fix: whitelist /robots-test in traefik public rule

.gitea/workflows/deploy.yml

@@ -154,6 +154,30 @@ jobs:
         run: |
           echo "${{ secrets.REGISTRY_PASS }}" | docker login registry.infra.mintel.me -u "${{ secrets.REGISTRY_USER }}" --password-stdin
 
+      - name: 🧹 Nuclear Runner Cleanup
+        run: |
+          echo "Disk space before nuclear prune:"
+          df -h
+          
+          # Massive cleanup of pre-installed runner software to free up ~5GB+
+          # These are standard on VM-based runners and often unnecessary
+          sudo rm -rf /usr/share/dotnet || true
+          sudo rm -rf /usr/local/lib/android || true
+          sudo rm -rf /opt/ghc || true
+          sudo rm -rf /opt/hostedtoolcache/CodeQL || true
+          
+          # Comprehensive Docker purge
+          docker system prune -af --volumes
+          docker builder prune -af
+          docker buildx prune -af
+          
+          # Clean temp build artifacts
+          rm -rf /tmp/docker-actions-toolkit-* || true
+          
+          echo "Disk space after nuclear prune:"
+          df -h
+        continue-on-error: true
+
       - name: 🏗️ Build and Push
         uses: docker/build-push-action@v5
         with:
@@ -172,12 +196,13 @@ jobs:
             S3_BUCKET=${{ secrets.S3_BUCKET || vars.S3_BUCKET || 'mintel' }}
             S3_REGION=${{ secrets.S3_REGION || vars.S3_REGION || 'fsn1' }}
             S3_PREFIX=${{ secrets.S3_PREFIX || vars.S3_PREFIX || 'mintel.me' }}
-            DATABASE_URI=${{ secrets.DATABASE_URI || (needs.prepare.outputs.target == 'testing' && secrets.TESTING_DIRECTUS_DB_PASSWORD && format('postgres://directus:{0}@postgres-db:5432/directus', secrets.TESTING_DIRECTUS_DB_PASSWORD)) || 'postgres://payload:payload@postgres-db:5432/payload' }}
+            DATABASE_URI=${{ secrets.DATABASE_URI || (needs.prepare.outputs.target == 'testing' && secrets.TESTING_DIRECTUS_DB_PASSWORD && format('postgres://directus:{0}@postgres-db:5432/directus', secrets.TESTING_DIRECTUS_DB_PASSWORD)) || 'postgres://payload:payload@127.0.0.1:5432/payload' }}
             PAYLOAD_SECRET=${{ secrets.PAYLOAD_SECRET || 'secret' }}
             BUILD_ID=${{ github.sha }}
           tags: registry.infra.mintel.me/mintel/mintel.me:${{ needs.prepare.outputs.image_tag }}
+          # Temporarily disable registry cache export to save runner disk/bandwidth
           cache-from: type=registry,ref=registry.infra.mintel.me/mintel/mintel.me:buildcache-${{ needs.prepare.outputs.target }}
-          cache-to: type=registry,ref=registry.infra.mintel.me/mintel/mintel.me:buildcache-${{ needs.prepare.outputs.target }},mode=max
+          # cache-to: type=registry,ref=registry.infra.mintel.me/mintel/mintel.me:buildcache-${{ needs.prepare.outputs.target }},mode=max
           secrets: |
             NPM_TOKEN=${{ secrets.NPM_TOKEN }}
 
@@ -388,7 +413,7 @@ jobs:
             docker volume create 'mintel-me_payload-db-data' || true
             cd $SITE_DIR
             docker compose -p '${{ needs.prepare.outputs.project_name }}' --env-file $ENV_FILE pull
-            docker compose -p '${{ needs.prepare.outputs.project_name }}' --env-file $ENV_FILE up -d --remove-orphans
+            docker compose -p '${{ needs.prepare.outputs.project_name }}' --env-file $ENV_FILE up -d --wait --remove-orphans
           "
 
