← board

Canonical domain in the docs

Why

The domain is the trust anchor. Against impersonation it beats every technical measure: people check the address bar, not the source repo. Naming it canonically — in the docs, the README, the installers, the release notes — is what makes a fake look wrong to a user who has seen the real one. Cheap, high leverage, do it early so it propagates everywhere by default.

Scope

Do NOW (independent of the site being live) — user action

REJECTED 2026-08-09 by the user — see [[chore-register-pxxc-domain-variants]]. The premise below is out of date: pxxc.com was already registered by someone else (parked on non-responding nameservers) before this ticket was written, so there was no gap left to close cheaply. pxxc.nl/.eu are still free; the user does not want them. Original reasoning kept for the record:

Register the variants of pxxc. This is the one item that gets harder with time: once the project is visible, squatters watch for exactly this gap.

Do WHEN LIVE

  1. DONE 2026-08-09. pxxc.org wired as canonical across docs/**: README header + Documentation section, docs/index.md footer, and an Official sources block on docs/install/index.md naming the site and the repo as the only two, since that page is where someone about to install looks.
  2. Nothing to point at — deferred to [[feature-release-checksums-repro]]. install.sh runs inside an existing checkout; it fetches no compiler. With no binary release channel there is no download URL to canonicalise, and inventing one would publish a dead link — the exact failure this ticket was blocked on. Reopen when releases exist.
  3. DONE 2026-08-09 (Track W). <link rel="canonical">, OG URLs, sitemap and robots all already pointed at https://pxxc.org. HSTS was the gap: now max-age=63072000, no includeSubDomains, no preload, emitted per nginx location (add_header does not merge — a server-level one would have been dropped by every location and still tested fine). Rolled out at 300s and verified on apex, www, /status/ and /static/ before the long value.
  4. Cannot do — no key exists yet. Publishing a fingerprint is meaningless until [[feature-web-tracker-and-host-portability]] creates the signing key. That ticket already owns "fingerprint published in >=2 places"; the site is one of the two, so this needs no separate tracking here.

Log