harden server, deduplicate CSS, fix layout and copy

- Parse templates once at startup instead of on every request

- Add security headers (X-Content-Type-Options, X-Frame-Options, etc.)

- Add per-request logging (IP, method, path, status, size, duration,

  referer, user-agent) — no PII in logs

- Add /healthz endpoint and graceful shutdown (SIGTERM)

- Validate waitlist emails and return proper errors on render failure

- Remove ~1700 lines of duplicate CSS appended to style.css

- Fix contribute grid (auto-fill → auto-fit for 3-card balance)

- Add accent color to contribute icons so SVGs are visible

- Center section headings, descriptions, waitlist form, and edition teaser

- Add Inter and JetBrains Mono Google Fonts

- Update hero and edition teaser copy to \"in development\"

- Add wget to Dockerfile for container healthcheck

- Point docker-compose healthcheck at /healthz

- Add .gitignore for build artifacts

Signed-off-by: Blake Ridgway <blake@blakeridgway.com>

.gitignore

@@ -0,0 +1,14 @@
+# Build artifacts
+arcline-landing
+landing
+
+# OS
+.DS_Store
+Thumbs.db
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+

Dockerfile

@@ -13,7 +13,7 @@ RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o landing .
 # ── Stage 2: Runtime ────────────────────────────────────────────────────────
 FROM alpine:3.21 AS runtime
 
-RUN apk add --no-cache ca-certificates && \
+RUN apk add --no-cache ca-certificates wget && \
     addgroup -S arcline && \
     adduser -S -G arcline arcline
 

docker-compose.yml

@@ -1,10 +1,3 @@
-# Arcline Project — Landing Page
-#
-# Deploy:    docker compose up -d
-# Stop:      docker compose down
-# Logs:      docker compose logs -f
-# Build:     docker compose build
-
 services:
   landing:
     build:
@@ -17,7 +10,7 @@ services:
     environment:
       - PORT=8080
     healthcheck:
-      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080"]
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/healthz"]
       interval: 30s
       timeout: 3s
       retries: 3

main.go

@@ -1,32 +1,158 @@
 package main
 
 import (
+	"context"
 	"html/template"
 	"log"
 	"net/http"
 	"os"
+	"os/signal"
+	"strings"
+	"syscall"
+	"time"
 )
 
+var templates = make(map[string]*template.Template)
+
+// contextKey is used to pass per-request log extras from handlers to the logging middleware.
+type contextKey struct{}
+type logContext struct{ extra string }
+
 func main() {
 	port := os.Getenv("PORT")
 	if port == "" {
 		port = "8080"
 	}
 
+	// Parse templates once at startup.
+	index, err := template.ParseFiles("templates/base.html", "templates/index.html")
+	if err != nil {
+		log.Fatalf("failed to parse index template: %v", err)
+	}
+	templates["index"] = index
+
+	waitlist, err := template.ParseFiles("templates/partials/waitlist_confirmation.html")
+	if err != nil {
+		log.Fatalf("failed to parse waitlist template: %v", err)
+	}
+	templates["waitlist"] = waitlist
+
+	mux := http.NewServeMux()
+
 	// Serve static assets
 	fs := http.FileServer(http.Dir("static"))
-	http.Handle("/static/", http.StripPrefix("/static/", fs))
+	mux.Handle("/static/", http.StripPrefix("/static/", fs))
 
 	// Page routes
-	http.HandleFunc("/", handleIndex)
+	mux.HandleFunc("/", handleIndex)
+	mux.HandleFunc("/healthz", handleHealthz)
 
 	// HTMX partial routes
-	http.HandleFunc("/partials/waitlist", handleWaitlist)
+	mux.HandleFunc("/partials/waitlist", handleWaitlist)
+
+	// Wrap with logging (outermost) and security headers (innermost).
+	handler := loggingMiddleware(securityHeaders(mux))
+
+	srv := &http.Server{
+		Addr:         ":" + port,
+		Handler:      handler,
+		ReadTimeout:  10 * time.Second,
+		WriteTimeout: 30 * time.Second,
+		IdleTimeout:  60 * time.Second,
+	}
+
+	// Graceful shutdown on SIGINT / SIGTERM.
+	go func() {
+		sig := make(chan os.Signal, 1)
+		signal.Notify(sig, syscall.SIGINT, syscall.SIGTERM)
+		<-sig
+		log.Println("shutting down…")
+		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
+		if err := srv.Shutdown(ctx); err != nil {
+			log.Printf("shutdown error: %v", err)
+		}
+	}()
 
