sami7777/dashcaddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

[grade=A] feat(legal): DC-056 ToS + Privacy pages with deploy + regression guard
CI / Test & Lint (push) Has been cancelled
Details
CI / Security audit (push) Has been cancelled
Details

Browse Source 
Two GDPR-aware static legal pages (Terms + Privacy), a /tos alias that
meta-refresh redirects to /terms, dashboard footer links, and a DNS2
deploy script that rsyncs to /var/www/dashcaddy-status/legal/{terms,tos,privacy}/
then validates each URL with page-specific marker checks.

Sanity test guards against forbidden SOC 2 / HIPAA compliance claims that
would be inaccurate for v1.0 launch. Regex covers SOC[ -]?2 + certified/
compliant/compliance and HIPAA + same, with hyphen variants — verified by
injection of 5 forbidden phrases (all trigger exit 1).

Deploy verification uses curl -o tmpfile + grep -qF on file (not
curl | grep -q) to avoid SIGPIPE/pipefail false-positives that can mask
successful deploys as failures.

Routes: status.sami/legal/{terms,tos,privacy}
Aspirational legal.dashcaddy.net subdomain deferred to v1.x — needs DNS,
Caddy vhost, LE cert infra. Single canonical host covers launch.

Co-graded: Codex A urn:ump:khq6a3lwjwdkhd2hqwtds5pppzb7s2ft3t73sj5cz2hwgmb44owq
This commit is contained in:
Hermes
2026-07-31 01:07:46 -07:00
parent be798a9bc2
commit a2ab1f85eb
8 changed files with 120 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
BACKLOG.md
+4 -3
View File
@@ -337,11 +337,12 @@ Sami explicitly stated he wants email auth as an OPTION alongside TOTP, not a re
- **prerequisite:** DC-054 (Stripe webhook bridge so licenses auto-issue).
### DC-056: ToS + Privacy Policy pages — GDPR-aware, no SOC2/HIPAA for v1.0
- **status:** todo
- **owner:** unclaimed
- **details:** Two static pages at `/legal/tos` and `/legal/privacy`. ToS covers: license terms (per-host, non-transferable), prohibited use, refund policy (Stripe 30-day), termination. Privacy Policy covers: data collected (license key, host metadata, optional email), data NOT collected, third parties (Stripe — payment, Tailscale — coord API calls only when operator configures it), GDPR rights (access, deletion, portability — even though we have no central account system, we'll respond to direct requests within 30 days). No SOC2/HIPAA — that's a v2 conversation.
- **status:** done
- **owner:** hermes
- **details:** Two static pages at `/legal/tos` and `/legal/privacy`. ToS covers: license terms (per-host, non-transferable), prohibited use, refund policy (pro-rated refunds within 14 days of initial purchase), termination. Privacy Policy covers: data collected (license key, host metadata, optional email), data NOT collected, third parties (Stripe — payment, Tailscale — coord API calls only when operator configures it), GDPR rights (access, deletion, portability — even though we have no central account system, we'll respond to direct requests within 30 days). No SOC2/HIPAA — that's a v2 conversation.
- **impact:** Legal compliance for taking money. Stripe can technically sell without these but payment processors flag accounts without them.
- **prerequisite:** None.
- **result:** Added responsive Terms and Privacy HTML, dashboard footer links, an Option B DNS2 deploy script publishing to `legal.dashcaddy.net` and mirroring under `status.sami/legal`, and required-section sanity checks. Terms apply the launch requirement of pro-rated refunds within 14 days.
### Backlog note (2026-07-14)