Notes/Next.js

Three Next.js apps, one privacy boundary

2026-05-20

TrustOS is four Node processes: three Next.js apps and a NestJS API. Marketing has to be crawlable. The Privacy Centre must not be. Marketing emits a sitemap, JSON-LD, and IndexNow. Privacy Centre sends noindex robots meta and X-Robots-Tag. Putting both in one Next app means one layout, one robots.txt, and a mistake that is hard to see until it is indexed. The dashboard is a third surface: permission-filtered nav, RSA bootstrap, then AES-GCM on request bodies so identifiers do not sit in DevTools. It talks to the same /v1 API as the public consent routes, but it is not a marketing site with a login bolted on. Shared packages hold RBAC, i18n, DPI rules, and email templates. The split is for threat model and SEO, not for the pleasure of extra repos.