Brookeside Wolvden Theme

MYSTIC-themed assets for Bray's Wolvden Den and player profile.

Wolvden setup

Use the stable hosted URLs below after the deployment environment is configured:

Wolvden field	URL	Accompanying custom HTML
Den CSS	https://css.corebot.ca/wolvden/brookeside-den.css	brookeside-den.html
Profile CSS	https://css.corebot.ca/wolvden/brookeside-profile.css	brookeside-profile.html

Paste the contents of the matching HTML file into Wolvden's Custom Den HTML or Custom Profile HTML field. The header intentionally uses just one static ONLINE indicator; it is visual identity, not a live Wolvden status.

Hosted CSS contract

The public static host must serve both files with this header:

Content-Type: text/css; charset=utf-8

Wolvden loads custom stylesheets with nosniff. Forgejo's raw endpoint currently responds with Content-Type: text/plain; charset=utf-8, so it cannot be used directly despite returning HTTP 200.

For the existing mystic-home Nginx service, publish the files into the directory mounted at /usr/share/nginx/html/wolvden/. Nginx's default MIME mapping serves .css as text/css; preserve the normal mime.types include when changing its configuration. Nginx Proxy Manager should route css.corebot.ca to that service, or the URLs can instead use https://main.corebot.ca/wolvden/....

CI and deployment

.forgejo/workflows/validate-css.yml runs on pull requests and main, checking that every required asset exists and the stylesheets have balanced blocks. .forgejo/workflows/deploy-css.yml publishes on each push to main, using an atomic per-file replacement on Runner, then verifies HTTP 200 plus Content-Type: text/css through the public URL.

The infrastructure PR provisions Runner's wolvden-css service at port 8091; Nginx Proxy Manager must route css.corebot.ca to 100.113.176.41:8091 with a Let's Encrypt certificate and Force SSL enabled. Add these repository Action secrets before merging this PR:

• WOLVDEN_DEPLOY_USER — a Runner account limited to the CSS publish directory.
• WOLVDEN_DEPLOY_SSH_KEY — that account's private deployment key.
• WOLVDEN_DEPLOY_KNOWN_HOSTS — the pinned Runner SSH host-key line for 100.113.176.41.

The account is key-restricted to exactly two temporary uploads and their atomic renames in /etc/komodo/repos/infra-runner/mono/runner-web/wolvden-css/public; it has no shell, forwarding, or access to other paths. The workflow uses legacy SCP mode (-O) so that restriction is enforceable.

Design guardrails

• #denCards exclusively styles the six Den navigation cards, preserving wolf portraits elsewhere.
• The Den identity panel is always a compact two-by-two grid.
• Theme headers are static, so they never claim to reflect live pack or site status.