From 4b71c014e94f0dba7d4b36baa724d6c1c9611474 Mon Sep 17 00:00:00 2001
From: Frank <frank@dankware>
Date: Wed, 7 Oct 2026 23:38:18 -0700
Subject: [PATCH] caddy: serve /img/* from the homepage root

The @data path allowlist on the post-auth listener did not include /img/*,
so docs screenshots fell through to the index.html catch-all and the
browser got 200 text/html for every PNG (docs images broken live
2026-10-08). Pinned by the homepage_caddy seam.
---
 dankclaw/Caddyfile        | 2 +-
 tests/homepage_caddy.bats | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile
index 46bf45a..1569963 100644
--- a/dankclaw/Caddyfile
+++ b/dankclaw/Caddyfile
@@ -337,7 +337,7 @@ http://:8017 {
 			try_files /docs.html
 			file_server
 		}
-		@data path /services.json /status.json /app.js /style.css /deployed.js
+		@data path /services.json /status.json /app.js /style.css /deployed.js /img/*
 		handle @data {
 			file_server
 		}
diff --git a/tests/homepage_caddy.bats b/tests/homepage_caddy.bats
index 57e58be..90ad2d5 100644
--- a/tests/homepage_caddy.bats
+++ b/tests/homepage_caddy.bats
@@ -31,6 +31,9 @@ setup() {
     # can access them (the browser's Authentik session covers these fetches).
     grep -qE "@data[[:space:]]+path[[:space:]]+/services\.json[[:space:]]+/status\.json" "$CADDY"
     grep -qE "handle[[:space:]]+@data" "$CADDY"
+    # docs screenshots (/img/*) must be served from disk, not answered by the
+    # index.html catch-all (2026-10-08: PNGs came back as 200 text/html).
+    grep -qE "@data[[:space:]]+path.*(/img/\*|/img/\*\")" "$CADDY"
 }
 
 @test "the homepage revalidates its assets (no stale cache after deploys)" {