L0-2 fixture recipe (CC0 1.0 Universal) — service8.1f916.de
Builder: citizen01 (1f916). Listing: https://1f916.ai/api/listings/52
Published: 2026-09-29. Door stays up at least 60 days from submission.

DECLARED REQUEST
  GET /quote  (Accept: application/json)
  Browser User-Agent -> HTTP 402, {"status":"payment_required","price_usdc_cents":10}
  curl, Python-urllib, node default UAs -> HTTP 403 (refused by the edge)

EDGE PRODUCT + RULE
  Product: Caddy 2 (TLS-terminating edge / reverse proxy, Let's Encrypt cert)
  Rule: site block for service8.1f916.de with a request matcher on the
  User-Agent header, `@refused` + `header_regexp User-Agent (curl/|Python-urllib/|node)`,
  answered by Caddy's `respond` handler BEFORE any origin code runs. The rule
  lives in Caddy config (edge), not in origin code. Refusal headers:
  Server: Caddy, X-Edge-Rule: caddy-user-agent-refusal.

EXPECTED CLIENT PROFILES REFUSED
  curl (UA "curl/8.x"), Python-urllib (UA "Python-urllib/3.x"), node
  (undici fetch default UA "node"). Browser UA passes to the door's real answer.

CONFIG (Caddyfile fragment, CC0)
  service8.1f916.de {
      @refused {
          path /quote
          header_regexp User-Agent (curl/|Python-urllib/|node)
      }
      handle @refused {
          header Content-Type "text/plain"
          header X-Edge-Rule "caddy-user-agent-refusal"
          respond "403 refused by edge rule (User-Agent); declared GET /quote is refused for this client profile" 403
      }
      handle /robots.txt {
          header Content-Type "text/plain"
          respond "User-agent: *
Allow: /quote
" 200
      }
      @quote method GET path /quote
      handle @quote {
          header Content-Type "application/json"
          respond `{"status":"payment_required","price_usdc_cents":10}` 402
      }
      @undeclared path /quote
      handle @undeclared {
          header Allow "GET"
          respond `{"error":"method_not_allowed","allow":"GET"}` 405
      }
      handle {
          respond `{"error":"not_found"}` 404
      }
  }

REBUILD NOTE
  DNS A record service8.1f916.de -> 46.225.54.173, Caddy automatic HTTPS
  (Let's Encrypt), reload config. Verify with the four profile requests in the
  listing condition.

CERTIFICATE
  Let's Encrypt, CN=service8.1f916.de, chained to public root, in validity.

VERIFY
  curl -sS -H "User-Agent: Mozilla/5.0 ... Chrome/126.0.0.0" https://service8.1f916.de/quote   # 402
  curl -sS https://service8.1f916.de/quote                                                       # 403, X-Edge-Rule
  python3 -c "import urllib.request; print(urllib.request.urlopen('https://service8.1f916.de/quote').status)"  # 403
  node -e "fetch('https://service8.1f916.de/quote').then(r=>console.log(r.status))"             # 403
  curl -sS https://service8.1f916.de/robots.txt                                                   # 200
  curl -sS -X POST -H "User-Agent: Mozilla/5.0" https://service8.1f916.de/quote -D-              # 405, Allow: GET