Harden the Visual X# website origin boundary with explicit unknown-host rejection on HTTP and TLS, canonicalize duplicate www, docs, and spec origins while preserving paths and queries, restore complete cleartext redirects and ACME handling, and remove the retired Marked dependency and stale notices after the ViGet migration.

4 files changed, 38 insertions, 33 deletions

diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index 3963a8a..9ec88ce 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -11,18 +11,3 @@ The website self-hosts the following fonts from the Google Fonts repository:
 - Fira Sans, licensed under the SIL Open Font License 1.1. See `third_party/fonts/FiraSans-OFL.txt`.
 
 Consolas is referenced only through the CSS `local()` source. The font is not copied or distributed by this repository.
-
-## Marked
-
-The frontend uses [Marked](https://marked.js.org/) to render trusted package Markdown during the static Astro build.
-Marked is licensed under the MIT License.
-
-## ASP.NET Core Identity and Entity Framework Core
-
-The account service uses Microsoft ASP.NET Core Identity and Entity Framework Core. They are licensed under the MIT
-License.
-
-## Npgsql
-
-PostgreSQL access uses [Npgsql](https://www.npgsql.org/) and its Entity Framework Core provider. Npgsql is licensed
-under the PostgreSQL License.
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 562ebd9..a981af7 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -9,8 +9,7 @@
       "version": "1.0.0",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
-        "astro": "7.3.2",
-        "marked": "18.0.12"
+        "astro": "7.3.2"
       },
       "devDependencies": {
         "@astrojs/check": "0.9.9",
@@ -3536,18 +3535,6 @@
         "source-map-js": "^1.2.1"
       }
     },
-    "node_modules/marked": {
-      "version": "18.0.12",
-      "resolved": "https://registry.npmjs.org/marked/-/marked-18.0.12.tgz",
-      "integrity": "sha512-LEm4ga2YeI2T3GVHj9b0BaDPPk93LLTHMFeMyQbNIzPxc8vCI0y/scy0ZA6z6lXKyT9j9Nhl/OC6ZYKYGuFScA==",
-      "license": "MIT",
-      "bin": {
-        "marked": "bin/marked.js"
-      },
-      "engines": {
-        "node": ">= 20"
-      }
-    },
     "node_modules/mdast-util-to-hast": {
       "version": "13.2.1",
       "resolved": "https://registry.npmjs.org/mdast-util-to-hast/-/mdast-util-to-hast-13.2.1.tgz",
diff --git a/frontend/package.json b/frontend/package.json
index d53b284..0f7a6d8 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -11,8 +11,7 @@
     "check": "astro check"
   },
   "dependencies": {
-    "astro": "7.3.2",
-    "marked": "18.0.12"
+    "astro": "7.3.2"
   },
   "devDependencies": {
     "@astrojs/check": "0.9.9",
diff --git a/ops/nginx/xsharp.conf b/ops/nginx/xsharp.conf
index 78e70b9..20d1421 100644
--- a/ops/nginx/xsharp.conf
+++ b/ops/nginx/xsharp.conf
@@ -2,9 +2,43 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
 
 server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name _;
+    server_tokens off;
+
+    return 444;
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name xsharp-lang.xyz www.xsharp-lang.xyz docs.xsharp-lang.xyz spec.xsharp-lang.xyz;
+    server_tokens off;
+
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/lib/letsencrypt;
+        default_type text/plain;
+    }
+
+    location / {
+        return 308 https://xsharp-lang.xyz$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+    server_name _;
+    server_tokens off;
+
+    ssl_reject_handshake on;
+}
+
+server {
     listen 443 ssl;
     listen [::]:443 ssl;
-    server_name xsharp-lang.xyz docs.xsharp-lang.xyz spec.xsharp-lang.xyz;
+    server_name xsharp-lang.xyz;
 
     root /srv/xsharp/website/current/frontend;
     index index.html;
@@ -74,7 +108,7 @@ server {
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
-    server_name www.xsharp-lang.xyz;
+    server_name www.xsharp-lang.xyz docs.xsharp-lang.xyz spec.xsharp-lang.xyz;
     server_tokens off;
 
     ssl_certificate /etc/letsencrypt/live/xsharp-lang.xyz/fullchain.pem;