From 3b49a91c82b9cb146d4b0e8b7a4ddaf404a44015 Mon Sep 17 00:00:00 2001
From: Dmitrii Creed <creeed22@gmail.com>
Date: Mon, 8 Jun 2026 15:38:06 +0400
Subject: [PATCH] fix(caddy): stop 503 page HTML comment from re-leaking the
 stack identity
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#308 replaced the visible 503 body but left a maintainer guard comment in the
served HTML that named the stack (simple-container.com / Caddy / k8s) and an
internal source path. HTML comments ship in the response body, so this
re-disclosed to unauthenticated clients the exact fingerprint #308 removed
from the visible text.

Replace it with a generic one-liner that names nothing (and notes that
comments are served), and move the detailed rationale — including the
'comments are served too' lesson — into the caddy.go default-503 block, which
is source and never served.

Signed-off-by: Dmitrii Creed <creeed22@gmail.com>
---
 pkg/clouds/pulumi/kubernetes/caddy.go                  |  8 ++++++++
 .../pulumi/kubernetes/embed/caddy/pages/503.html       | 10 +---------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkg/clouds/pulumi/kubernetes/caddy.go b/pkg/clouds/pulumi/kubernetes/caddy.go
index ab7cebb6..2d00f856 100644
--- a/pkg/clouds/pulumi/kubernetes/caddy.go
+++ b/pkg/clouds/pulumi/kubernetes/caddy.go
@@ -123,6 +123,14 @@ func DeployCaddyService(ctx *sdk.Context, caddy CaddyDeployment, input api.Resou
 	// - Operators can override the 503 body by mounting a different ConfigMap
 	//   at /etc/caddy/pages/503.html without touching SC api code.
 	//
+	// Keep pages/503.html generic — it answers every unknown Host for
+	// unauthenticated clients, which cannot be distinguished from operators.
+	// No stack identifiers, internal paths, or remediation runbooks in the
+	// body OR in HTML comments (comments ship in the response too — that was
+	// the bug behind this very page once leaking the caddyfile-entry runbook).
+	// The operator runbook for "no backend route for this Host" is this
+	// comment block plus the generate-caddyfile init-container logs.
+	//
 	// Wrapped in `handle { ... }` so the directives below apply only to the
 	// 503 path and nothing else can short-circuit (e.g. `import hsts` redir
 	// firing before the response). We also intentionally do NOT `import hsts`
diff --git a/pkg/clouds/pulumi/kubernetes/embed/caddy/pages/503.html b/pkg/clouds/pulumi/kubernetes/embed/caddy/pages/503.html
index 10e2d314..1df5931e 100644
--- a/pkg/clouds/pulumi/kubernetes/embed/caddy/pages/503.html
+++ b/pkg/clouds/pulumi/kubernetes/embed/caddy/pages/503.html
@@ -7,15 +7,7 @@
     article { display: block; text-align: left; width: 650px; margin: 0 auto; }
 </style>
 
-<!--
-  Public-facing body only. Do NOT add operator runbooks, stack
-  identifiers (simple-container.com / Caddy / k8s annotations), or
-  remediation hints here: this catch-all answers every unknown Host for
-  unauthenticated clients and cannot distinguish an operator from an
-  attacker. The runbook for "no backend route for this Host" lives in
-  pkg/clouds/pulumi/kubernetes/caddy.go (default 503 block rationale)
-  and in the generate-caddyfile init-container logs.
--->
+<!-- Served to unauthenticated clients on any unknown host. Keep generic: no internal, infrastructure, or diagnostic detail (this comment ships in the response). -->
 <article>
     <h1>503 Service Unavailable</h1>
     <p>This service is temporarily unavailable. Please try again in a few moments.</p>