diff --git a/.dockerignore b/.dockerignore
index da9ed59..20598d1 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -11,3 +11,4 @@
!assets/
!assets/geist.ttf
!assets/Geist-OFL.txt
+!assets/grip-sharing-v1.png
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 01e4860..f0916dc 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -31,7 +31,7 @@ jobs:
if curl -fsS http://localhost:8080/healthz; then break; fi
sleep 1
done
- for path in / /index.html /styles.css /app.js /settings.js /data.js /favicon.svg /assets/geist.ttf /assets/Geist-OFL.txt; do
+ for path in / /index.html /styles.css /app.js /settings.js /data.js /favicon.svg /assets/geist.ttf /assets/Geist-OFL.txt /assets/grip-sharing-v1.png; do
curl -fsS -o /dev/null "http://localhost:8080$path"
done
for path in /.env /.git/config /README.md /context.md /design-options/ /missing; do
diff --git a/DEPLOYMENT.md b/DEPLOYMENT.md
index 74367e4..061c0ea 100644
--- a/DEPLOYMENT.md
+++ b/DEPLOYMENT.md
@@ -28,3 +28,7 @@ docker run --rm -p 8080:8080 grip-reference
## Rollback
For a regression, revert through the same staging → main release path and let Dokploy rebuild. For urgent recovery, select the preceding retained image in Dokploy and verify its commit and health. For the first release, withdrawing only this application's route/service returns to the previous state. Do not change shared proxy, registry, or other applications.
+
+## Sharing preview
+
+`index.html` includes server-rendered Open Graph and large-image card tags. `assets/grip-sharing-v1.png` must stay in the Docker copy list, build-context allowlist, Nginx path allowlist, and CI asset checks. Verify its public HTTPS response is `image/png`, dimensions match the tags, and a crawler can read the tags without executing JavaScript. Social platforms may cache prior previews; use their refresh tool or share again after their cache expires.
diff --git a/Dockerfile b/Dockerfile
index fd62d36..1af666a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,6 +4,6 @@ LABEL org.opencontainers.image.source="https://github.com/stephenjoly/grip-refer
org.opencontainers.image.revision="${SOURCE_REVISION}"
COPY deploy/nginx.conf /etc/nginx/conf.d/default.conf
COPY index.html styles.css app.js settings.js data.js favicon.svg /usr/share/nginx/html/
-COPY assets/geist.ttf assets/Geist-OFL.txt /usr/share/nginx/html/assets/
+COPY assets/geist.ttf assets/Geist-OFL.txt assets/grip-sharing-v1.png /usr/share/nginx/html/assets/
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 CMD wget -q -O /dev/null http://127.0.0.1:8080/healthz || exit 1
diff --git a/README.md b/README.md
index 935086d..bf37595 100644
--- a/README.md
+++ b/README.md
@@ -29,3 +29,7 @@ Browser checks in `.impeccable/verify-lilac.js` cover 81 exact ages, invalid inp
## Deployment
Live: https://ogs.stephenjoly.net. See [DEPLOYMENT.md](DEPLOYMENT.md) for the staging-to-production release process.
+
+## Sharing
+
+Open Graph and large-image social cards use the approved purple preview at `assets/grip-sharing-v1.png` (1733 × 907). The canonical URL is https://ogs.stephenjoly.net/. Update the image filename and metadata together when replacing the card so sharing caches can discover the new asset.
diff --git a/assets/grip-sharing-v1.png b/assets/grip-sharing-v1.png
new file mode 100644
index 0000000..a96fd27
Binary files /dev/null and b/assets/grip-sharing-v1.png differ
diff --git a/context.md b/context.md
index f42bc49..95ff665 100644
--- a/context.md
+++ b/context.md
@@ -13,3 +13,7 @@ Verified 81 exact ages20–100, invalid/under-20 handling, actual rich HTML/text
## Hosting
Public GitHub repository: `stephenjoly/grip-reference`. Production hostname: `ogs.stephenjoly.net`. Root Dockerfile serves only app assets with unprivileged Nginx on 8080; deployment procedure is in `DEPLOYMENT.md`.
+
+## Sharing preview
+
+Approved purple card is `assets/grip-sharing-v1.png` (1733 × 907). Open Graph and large-image card metadata point to the canonical public hostname; container and CI asset allowlists include the image.
diff --git a/deploy/nginx.conf b/deploy/nginx.conf
index 26443c3..77c4336 100644
--- a/deploy/nginx.conf
+++ b/deploy/nginx.conf
@@ -9,6 +9,6 @@ server {
add_header Cache-Control "no-cache" always;
location = /healthz { access_log off; default_type text/plain; return 200 "ok\n"; }
location = / { try_files /index.html =404; }
- location ~ ^/(index\.html|styles\.css|app\.js|settings\.js|data\.js|favicon\.svg|assets/(geist\.ttf|Geist-OFL\.txt))$ { try_files $uri =404; }
+ location ~ ^/(index\.html|styles\.css|app\.js|settings\.js|data\.js|favicon\.svg|assets/(geist\.ttf|Geist-OFL\.txt|grip-sharing-v1\.png))$ { try_files $uri =404; }
location / { return 404; }
}
diff --git a/index.html b/index.html
index 0981949..a678c36 100644
--- a/index.html
+++ b/index.html
@@ -6,6 +6,22 @@
Grip reference — Adult strength norms
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+