Redirect tazel.tala.run to tazel.net for good

Tazel has its own site at tazel.net, so tazel.tala.run no longer serves
the build system's pages from this build. Every request answers with a
permanent 308 redirect:

- /docs/commands and /docs/project-file go to their pages under
  tazel.net/docs/reference/, keeping the query string;
- any other page under /docs/ goes to tazel.net/docs;
- every other path goes to the same path on tazel.net.

The host keeps its HSTS header. The README and the comments of the
configuration name the four sites the build still serves.

2 files changed, 17 insertions, 46 deletions

diff --git a/README.md b/README.md
index 58fdf50..acddd64 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Gr
 # Tala website
 
 This repository owns the public language website at [tala.run](https://tala.run) and the documentation of the
-compiler and the build system at [talac.tala.run](https://talac.tala.run) and [tazel.tala.run](https://tazel.tala.run).
+compiler at [talac.tala.run](https://talac.tala.run). The build system has its own site, [tazel.net](https://tazel.net).
 It does not own
 Progmasoft's corporate or account sites. Tala uses its own supplied purple leopard SVG identity;
 the Progmasoft mark is a different brand.
@@ -19,7 +19,8 @@ One frontend build serves three sites and picks its pages from the host name:
   explains the design direction, `tala.run/docs/getting-started` links the real compiler checkout and toolchain, and
   `tala.run/docs/syntax` gives a first look at the syntax from the public specification.
 - `talac.tala.run/docs/command-line` and `talac.tala.run/docs/outputs` document the compiler.
-- `tazel.tala.run/docs/commands` and `tazel.tala.run/docs/project-file` document the build system.
+- `tazel.tala.run` redirects permanently to [tazel.net](https://tazel.net); its two pages go to
+  `tazel.net/docs/reference/commands` and `tazel.net/docs/reference/project-file`.
 - `forum.tala.run` is a standalone informational page. It is *not* a forum service; accounts and posts do not exist
   there yet. It stays noindex until a real community forum is launched.
 
diff --git a/ops/nginx/tala.conf b/ops/nginx/tala.conf
index 3b0cadd..2b75fdd 100644
--- a/ops/nginx/tala.conf
+++ b/ops/nginx/tala.conf
@@ -1,11 +1,12 @@
 # SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
 # SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
 
-# One frontend build serves five sites: tala.run for the language,
-# talac.tala.run for the compiler, tazel.tala.run for the build system,
-# talafmt.tala.run for the formatter and talalint.tala.run for the linter.
-# The page picks its content from the host name. xsharp-lang.xyz, the former
-# domain, answers with a permanent redirect to the same path on tala.run.
+# One frontend build serves four sites: tala.run for the language,
+# talac.tala.run for the compiler, talafmt.tala.run for the formatter and
+# talalint.tala.run for the linter. The page picks its content from the host
+# name. xsharp-lang.xyz, the former domain, answers with a permanent redirect to
+# the same path on tala.run. tazel.tala.run, where the build system was
+# documented, answers with a permanent redirect to tazel.net, its own site.
 
 server {
     listen 80 default_server;
@@ -116,7 +117,7 @@ server {
     }
 }
 
-# talac.tala.run, tazel.tala.run, talafmt.tala.run and talalint.tala.run serve
+# talac.tala.run, talafmt.tala.run and talalint.tala.run serve
 # the same build; each answers for robots.txt and sitemap.xml with its own file.
 server {
     listen 443 ssl;
@@ -303,9 +304,6 @@ server {
     listen [::]:443 ssl;
     http2 on;
     server_name tazel.tala.run;
-
-    root /srv/xsharp/website/current/frontend;
-    index index.html;
     server_tokens off;
 
     ssl_certificate /etc/letsencrypt/live/tala.run/fullchain.pem;
@@ -313,48 +311,20 @@ server {
     include /etc/letsencrypt/options-ssl-nginx.conf;
     ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
 
-    add_header Content-Security-Policy "default-src 'self'; img-src 'self' data:; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; object-src 'none'" always;
-    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
     add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-Frame-Options "DENY" always;
-
-    location = /robots.txt {
-        try_files /hosts/tazel/robots.txt =404;
-    }
 
-    location = /sitemap.xml {
-        try_files /hosts/tazel/sitemap.xml =404;
+    # The two pages of the old site have their own pages on tazel.net; any
+    # other page of its docs goes to the docs, everything else to the same path.
+    location ~ "^/docs/(commands|project-file)/?$" {
+        return 308 https://tazel.net/docs/reference/$1$is_args$args;
     }
 
-    location ^~ /hosts/ {
-        return 404;
-    }
-
-    location ^~ /api/ {
-        return 404;
+    location /docs/ {
+        return 308 https://tazel.net/docs;
     }
 
     location / {
-        try_files $uri $uri/ @application;
-    }
-
-    # The application has two kinds of routes: the landing page and
-    # /docs/<page>. Any other path that is not a file is answered with 404, so
-    # that unknown addresses, including the probes for /wp-login.php and
-    # friends, are not served as pages. The body of the 404 is still the
-    # application, whose router takes a visitor to the landing page.
-    location @application {
-        if ($uri !~ "^/(docs/[a-z0-9-]+/?)?$") {
-            return 404;
-        }
-        rewrite ^ /index.html break;
-    }
-
-    error_page 404 /index.html;
-
-    location ~ /\. {
-        deny all;
+        return 308 https://tazel.net$request_uri;
     }
 }