From f9330fa20100ac78c1bb05ba85a33846ba9f46ba Mon Sep 17 00:00:00 2001 From: Frank Date: Wed, 7 Oct 2026 23:41:58 -0700 Subject: [PATCH] docs(homepage): record the @data allowlist law for new assets --- serverAppConfigs-docs/Infrastructure/Homepage.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/serverAppConfigs-docs/Infrastructure/Homepage.md b/serverAppConfigs-docs/Infrastructure/Homepage.md index a9bf7d4..2549536 100644 --- a/serverAppConfigs-docs/Infrastructure/Homepage.md +++ b/serverAppConfigs-docs/Infrastructure/Homepage.md @@ -40,7 +40,11 @@ Media Library Apps section. phosphor to amber CRT-AMBIOS (`--fg #ffb000` on `--bg #0a0600`), and the font stack now leads with **VT323** loaded from the Google Fonts CDN (the deploy also ships `shared/homepage/img/` beside the page, so `/img/*` serves the docs -screenshots). The docs page gained a full **API access** walkthrough +screenshots — the post-auth listener serves files only through the `@data` +path allowlist, so new top-level assets must be added there (the `@home` +catch-all answers anything else with `index.html`, i.e. a PNG arrives as +`200 text/html` and renders broken; pinned in `homepage_caddy.bats` — this +exact bug bit the screenshots on 2026-10-08). The docs page gained a full (`/docs#api-access`): per-user OpenWebUI API keys (User menu → Settings → Account → API keys), the base URL `https://ai.franksdank.cloud/api/v1`, and copy-paste configs for **Opencode** (`~/.config/opencode/opencode.json`) and