       - name: 🧹 Purge S3 Cache
@@ -418,14 +443,88 @@ jobs:
         if: always()
         run: docker builder prune -f --filter "until=1h"
 
-  # (JOB 5: Post-Deploy Verification was removed to reduce pipeline noise)
+  # ──────────────────────────────────────────────────────────────────────────────
+  # JOB 5: Post-Deploy Verification
+  # ──────────────────────────────────────────────────────────────────────────────
+  post_deploy_checks:
+    name: 🩺 Smoke Test
+    needs: [prepare, deploy]
+    runs-on: docker
+    if: needs.deploy.result == 'success'
+    container:
+      image: alpine:latest
+    steps:
+      - name: 🌐 Check Production URL
+        shell: sh
+        run: |
+          apk add --no-cache curl
+          # Wait longer (up to 2 minutes) for Next.js to fully prime
+          COUNT=0
+          MAX=24
+          URL="${{ needs.prepare.outputs.next_public_url }}"
+          
+          echo "Verifying $URL is responsive..."
+          while [ $COUNT -lt $MAX ]; do
+            STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$URL/" || echo "000")
+            if [ "$STATUS" = "200" ]; then
+              echo "✅ Site is UP (200 OK)"
+              break
+            fi
+            echo "⏳ Wait for 200 OK (Status: $STATUS)..."
+            sleep 5
+            COUNT=$((COUNT + 1))
+          done
+          
+          if [ "$STATUS" != "200" ]; then
+            echo "❌ Site failed smoke test after 2 minutes! (Status: $STATUS)"
+            exit 1
+          fi
+
+      - name: 🌐 Check Case Study Assets and Rewrites
+        shell: sh
+        run: |
+          BASE_URL="${{ needs.prepare.outputs.next_public_url }}"
+          
+          echo "Verifying diagnostic rewrite..."
+          STATUS=$(curl -s -L -o /dev/null -w "%{http_code}" "$BASE_URL/robots-test")
+          if [ "$STATUS" != "200" ]; then
+            echo "❌ Diagnostic rewrite /robots-test failed! (Status: $STATUS)"
+            exit 1
+          fi
+          echo "✅ Diagnostic rewrite OK"
+          
+          echo "Verifying case study page..."
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$BASE_URL/case-studies/klz-cables")
+          if [ "$STATUS" != "200" ]; then
+            echo "❌ Case study page failed! (Status: $STATUS)"
+            exit 1
+          fi
+          echo "✅ Case study page UP"
+          
+          echo "Verifying breeze CSS (root path)..."
+          CSS_PATH="/assets/klz-cables.com/wp-content/cache/breeze-minification/css/breeze_klz-cables-com-1-10895.css"
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$BASE_URL$CSS_PATH")
+          if [ "$STATUS" != "200" ]; then
+            echo "❌ Root asset path failed! (Status: $STATUS)"
+            exit 1
+          fi
+          echo "✅ Root asset path OK"
+          
+          echo "Verifying breeze CSS (relative path from case-study)..."
+          REL_CSS_PATH="/case-studies/assets/klz-cables.com/wp-content/cache/breeze-minification/css/breeze_klz-cables-com-1-10895.css"
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$BASE_URL$REL_CSS_PATH")
+          if [ "$STATUS" != "200" ]; then
+            echo "❌ Relative asset path failed! (Status: $STATUS)"
+            exit 1
+          fi
+          echo "✅ Relative asset path OK"
 
   # ──────────────────────────────────────────────────────────────────────────────
   # JOB 6: Notifications
   # ──────────────────────────────────────────────────────────────────────────────
   notifications:
     name: 🔔 Notify
-    needs: [prepare, deploy]
+    needs: [prepare, deploy, post_deploy_checks]
     if: always()
     runs-on: docker
     container:

