krz/gitbay

Serve static sites from repositories — the personal-site use case (cleberg.net, krz.sh) next to the code that generates it.

Sketch: a repo setting names a branch (default pages) whose tree is served as a static site. Rebuilt view on push (webhook/hook already fires); no build step server-side — push rendered output, keeping the no-execution principle (CI from #13 can do the building).

The security constraint that shapes everything: repo-authored HTML must never run on the forge origin (session cookies). Pages need a separate origin — <owner>.pages.<domain> wildcard subdomains, which means a wildcard DNS record and either wildcard/on-demand ACME certificates. Custom domains (CNAME + per-domain ACME) as a follow-up.

Serving is cheap once origins are right: read the tree via the existing plumbing, correct MIME types, index.html defaults, 404.html support.