feature: www directory support

.dockerignore

···
+# Git
+.git
+.gitignore
+
+# Documentation
+*.md
+docs/
+LICENSE
+
+# Development files
+.vscode/
+.env
+.env.local
+*.log
+
+# Build artifacts
+target/
+Dockerfile
+.dockerignore
+
+# Test files
+tests/
+benches/
+
+# Scripts (except the ones we need)
+*.sh
+
+# SQLite databases
+*.db
+*.db-*
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Keep the www directory for static files
+!www/

.env.example

···
 # QuickDID Environment Configuration Template
 # Copy this file to .env and customize for your deployment
-# 
-# IMPORTANT: Never commit .env files with real SERVICE_KEY values
 
 # ============================================================================
 # REQUIRED CONFIGURATION
···
 #   - quickdid.example.com:8080
 #   - localhost:3007
 HTTP_EXTERNAL=quickdid.example.com
-
-# Private key for service identity (REQUIRED)
-# SECURITY: Generate a new key for each environment
-# NEVER commit real keys to version control
-SERVICE_KEY=did:key:YOUR_PRIVATE_KEY_HERE
 
 # ============================================================================
 # NETWORK CONFIGURATION
···
 QUEUE_BUFFER_SIZE=1000
 
 # ============================================================================
+# STATIC FILES CONFIGURATION
+# ============================================================================
+
+# Directory for serving static files (default: www)
+# This should contain:
+#   - index.html (landing page)
+#   - .well-known/atproto-did (service DID)
+#   - .well-known/did.json (DID document)
+# Docker default: /app/www
+STATIC_FILES_DIR=www
+
+# ============================================================================
 # LOGGING
 # ============================================================================
 
···
 # ============================================================================
 
 # HTTP_EXTERNAL=localhost:3007
-# SERVICE_KEY=did:key:z42tmZxD2mi1TfMKSFrsRfednwdaaPNZiiWHP4MPgcvXkDWK
 # RUST_LOG=debug
 # CACHE_TTL_MEMORY=60
 # CACHE_TTL_REDIS=300

CLAUDE.md

···
 cargo build
 
 # Run in debug mode (requires environment variables)
-HTTP_EXTERNAL=localhost:3007 SERVICE_KEY=did:key:z42tmZxD2mi1TfMKSFrsRfednwdaaPNZiiWHP4MPgcvXkDWK cargo run
+HTTP_EXTERNAL=localhost:3007 cargo run
 
 # Run tests
 cargo test
···
 4. **HTTP Server** (`src/http/`)
    - XRPC endpoints for AT Protocol compatibility
    - Health check endpoint
-   - DID document serving via .well-known
+   - Static file serving from configurable directory (default: www)
+   - Serves .well-known files as static content
    - CORS headers support for cross-origin requests
    - Cache-Control headers with configurable max-age and stale directives
    - ETag support with configurable seed for cache invalidation
···
 
 ### Required
 - `HTTP_EXTERNAL`: External hostname for service endpoints (e.g., `localhost:3007`)
-- `SERVICE_KEY`: Private key for service identity (DID format)
 
 ### Optional - Core Configuration
 - `HTTP_PORT`: Server port (default: 8080)
 - `PLC_HOSTNAME`: PLC directory hostname (default: plc.directory)
 - `RUST_LOG`: Logging level (e.g., debug, info)
+- `STATIC_FILES_DIR`: Directory for serving static files (default: www)
 
 ### Optional - Caching
 - `REDIS_URL`: Redis connection URL for caching

Cargo.lock

···
 ]
 
 [[package]]
+name = "http-range-header"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9171a2ea8a68358193d15dd5d70c1c10a2afc3e7e4c5bc92bc9f025cebd7359c"
+
+[[package]]
 name = "httparse"
 version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
 [[package]]
+name = "mime_guess"
+version = "2.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
+dependencies = [
+ "mime",
+ "unicase",
+]
+
+[[package]]
 name = "miniz_oxide"
 version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "thiserror 2.0.16",
  "tokio",
  "tokio-util",
+ "tower-http",
  "tracing",
  "tracing-subscriber",
 ]
···
 dependencies = [
  "bitflags",
  "bytes",
+ "futures-core",
  "futures-util",
  "http",
  "http-body",
+ "http-body-util",
+ "http-range-header",
+ "httpdate",
  "iri-string",
+ "mime",
+ "mime_guess",
+ "percent-encoding",
  "pin-project-lite",
+ "tokio",
+ "tokio-util",
  "tower",
  "tower-layer",
  "tower-service",
+ "tracing",
 ]
 
 [[package]]
···
 version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f"
+
+[[package]]
+name = "unicase"
+version = "2.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75b844d17643ee918803943289730bec8aac480150456169e647ed0b576ba539"
 
 [[package]]
 name = "unicode-bidi"