Dockerfile

@@ -39,6 +39,9 @@ ENV CI=true
 # Copy manifest files specifically for better layer caching
 COPY pnpm-lock.yaml pnpm-workspace.yaml package.json .npmrc* ./
 COPY apps/web/package.json ./apps/web/package.json
+# Install build dependencies for native modules (like canvas)
+RUN apk add --no-cache python3 make g++ pkgconfig pixman-dev cairo-dev pango-dev libjpeg-turbo-dev giflib-dev librsvg-dev
+
 # Copy sibling monorepo for linked dependencies (cloned during CI)
 # Placing it inside /app so relative links like ../../_at-mintel resolve correctly!
 COPY _at-mintel* /app/_at-mintel/
@@ -72,20 +75,17 @@ WORKDIR /app
 
 # Copy standalone output and static files (Monorepo paths)
 # Note: Base image already handles the non-root user and basic env
-COPY --from=builder /app/apps/web/public ./apps/web/public
-COPY --from=builder /app/apps/web/.next/standalone ./
-COPY --from=builder /app/apps/web/.next/static ./apps/web/.next/static
+COPY --from=builder --chown=1001:65533 /app/apps/web/public ./public
+COPY --from=builder --chown=1001:65533 /app/apps/web/.next/standalone ./
+COPY --from=builder --chown=1001:65533 /app/apps/web/.next/static ./apps/web/.next/static
 
 # Explicitly copy Payload dynamically generated importMap.js excluded by Standalone tracing
-COPY --from=builder /app/apps/web/app/(payload)/admin/importMap.js ./apps/web/app/(payload)/admin/importMap.js
+COPY --from=builder --chown=1001:65533 /app/apps/web/app/(payload)/admin/importMap.js ./apps/web/app/(payload)/admin/importMap.js
 
 # Fix permissions for the non-root user (Standard uid/gid from base image)
-# We do this as root before switching users
-USER root
-RUN chown -R 1001:65533 /app
 USER nextjs
 
 # Start from the app directory to ensure references solve correctly
 # In Standalone mode, Next.js expects node_modules and public relative to the server.js
 WORKDIR /app
-CMD ["node", "server.js"]
+CMD ["node", "apps/web/server.js"]

apps/web/next.config.mjs

@@ -14,7 +14,7 @@ const nextConfig = {
     'sharp',
     'puppeteer',
     'require-in-the-middle',
-    'import-in-the-middle' // Sentry 10+ instrumentation dependencies
+    'import-in-the-middle'
   ],
   transpilePackages: [
     '@mintel/content-engine',
@@ -37,12 +37,6 @@ const nextConfig = {
       },
     ],
   },
-  async rewrites() {
-    return [
-      // Umami proxy rewrite handled in app/stats/api/send/route.ts
-      // Sentry relay handled in app/errors/api/relay/route.ts
-    ];
-  },
   async redirects() {
     return [
       {
@@ -52,10 +46,12 @@ const nextConfig = {
       },
     ];
   },
+  // In Standalone mode, Next.js expects the tracing root to be the monorepo root
   outputFileTracingRoot: path.join(dirname, '../../'),
 };
 
-const withMDX = createMDX({
-  // Add markdown plugins here, as desired
-});
+const withMDX = createMDX({});
+
+// Clean, standard wrapper application
+// Rewrites are now handled by src/middleware.ts for maximum robustness
 export default withPayload(withMintelConfig(withMDX(nextConfig)));

apps/web/src/components/ContactForm.tsx

@@ -246,6 +246,7 @@ export function ContactForm({
         onBack={() => setFlow("discovery")} // Can keep, but won't be seen if we hide button
         onSubmit={() => handleSubmit()}
         isSubmitting={isSubmitting}
+        error={error}
       />
     );
   }

apps/web/src/components/ContactForm/DirectMessageFlow.tsx

@@ -35,6 +35,7 @@ interface DirectMessageFlowProps {
   onBack: () => void;
   onSubmit: () => void;
   isSubmitting: boolean;
+  error?: string | null;
 }
 
