Add robots.txt (block /admin + /go), go-live staging checklist (GOLIVE.md)

fee7e914fb7e1142cdf7612811d8ca78595315f1 · 2026-08-01 11:26:15 -0700 · Steve Abrams

Files touched

A GOLIVE.md
M server.js

Diff

commit fee7e914fb7e1142cdf7612811d8ca78595315f1
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat Aug 1 11:26:15 2026 -0700

    Add robots.txt (block /admin + /go), go-live staging checklist (GOLIVE.md)
---
 GOLIVE.md | 30 ++++++++++++++++++++++++++++++
 server.js |  6 ++++++
 2 files changed, 36 insertions(+)

diff --git a/GOLIVE.md b/GOLIVE.md
new file mode 100644
index 0000000..eed6b5e
--- /dev/null
+++ b/GOLIVE.md
@@ -0,0 +1,30 @@
+# Go-Live Checklist — interiordesignershowroom.com
+
+Status: **STAGED — awaiting Steve's approval.** Nothing below has been executed.
+The site runs locally under pm2 `interiordesignershowroom` on `:9861`.
+
+## Prereqs (Steve's, gated)
+- [ ] Decide to commit the premium `.com` to this build (overrides the "premium .coms are assets to sell" rule — you chose *Go live on the .com*).
+- [ ] Affiliate accounts + creds (feeds stay empty until these land):
+  - [x] CJ company id `7896980` (recorded in `.env`)
+  - [ ] `CJ_TOKEN` (Developer PAT, developers.cj.com) + `CJ_WEBSITE_ID` (PID)
+  - [ ] Amazon Associates: `AMAZON_ACCESS_KEY` / `AMAZON_SECRET_KEY` / `AMAZON_PARTNER_TAG` (needs live site first)
+  - [ ] Rakuten: `RAKUTEN_CLIENT_ID` / `RAKUTEN_CLIENT_SECRET` / `RAKUTEN_SCOPE`
+  - [ ] ShareASale: `SHAREASALE_AFFILIATE_ID` / `SHAREASALE_API_TOKEN` / `SHAREASALE_API_SECRET`
+
+## Deploy steps (I run on your go)
+1. **Cloudflare zone** for interiordesignershowroom.com (via cloudflare-dns MCP / domain-setup skill).
+2. **NS swap** at the registrar → Cloudflare nameservers; clean stale/parking records.
+3. **Kamatera**: rsync repo to `/root/Projects/interiordesignershowroom`, `npm ci`, create the `idshowroom` PG DB + load `db/schema.sql`, `node scripts/seed.js` (or first real `ingest` once creds exist), `pm2 start` on `PORT=9861`, `pm2 save`.
+4. **Let's Encrypt SSL** (certbot) on the origin; CF proxy (orange cloud) on.
+5. **DNS**: `A`/`CNAME` root + `www` → Kamatera origin, proxied.
+6. **Smoke test**: `/healthz` 200, `/` renders, `/sitemap.xml`, `/robots.txt`, a `/go/:id` 302.
+7. **Post-live**: submit sitemap to Google Search Console; then apply to CJ/Rakuten/ShareASale/Amazon with the live URL.
+
+## Rollback
+- pm2 process stop + CF DNS record removal. No destructive data ops (fresh DB).
+
+## Guardrails honored
+- FTC disclosure on every page; `/admin` + `/go/` disallowed in robots.txt.
+- `.env` gitignored; no secrets in the repo.
+- Deploy runs through `.deploy.conf` (PROJECT_NAME/DEPLOY_PATH/HEALTH_URL/PORT set).
diff --git a/server.js b/server.js
index e1cc6b6..e663fdc 100644
--- a/server.js
+++ b/server.js
@@ -161,6 +161,12 @@ app.get('/privacy', (_req, res) => {
   res.send(layout({ title: 'Privacy', description: 'Privacy practices for Interior Designer’s Showroom.', canonical: `${SITE.url}/privacy`, body }));
 });
 
+app.get('/robots.txt', (_req, res) => {
+  // Let crawlers index content; keep them out of the admin + the affiliate redirects
+  // (Google dislikes crawling long chains of sponsored/nofollow go-through links).
+  res.type('text/plain').send(`User-agent: *\nAllow: /\nDisallow: /admin\nDisallow: /go/\n\nSitemap: ${SITE.url}/sitemap.xml\n`);
+});
+
 app.get('/sitemap.xml', async (_req, res, next) => {
   try {
     const { rows: guides } = await db.query(`SELECT slug, updated_at FROM guides WHERE published`);

← 5637f88 Add gated /admin curation dashboard + dotenv env loading · back to Interiordesignershowroom · auto-save: 2026-08-01T11:36:26 (2 files) — server.js lib/cat 86a89da →