Verify generated note pages, internal links, and underscore privacy on the
  deployed host.
- [ ] Install the locked, delayed cron build and confirm a forced failure is
  logged.
- [ ] Restore Notes navigation and homepage links only after real public notes
  are present and verified.

Notes remains hidden: no real selected vault content exists in this repository,
so vault connection and server activation are intentionally pending.