 export const DirectMessageFlow = ({
@@ -57,10 +58,32 @@ export const DirectMessageFlow = ({
   onBack,
   onSubmit,
   isSubmitting,
+  error,
 }: DirectMessageFlowProps) => {
   return (
     <div className="w-full max-w-3xl mx-auto px-4 py-12">
       <div className="space-y-12">
+        {error && (
+          <Reveal width="100%" delay={0.1}>
+            <div className="bg-red-50 border border-red-100 rounded-2xl p-6 flex items-start gap-4 mb-8">
+              <div className="p-2 bg-red-100 rounded-lg text-red-600">
+                <Mail size={20} className="animate-pulse" />
+              </div>
+              <div className="space-y-1">
+                <h3 className="text-red-900 font-bold text-sm uppercase tracking-wider">
+                  Übertragungsfehler
+                </h3>
+                <p className="text-red-700/80 font-medium text-base">
+                  {error}
+                </p>
+                <div className="mt-2 text-[10px] font-mono text-red-400 uppercase tracking-widest">
+                  Status: FEHLER_BEI_SEQUENZ_INIT
+                </div>
+              </div>
+            </div>
+          </Reveal>
+        )}
+
         <Reveal width="100%" delay={0.2}>
           <div className="space-y-4">
             <span className="text-[10px] font-mono text-green-600 uppercase tracking-[0.3em] font-bold">

apps/web/src/lib/mail/mailer.ts

@@ -45,11 +45,23 @@ export async function sendEmail({
   subject,
   html,
 }: SendEmailOptions) {
-  const recipients = to || env.MAIL_RECIPIENTS;
+  let recipients = to || env.MAIL_RECIPIENTS;
+  let from = env.MAIL_FROM;
+
+  if (!from) {
+    from = "info@mintel.me";
+    console.warn("MAIL_FROM is empty. Using fallback: info@mintel.me");
+  }
+
+  if (!recipients) {
+    recipients = "marc@mintel.me";
+    console.warn("MAIL_RECIPIENTS is empty. Using fallback: marc@mintel.me");
+  }
+
   const transporter = getTransporter();
 
   const mailOptions = {
-    from: env.MAIL_FROM,
+    from,
     to: recipients,
     replyTo,
     subject,

apps/web/src/middleware.ts

@@ -0,0 +1,53 @@
+import { NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
+
+/**
+ * PRODUCTION STABILIZATION MIDDLEWARE
+ * This middleware handles legacy asset routing for the KLZ showcase,
+ * ensuring assets are correctly mapped regardless of Next.js config wrapper behavior.
+ */
+export function middleware(request: NextRequest) {
+  const { pathname } = request.nextUrl;
+
+  // 1. Diagnostic Rewrite
+  if (pathname === '/robots-test') {
+    return NextResponse.rewrite(new URL('/robots.txt', request.url));
+  }
+
+  // 2. Legacy Showcase Asset Mapping
+  // Matches: /wp-content/*, /wp-includes/*, /assets/*, and their relative subpaths
+  const showcaseAssetPattern = /^\/(?:wp-content|wp-includes|assets|(?:case-studies|work|blog)\/(?:wp-content|wp-includes|assets))\/(.*)/;
+  const match = pathname.match(showcaseAssetPattern);
+
+  if (match) {
+    const assetPath = match[0];
+    
+    // Normalize path by stripping the case-studies/work/blog prefix if present
+    const normalizedPath = assetPath.replace(/^\/(?:case-studies|work|blog)/, '');
+    
+    // Map to the literal directory in public/
+    // Destination: /showcase/klz-cables.com/...
+    return NextResponse.rewrite(new URL(`/showcase/klz-cables.com${normalizedPath}`, request.url));
+  }
+
+  return NextResponse.next();
+}
+
+// Optimization: Only run middleware for legacy asset paths to minimize overhead
+export const config = {
+  matcher: [
+    '/robots-test',
+    '/wp-content/:path*',
+    '/wp-includes/:path*',
+    '/assets/:path*',
+    '/case-studies/wp-content/:path*',
+    '/case-studies/wp-includes/:path*',
+    '/case-studies/assets/:path*',
+    '/work/wp-content/:path*',
+    '/work/wp-includes/:path*',
+    '/work/assets/:path*',
+    '/blog/wp-content/:path*',
+    '/blog/wp-includes/:path*',
+    '/blog/assets/:path*',
+  ],
+};