 	log.Printf("Arcline Project server starting on :%s", port)
-	if err := http.ListenAndServe(":"+port, nil); err != nil {
+	if err := srv.ListenAndServe(); err != http.ErrServerClosed {
 		log.Fatalf("server failed: %v", err)
 	}
+	log.Println("server stopped")
+}
+
+// securityHeaders adds basic security headers to every response.
+func securityHeaders(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		w.Header().Set("X-Frame-Options", "DENY")
+		w.Header().Set("Referrer-Policy", "no-referrer")
+		w.Header().Set("Permissions-Policy", "camera=(), microphone=(), geolocation=()")
+		next.ServeHTTP(w, r)
+	})
+}
+
+// responseWriter wraps http.ResponseWriter to capture the status code and bytes written.
+type responseWriter struct {
+	http.ResponseWriter
+	status int
+	bytes  int
+}
+
+func (rw *responseWriter) WriteHeader(code int) {
+	rw.status = code
+	rw.ResponseWriter.WriteHeader(code)
+}
+
+func (rw *responseWriter) Write(b []byte) (int, error) {
+	if rw.status == 0 {
+		rw.status = http.StatusOK
+	}
+	n, err := rw.ResponseWriter.Write(b)
+	rw.bytes += n
+	return n, err
+}
+
+// loggingMiddleware logs every request with IP, method, path, status, size, duration, referer, and user-agent.
+func loggingMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		lc := &logContext{}
+		ctx := context.WithValue(r.Context(), contextKey{}, lc)
+		r = r.WithContext(ctx)
+
+		start := time.Now()
+		rw := &responseWriter{ResponseWriter: w, status: 0}
+		next.ServeHTTP(rw, r)
+
+		ip := r.RemoteAddr
+		if fwd := r.Header.Get("X-Forwarded-For"); fwd != "" {
+			ip = fwd
+		}
+
+		ref := r.Referer()
+		if ref == "" {
+			ref = "-"
+		}
+
+		ua := r.UserAgent()
+		if ua == "" {
+			ua = "-"
+		}
+
+		duration := time.Since(start)
+
+		if lc.extra != "" {
+			log.Printf("%s %s %s → %d (%dB) %v ref:%q ua:%q | %s", ip, r.Method, r.URL.Path, rw.status, rw.bytes, duration, ref, ua, lc.extra)
+		} else {
+			log.Printf("%s %s %s → %d (%dB) %v ref:%q ua:%q", ip, r.Method, r.URL.Path, rw.status, rw.bytes, duration, ref, ua)
+		}
+	})
+}
+
+func handleHealthz(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	w.WriteHeader(http.StatusOK)
+	w.Write([]byte("ok"))
 }
 
 func handleIndex(w http.ResponseWriter, r *http.Request) {
@@ -35,20 +161,13 @@ func handleIndex(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	tmpl, err := template.ParseFiles("templates/base.html", "templates/index.html")
-	if err != nil {
-		log.Printf("template error: %v", err)
-		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
-		return
-	}
-
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	data := map[string]interface{}{
 		"Title": "Arcline Project",
 	}
-
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	if err := tmpl.ExecuteTemplate(w, "base", data); err != nil {
+	if err := templates["index"].ExecuteTemplate(w, "base", data); err != nil {
 		log.Printf("render error: %v", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
 	}
 }
 
@@ -58,23 +177,25 @@ func handleWaitlist(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	email := r.FormValue("email")
-
-	// Parse edition preferences (checkboxes with same name)
-	r.ParseForm()
-	editions := r.Form["edition"]
-	log.Printf("Waitlist signup: %s | editions: %v", email, editions)
-
-	tmpl, err := template.ParseFiles("templates/partials/waitlist_confirmation.html")
-	if err != nil {
-		log.Printf("template error: %v", err)
-		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, "Bad Request", http.StatusBadRequest)
 		return
 	}
 
+	email := strings.TrimSpace(r.FormValue("email"))
+	if email == "" || !strings.Contains(email, "@") {
+		http.Error(w, "Invalid email address", http.StatusBadRequest)
+		return
+	}
+
+	// Signal the logging middleware that this was a waitlist signup.
+	if lc, ok := r.Context().Value(contextKey{}).(*logContext); ok {
+		lc.extra = "signup"
+	}
+
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	if err := tmpl.Execute(w, map[string]string{"Email": email}); err != nil {
+	if err := templates["waitlist"].Execute(w, map[string]string{"Email": email}); err != nil {
 		log.Printf("render error: %v", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
 	}
 }
-

templates/base.html

@@ -6,6 +6,9 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>{{.Title}}</title>
     <link rel="icon" type="image/svg+xml" href="/static/favicon.svg">
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=Inter:opsz,wght@14..32,400..700&amp;family=JetBrains+Mono:ital,wght@0,400..700;1,400..700&amp;display=swap" rel="stylesheet">
     <link rel="stylesheet" href="/static/css/style.css">
     <script src="/static/js/htmx.min.js"></script>
 </head>

templates/index.html

@@ -22,7 +22,6 @@
     <!-- Hero -->
     <section class="hero">
         <div class="hero-inner">
-            <div class="hero-kicker">arcline os — alpha</div>
             <h1>
                 The Linux OS for<br>
                 <span class="hero-highlight">people who run infrastructure.</span>
@@ -181,7 +180,7 @@
                 </div>
             </div>
             <div class="edition-teaser">
-                <div class="edition-teaser-badge">// also in the works</div>
+                <div class="edition-teaser-badge">// arcline workstation — in development</div>
                 <p>
                     <strong>Arcline Workstation</strong> — same hardened base, with a lightweight KDE Plasma desktop,
                     pre-configured dev toolchains, and privacy-hardened browser profiles.