Deploy a static site

Commit built HTML and assets, choose a document root, and serve a static site with Caddy on DeployGrove.

Put the manifest and lockfile at the repository root. Commit source and lockfiles, but keep credentials, local dependencies, virtual environments, and database files out of Git. DeployGrove scans the whole checkout: Dockerfiles, Containerfiles, Compose files, symlinks, Git submodules, package-manager config files, and unsupported dependency sources are rejected, even in unused folders.

Repository layout

my-site/
  public/
    index.html
    assets/
      app.css
      app.js
    _headers

Commit index.html in public/, dist/, or the repository root. Auto-selection checks those locations in that order. Choose the document root explicitly if more than one exists. Select Static HTML explicitly when the repository also has package.json.

Prepare a built site

Caddy 2.11.4 serves committed files on port 8080. It does not run npm, a build script, or a repository Caddyfile. For Vite, Astro, or another static generator, build locally or in your own CI, then commit the finished output to the branch you deploy. Confirm index.html and all assets are tracked in Git.

Static HTML cannot run an API or render pages on a server. Use Node.js for a Next.js server or another app that needs server code. Do not place secrets in client JavaScript. Build-time public values become part of the files visitors can read.

The platform probes /healthz, independent of your site files. Open the homepage, assets, and nested URLs after release. Do not assume a catch-all SPA fallback; provide files or routes that work with static serving.

Headers and caching

Dotfiles, package manifests, and container config files are not served. Directory listings are off. Static assets get a 30-day cache by default; HTML revalidates. Use versioned asset filenames to avoid stale files after a release.

An optional _headers file in the document root can set supported headers:

/*
  Content-Security-Policy: default-src 'self'
  Permissions-Policy: camera=(), microphone=()

/assets/*
  Cache-Control: public, max-age=31536000, immutable

Use the long immutable cache only for versioned assets. Unsupported headers or unsafe values are skipped with a deploy-log warning. Platform security headers remain enforced. The _headers file itself is never served.

Ready to release? Follow the deploy steps and account setup.