From 88a4af78ded9fecafbf942bbd38efb5f3a9bfce4 Mon Sep 17 00:00:00 2001
From: Dmitrii Creed <creeed22@gmail.com>
Date: Wed, 3 Jun 2026 00:48:18 +0400
Subject: [PATCH] fix(caddy): stop catch-all 503 page from leaking stack +
 operator runbook

The default catch-all 503 body printed the simple-container.com/caddyfile-entry
annotation name and a step-by-step operator remediation runbook to every
unauthenticated client that hit an unknown Host. That discloses the stack
(SC + Caddy + k8s) for attacker fingerprinting and publishes internal
remediation steps on the open internet.

Keep the page clearly recognizable as a 503 (English heading + copy,
consistent with the 404/500 pages) but strip the stack identifier and the
operator runbook. The HTTP 503 status, Retry-After, Cache-Control, and the
catch-all handle block are all unchanged, so CDN failover and uptime alerting
behave exactly as before (the win from #255 is preserved).

The operator runbook is not lost: it remains in the caddy.go default-503
rationale comment and the generate-caddyfile init-container logs, where only
operators can see it. A guard comment in the page warns against re-adding any
disclosure, since a public catch-all cannot authenticate the caller.

Signed-off-by: Dmitrii Creed <creeed22@gmail.com>
---
 .../pulumi/kubernetes/embed/caddy/pages/503.html  | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/pkg/clouds/pulumi/kubernetes/embed/caddy/pages/503.html b/pkg/clouds/pulumi/kubernetes/embed/caddy/pages/503.html
index 85412ecd..10e2d314 100644
--- a/pkg/clouds/pulumi/kubernetes/embed/caddy/pages/503.html
+++ b/pkg/clouds/pulumi/kubernetes/embed/caddy/pages/503.html
@@ -5,13 +5,18 @@
     h1 { font-size: 50px; }
     body { font: 20px Helvetica, sans-serif; color: #333; }
     article { display: block; text-align: left; width: 650px; margin: 0 auto; }
-    code { background: #eee; padding: 2px 6px; border-radius: 3px; font-size: 16px; }
 </style>
 
+<!--
+  Public-facing body only. Do NOT add operator runbooks, stack
+  identifiers (simple-container.com / Caddy / k8s annotations), or
+  remediation hints here: this catch-all answers every unknown Host for
+  unauthenticated clients and cannot distinguish an operator from an
+  attacker. The runbook for "no backend route for this Host" lives in
+  pkg/clouds/pulumi/kubernetes/caddy.go (default 503 block rationale)
+  and in the generate-caddyfile init-container logs.
+-->
 <article>
     <h1>503 Service Unavailable</h1>
-    <p>No backend route is configured for this host.</p>
-    <p>If you are an operator, verify the Service has the
-       <code>simple-container.com/caddyfile-entry</code> annotation and that
-       Caddy has been rolled.</p>
+    <p>This service is temporarily unavailable. Please try again in a few moments.</p>
 </article>