# LANE 5 — Ship it: harden 3GOD, deploy the web toy to digalot.fyi

**Owns:** the 3GOD server code/config (wherever it lives — recon first) + the VPS's web
serving config for the new route. Does NOT touch `game/`, `web/` app code (except a
config constant if the depot URL changes), or meshgod's pipeline.
**For:** an Opus 4.8 session. **Pre-req:** LANE4 merged (it is — `9dd6824`).
**⚠️ This lane touches production boxes.** Work in small, reversible steps; keep a
rollback note for every change; if anything is ambiguous about the owner's infra,
STOP and ask rather than guess.

## Why now

The web toy reads props live from `digalot.fyi/3god`, and the whole point of Lane 3 is a
public shareable link. Two things stand between here and that link:

1. **3GOD is wide open** (PLAN.md flag, confirmed twice since): `GOD3_OPEN=1` means
   unauthenticated writes (upload/delete) via the tailnet origin, and `/api/fetch` has an
   SSRF hole (`server.py:173` — accepts `file://` and can reach cloud-metadata IPs).
   Fine as a private tool; not as the backing store of a public game.
2. **The web toy isn't deployed** — it only exists in the monorepo and on localhost.

## Deliverables

### A. Recon (do this first, report before changing anything)
- Locate the 3GOD deployment: which machine serves the origin `dealgod:8788`
  (tailnet 100.94.195.115), where `server.py` lives, how it's started (launchd/systemd/
  tmux/docker?), and how digalot.fyi (Cloudflare) routes `/3god` to it.
- Locate how thriftgod is served on digalot.fyi (same VPS? Caddy/nginx/static dir?) —
  the web toy should ride the same mechanism.
- Confirm current behavior as the baseline: CF `GET /3god/a/<file>` → 200 + CORS `*`;
  origin write w/o auth → accepted (open mode); `POST /api/fetch` with a `file://` URL →
  what does it return today?

### B. Harden 3GOD (writes closed, reads stay public)
1. **Close open mode:** run with `GOD3_OPEN` unset. Writes (upload/delete/fetch) must
   require the existing auth (`3g` HMAC cookie per `server.py::_push_3god` contract —
   set a real `GOD3_PW`). Store the password where meshgod's `push_3god.py` can read it
   (env/openrc-style file next to `open.txt`, gitignored) and verify a meshgod push still
   works WITH the password and 401/403s without.
2. **Plug the SSRF:** `/api/fetch` must allow-list schemes (`https` only) and reject
   private/metadata hosts (169.254.0.0/16, 10/8, 172.16/12, 192.168/16, localhost,
   `file://`, redirects re-checked after resolution). If fetch isn't actually needed for
   the game workflow, gate it behind auth entirely — simplest correct fix.
3. **Keep reads public:** `GET /a/<file>` and `GET /api/list` stay unauthenticated with
   CORS `*` — the web toy depends on them. Re-run the baseline checks after.
4. Commit the server changes to 3GOD's own repo with before/after curl transcripts in
   the commit message. Restart the service the same way it was started.

### C. Deploy the web toy
1. Serve the monorepo's `web/` at a stable URL on digalot.fyi (e.g. `digalot.fyi/destroy`
   or a subdomain — match however thriftgod is wired; static files, no build step).
   Simplest robust shape: a checkout/rsync of `web/` on the VPS + a deploy note in
   `web/README.md` saying exactly how to update it.
2. Verify from the public internet (not the tailnet): page loads, pointer lock works in
   normal Chrome; drag-look fallback works in an iframe; props load from the depot
   (network tab shows `/3god/a/*.glb` 200s); printer boss chunks; share button works.
   Test Safari too — it's the weakest target.
3. Confirm the offline mirror still covers a depot outage (block the depot host in
   devtools → toy still playable from `assets/`).

## Acceptance
- Unauthenticated write to the origin → 401/403. Authenticated meshgod push → lands.
- `POST /api/fetch` with `file:///etc/hosts` and `http://169.254.169.254/` → rejected.
- Public reads unchanged (CF GET 200 + CORS `*`), web toy loads its depot props publicly.
- The toy is live at its public URL, playable in Chrome + Safari, and the URL is posted
  in the final report along with the rollback notes.

## Out of scope
- Game content (office level etc.), balance, new mechanics.
- Cloudflare account/DNS changes beyond routing the existing zone.
- Rate limiting/CDN caching of the depot (note as a follow-up if reads look heavy).