---

What this is

ccru-mirror is a faithful, unofficial archival copy of ccru.net — the site of the Cybernetic Culture Research Unit (CCRU), the 1990s Warwick-adjacent theory collective. The original pages are captured in object storage and served read-only with a strict, defense-in-depth security posture. The stored archive is never mutated; a small attribution footer is the only thing spliced in, and it's added at serve time at the byte level so the original iso-8859-1 HTML stays intact.

It's for readers who want a stable, legible home for the CCRU texts, and for anyone who wants a compact reference for hardening a static-archive Worker.

Live: https://ccru.numetal.xyz

Highlights

• Zero dependencies. One ES-module Worker (src/index.js) — no framework, no build step, no node_modules.
• Read-only by design. GET/HEAD only; every other method returns 405. No login, no write path, no directory listing, no bucket enumeration.
• Hard path validation. Each request path is decoded once and validated — rejecting .., encoded .., backslashes, NUL/control bytes, #/?, and malformed percent-encoding — then forced under a fixed key prefix. Traversal vectors are covered by unit tests.
• Strict security headers on every response. A locked Content-Security-Policy (default-src 'none', scripts disabled except one hash-pinned snippet), HSTS with preload, nosniff, frame-deny + frame-ancestors 'none', no-referrer, a tight Permissions-Policy, and COOP/CORP.
• Fails closed. Any unexpected error returns a generic 500 with no internals leaked.
• Edge-cached, including negative lookups. Pages, sitemap.xml, robots.txt, and 404s are all cached at the edge, so key-enumeration can't be used to hammer origin storage for cost-amplification.
• Byte-faithful footer injection. The attribution footer is inserted before the last </body> without re-encoding the page — the footer is pure ASCII/HTML-entities so it can't mangle the original latin1 bytes. A test asserts this ASCII purity and verifies the CSP hash matches the one allowed inline script.
• Live sitemap + robots. sitemap.xml is generated on demand from what's actually in storage; robots.txt allows all and points at it.

Live & links

Mirror	https://ccru.numetal.xyz
Maintainer	Gökhan Turhan (hosted pro bono)
Original texts	© their respective authors — see Urbanomic's CCRU: Writings 1997–2003

Stack

Layer	Choice
Runtime	Cloudflare Workers (single ES module, zero deps)
Object storage	Cloudflare R2 (S3-compatible)
Images (optional)	Cloudflare Images — same-origin proxy, with R2 as automatic fallback
Edge cache	Workers Cache API
Zone defense	Cloudflare managed WAF + L7 DDoS + per-IP rate limiting (configured at the zone, in front of the Worker)
Tests	Node's built-in node:test runner
Tooling	Wrangler

Develop

# Run the test suite (path-traversal vectors + footer-injection fidelity + CSP-hash drift guard)
node --test
# Local dev server (Wrangler; serves from the configured R2 bucket)
npx wrangler dev

The tests are dependency-free and cover the security-critical logic: the safeKey path validator (traversal/injection vectors), byte-faithful injectFooter, and a drift guard that recomputes the SHA-256 of the one inline script and asserts it matches the value pinned in the CSP.

Deploy

Deployment targets the maintainer's Cloudflare account and requires an API token with the Workers/R2/Images and zone scopes listed in deploy.sh. Storage identifiers are resolved by name at deploy time rather than committed to the repo.

./deploy.sh   # wrangler deploy + purge the edge cache for the mirror host

Always use deploy.sh rather than a bare wrangler deploy: HTML is edge-cached (~1h), so a deploy is invisible to visitors until the cache is purged. Configuration lives in wrangler.jsonc.

Security

No login, no write path — the entire surface is a read-only archive. The security model is documented inline at the top of src/index.js and exercised by test/logic.test.mjs. There is no dedicated SECURITY.md; to report an issue, open an issue on this repository or contact the maintainer at gokhanturhan.com.

Credits & third-party

• Cloudflare — Workers, R2, Images, Cache API, WAF/DDoS. Deployed with Wrangler (Apache-2.0 / MIT).
• Node.js node:test runner for the test suite (Node is MIT-licensed).
• CCRU — the archived texts are the work of the Cybernetic Culture Research Unit and its members; copyright remains with their respective authors. This mirror is unofficial and non-commercial. See Urbanomic's collected edition CCRU: Writings 1997–2003.

This repository contains only the serving code and configuration. The archived page content is not part of this repository and is not relicensed by it.

Attribution & donations

The mirror is hosted and served pro bono. The injected footer credits the maintainer and offers optional donation addresses (EVM / SOL / Zcash / BTC) — donations are voluntary and unrelated to the archived texts.

License

This project is licensed under the MIT License — remix freely with attribution. See LICENSE.