SEO pass: real index.html, apex canonicals, robots+sitemap, prod React, nginx hardening

nginx.conf

@@ -1,6 +1,5 @@
 server {
-    listen 43036 default_server;
-    listen [::]:43036 default_server;
+    listen 80;
     server_name _;
 
     root /usr/share/nginx/html;
@@ -9,30 +8,50 @@ server {
     charset utf-8;
 
     gzip on;
-    gzip_types text/plain text/css text/javascript application/javascript application/json image/svg+xml;
+    gzip_types text/plain text/css text/javascript application/javascript application/json application/xml image/svg+xml;
     gzip_min_length 1024;
+    gzip_comp_level 6;
+    gzip_vary on;
 
-    # Long cache for static assets — they're content-addressed by path,
-    # bust via filename when they change.
-    location ~* \.(png|jpg|jpeg|gif|webp|svg|ico|woff2?|ttf)$ {
-        expires 30d;
+    # Security headers
+    add_header X-Frame-Options SAMEORIGIN always;
+    add_header X-Content-Type-Options nosniff always;
+    add_header Referrer-Policy strict-origin-when-cross-origin always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+
+    # Vendored libs — versioned, cache hard
+    location /vendor/ {
+        expires 365d;
         add_header Cache-Control "public, immutable";
     }
 
-    # Short cache for the HTML/JS that drive the SPA so edits show up fast.
-    location ~* \.(html|css|js|jsx)$ {
-        expires 5m;
+    # Images/fonts — long cache
+    location ~* \.(png|jpg|jpeg|gif|webp|avif|svg|ico|woff2?|ttf)$ {
+        expires 30d;
+        add_header Cache-Control "public, no-transform";
+    }
+
+    # App JS/CSS — short cache so edits show fast
+    location ~* \.(css|js)$ {
+        expires 10m;
         add_header Cache-Control "public, must-revalidate";
     }
 
-    # Single-page app — unknown paths fall back to index.html, which
-    # handles routing via location.hash (#/projects/<slug>).
+    # Never index build sources or patch scripts
+    location ~* \.(jsx|py)$ { return 404; }
+    location /scripts/ { return 404; }
+
+    location = /robots.txt  { default_type text/plain; }
+    location = /llms.txt    { default_type text/plain; }
+    location = /sitemap.xml { default_type application/xml; }
+
+    # HTML — no stale cache
+    location = /index.html {
+        add_header Cache-Control "no-cache, must-revalidate";
+    }
+
+    # SPA fallback (routing via location.hash)
     location / {
         try_files $uri $uri/ /index.html;
     }
-
-    # llms.txt — let crawlers pull it without rewrites.
-    location = /llms.txt {
-        default_type text/plain;
-    }
 }

robots.txt

@@ -0,0 +1,6 @@
+User-agent: *
+Allow: /
+Disallow: /vendor/
+Disallow: /scripts/
+
+Sitemap: https://wilddragon.net/sitemap.xml

sitemap.xml

@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"
+        xmlns:image="http://www.google.com/schemas/sitemap-image/1.1">
+  <url>
+    <loc>https://wilddragon.net/</loc>
+    <lastmod>2026-07-03</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>1.0</priority>
+    <image:image>
+      <image:loc>https://wilddragon.net/images/wild-dragon-logo.jpg</image:loc>
+      <image:title>Wild Dragon — Broadcast Systems Integration</image:title>
+    </image:image>
+    <image:image>
+      <image:loc>https://wilddragon.net/images/photos/production-switcher.jpg</image:loc>
+      <image:title>Production switcher in a broadcast control room</image:title>
+    </image:image>
+    <image:image>
+      <image:loc>https://wilddragon.net/images/photos/commanders-stadium.jpg</image:loc>
+      <image:title>Washington Commanders stadium broadcast production</image:title>
+    </image:image>
+    <image:image>
+      <image:loc>https://wilddragon.net/images/photos/betmgm-production.jpg</image:loc>
+      <image:title>BetMGM cloud production facility</image:title>
+    </image:image>
+    <image:image>
+      <image:loc>https://wilddragon.net/images/photos/cvs-aetna.jpg</image:loc>
+      <image:title>CVS/Aetna broadcast facility</image:title>
+    </image:image>
+    <image:image>
+      <image:loc>https://wilddragon.net/images/photos/xr-monitor.jpg</image:loc>
+      <image:title>XR virtual production stage monitor</image:title>
+    </image:image>
+  </url>
+</urlset>