During the nginx outage the proxy URLs briefly served the landing page
WITH cacheable headers; browsers cached that HTML for the proxy URLs and
kept reading it after the origin recovered (satellites 'no satellites',
empty aircraft). no-store on every feed fetch means the browser cache can
never serve (or store) a poisoned body for data endpoints again. The
proxies are no-store server-side anyway — this closes the outage-window
loophole.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- firms (bespoke): raw VIIRS S-NPP fire detections, world, 24h. CSV via
new serve.py proxy/firms (key from gitignored firmscredentials.json,
injected server-side, 1h cache + stale-on-error). Points colored/sized
by fire radiative power; click -> FRP/brightness/time/satellite overlay.
Verified live: 1412 detections, hottest 88 MW seen 00:35 UTC today.
- windycams (bespoke): viewport-driven Windy Webcams v3 — nearest ~50 cams
wherever the camera stops, entities with live preview img in InfoBox.
proxy/windy validates nearby=lat,lon,km, injects x-windy-api-key header,
10min coarsened cache. Degrades cleanly: 'key rejected' status until a
real WEBCAMS-product key lands in windycredentials.json (re-read per
request, no restart needed).
- key loader tolerant of JSON, brace-less fragments, or raw pasted tokens.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