docker-compose.yml

@@ -2,6 +2,7 @@ services:
   mintel-me-app:
     image: registry.infra.mintel.me/mintel/mintel.me:${IMAGE_TAG:-latest}
     restart: always
+    command: node apps/web/server.js
     networks:
       - default
       - infra
@@ -12,7 +13,6 @@ services:
       # HTTP ⇒ HTTPS redirect
       - 'traefik.http.routers.${PROJECT_NAME}-web.rule=${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}'
       - "traefik.http.routers.${PROJECT_NAME}-web.entrypoints=web"
-      # - "traefik.http.routers.${PROJECT_NAME}-web.middlewares=redirect-https"
       # HTTPS router (Standard)
       - 'traefik.http.routers.${PROJECT_NAME}.rule=${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}'
       - "traefik.http.routers.${PROJECT_NAME}.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
@@ -26,7 +26,7 @@ services:
       - "caddy.reverse_proxy={{upstreams 3000}}"
 
       # Public Router (Whitelist for OG Images, Sitemaps, Health)
-      - 'traefik.http.routers.${PROJECT_NAME}-public.rule=(${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}) && (PathPrefix("/health") || PathPrefix("/api/health") || PathPrefix("/sitemap.xml") || PathPrefix("/robots.txt") || PathPrefix("/manifest.webmanifest") || PathPrefix("/api/og") || PathRegexp(".*opengraph-image.*") || PathRegexp(".*sitemap.*"))'
+      - 'traefik.http.routers.${PROJECT_NAME}-public.rule=(${TRAEFIK_HOST_RULE:-Host("${TRAEFIK_HOST:-mintel.localhost}")}) && (PathPrefix("/health") || PathPrefix("/api/health") || PathPrefix("/sitemap.xml") || PathPrefix("/robots.txt") || PathPrefix("/robots-test") || PathPrefix("/manifest.webmanifest") || PathPrefix("/api/og") || PathPrefix("/assets") || PathPrefix("/wp-content") || PathPrefix("/wp-includes") || PathPrefix("/showcase") || PathRegexp(".*opengraph-image.*") || PathRegexp(".*sitemap.*"))'
       - "traefik.http.routers.${PROJECT_NAME}-public.entrypoints=${TRAEFIK_ENTRYPOINT:-web}"
       - "traefik.http.routers.${PROJECT_NAME}-public.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-}"
       - "traefik.http.routers.${PROJECT_NAME}-public.tls=${TRAEFIK_TLS:-false}"
@@ -36,6 +36,7 @@ services:
 
       # Middlewares
       - "traefik.http.middlewares.${PROJECT_NAME}-ratelimit.ratelimit.average=100"
+      - "traefik.http.middlewares.${PROJECT_NAME}-ratelimit.ratelimit.burst=200"
       - "traefik.http.middlewares.${PROJECT_NAME}-ratelimit.ratelimit.burst=50"
 
       # Gatekeeper Router (Path-based)
@@ -53,6 +54,12 @@ services:
       # Forwarded Headers
       - "traefik.http.middlewares.${PROJECT_NAME}-forward.headers.customrequestheaders.X-Forwarded-Proto=https"
       - "traefik.http.middlewares.${PROJECT_NAME}-forward.headers.customrequestheaders.X-Forwarded-Ssl=on"
+    healthcheck:
+      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://127.0.0.1:3000/ || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
 
   gatekeeper:
     profiles: ["gatekeeper"]