The website of modelprofile.com: the open-source project site for AGL, FlexHarness and the modelprofile.com MCP servers. One page, built with Lit and @design.estate/dees-element, coloured with the theme tokens of @design.estate/dees-catalog, and served by @push.rocks/smartserve with nothing but its static file server: no API, no WebSocket, no service worker.

Issue Reporting and Security

For reporting bugs, issues, or security vulnerabilities, please visit community.foss.global/. This is the central community hub for all issue reporting. Developers who sign and comply with our contribution agreement and go through identification can also get a code.foss.global/ account to submit Pull Requests directly.

What the site does

One page: the projects, AGL, FlexHarness and the community, in light or dark as the visitor's system prefers. It uses the system font stack, sets no cookies and loads nothing from other origins.
/.well-known/security.txt (RFC 9116) from html/security.txt.
www.modelprofile.com answers every path but /healthz with a 301 to the same path on modelprofile.com.
/healthz answers 200 on every host, for health checks.
Only GET and HEAD, and only the built page: there is no SPA fallback, directories and dot files are refused, and repository files (.git, package.json, ts/, …) are not reachable. The bundle's source map and third-party notices are served next to it. Every answer carries a strict Content Security Policy and the usual security headers.
The server makes no outbound connections.

Develop

Needs Node.js 24 or later and pnpm (the version in packageManager). The build tooling's lockfile reaches a few owner-scope versions that only https://verdaccio.lossless.digital/ serves (anonymous read), so install from there: pnpm config set registry https://verdaccio.lossless.digital/, as the Dockerfile does.

pnpm install --frozen-lockfile
pnpm run build      # tsrepo build --web && tsrepo bundle → dist_ts/ and dist_serve/
pnpm start          # serves dist_serve/ on port 3000
pnpm run watch      # rebuilds the page and restarts the server on changes

runCli({ port }) and stop() in ts/index.ts start and stop the server from code; the tests use them.

Test

pnpm test             # builds, then the server and the rendered page in Chrome or Chromium (light and dark)
pnpm run test:image   # builds the image and runs it hardened (needs Docker)

Run the image

Dockerfile_##version## builds a two-stage image that runs as nobody (65534) on port 3000 and writes nothing. deploy/deploy.sh runs a built image the way it is meant to run, read-only, without capabilities or new privileges, with memory, CPU, pid and log limits, no volumes and no docker socket, on its own Docker network:

docker build -f 'Dockerfile_##version##' -t modelprofile-landingpage:<version> .
deploy/deploy.sh deploy --image modelprofile-landingpage:<version> \
  --bind <address> --port <port> --network <network> --bridge <interface>
deploy/deploy.sh rollback --bind <address> --port <port>

deploy checks the image as a candidate on the network first, then stops the running container (kept as modelprofile-landingpage-previous), starts the new one on <address>:<port> and checks it there; when that check fails, the previous container comes back. rollback brings the previous container back. The network gets the given bridge interface name, so host firewall rules can name it.

License and Legal Information

This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the license.md file.

Please note: The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.

Trademarks

This project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH or third parties, and are not included within the scope of the MIT license granted herein.

Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines or the guidelines of the respective third-party owners, and any usage must be approved in writing. Third-party trademarks used herein are the property of their respective owners and used only in a descriptive manner, e.g. for an implementation of an API or similar.

readme.md

@modelprofile.com/landingpage