Cargo.toml

···
 thiserror = "2.0"
 tokio = { version = "1.35", features = ["rt-multi-thread", "macros", "signal", "sync", "time", "net", "fs"] }
 tokio-util = { version = "0.7", features = ["rt"] }
+tower-http = { version = "0.6", features = ["fs"] }
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 

Dockerfile

···
 WORKDIR /app
 COPY --from=builder /app/target/release/quickdid /app/quickdid
 
+# Copy static files for serving
+COPY www /app/www
+
 ENV HTTP_PORT=8080
+ENV STATIC_FILES_DIR=/app/www
 ENV RUST_LOG=info
 ENV RUST_BACKTRACE=full
 

README.md

···
 
 ## Minimum Configuration
 
-QuickDID requires the following environment variables to run. Configuration is validated at startup, and the service will exit with specific error codes if validation fails.
+QuickDID requires minimal configuration to run. Configuration is validated at startup, and the service will exit with specific error codes if validation fails.
 
 ### Required
 
 - `HTTP_EXTERNAL`: External hostname for service endpoints (e.g., `localhost:3007`)
-- `SERVICE_KEY`: Private key for service identity in DID format (e.g., `did:key:z42tmZxD2mi1TfMKSFrsRfednwdaaPNZiiWHP4MPgcvXkDWK`)
 
 ### Example Minimal Setup
 
 ```bash
-HTTP_EXTERNAL=localhost:3007 \
-SERVICE_KEY=did:key:z42tmZxD2mi1TfMKSFrsRfednwdaaPNZiiWHP4MPgcvXkDWK \
-cargo run
+HTTP_EXTERNAL=localhost:3007 cargo run
+```
+
+### Static Files
+
+QuickDID serves static files from the `www` directory by default. This includes:
+- Landing page (`index.html`)
+- AT Protocol well-known files (`.well-known/atproto-did` and `.well-known/did.json`)
+
+Generate the `.well-known` files for your deployment:
+
+```bash
+HTTP_EXTERNAL=your-domain.com ./generate-wellknown.sh
 ```
 
 This will start QuickDID with:
···
 - `PROACTIVE_REFRESH_ENABLED`: Enable proactive cache refreshing (default: false)
 - `PROACTIVE_REFRESH_THRESHOLD`: Refresh when TTL remaining is below this threshold (0.0-1.0, default: 0.8)
 
+#### Static Files
+- `STATIC_FILES_DIR`: Directory for serving static files (default: www)
+
 #### Logging
 - `RUST_LOG`: Logging level (e.g., debug, info, warn, error)
 
···
 #### Redis-based with Metrics (Multi-instance/HA)
 ```bash
 HTTP_EXTERNAL=quickdid.example.com \
-SERVICE_KEY=did:key:yourkeyhere \
 HTTP_PORT=3000 \
 REDIS_URL=redis://localhost:6379 \
 CACHE_TTL_REDIS=86400 \
···
 #### SQLite-based (Single-instance)
 ```bash
 HTTP_EXTERNAL=quickdid.example.com \
-SERVICE_KEY=did:key:yourkeyhere \
 HTTP_PORT=3000 \
 SQLITE_URL=sqlite:./quickdid.db \
 CACHE_TTL_SQLITE=86400 \

docker-compose.yml

···
+version: '3.8'
+
+services:
+  quickdid:
+    image: quickdid:latest
+    build: .
+    ports:
+      - "3007:8080"
+    environment:
+      - HTTP_EXTERNAL=localhost:3007
+      - HTTP_PORT=8080
+      - RUST_LOG=info
+      # Optional: Override the static files directory
+      # - STATIC_FILES_DIR=/app/custom-www
+    volumes:
+      # Optional: Mount custom static files from host
+      # - ./custom-www:/app/custom-www:ro
+      # Optional: Mount custom .well-known files
+      # - ./www/.well-known:/app/www/.well-known:ro
+      # Optional: Use SQLite for caching
+      # - ./data:/app/data
+    # environment:
+      # SQLite cache configuration
+      # - SQLITE_URL=sqlite:/app/data/quickdid.db
+      # - CACHE_TTL_SQLITE=86400
+      
+      # Redis cache configuration (if using external Redis)
+      # - REDIS_URL=redis://redis:6379
+      # - CACHE_TTL_REDIS=86400
+      # - QUEUE_ADAPTER=redis
+      
+  # Optional: Redis service for caching
+  # redis:
+  #   image: redis:7-alpine
+  #   ports:
+  #     - "6379:6379"
+  #   volumes:
+  #     - redis-data:/data
+
+volumes:
+  redis-data:

docs/configuration-reference.md

···
 **Constraints**:
 - Must be a valid hostname or hostname:port combination
 - Port (if specified) must be between 1-65535
-- Used to generate service DID (did:web:{HTTP_EXTERNAL})
-
-### `SERVICE_KEY`
-
-**Required**: Yes  
-**Type**: String  
-**Format**: DID private key  
-**Security**: SENSITIVE - Never commit to version control  
-
-The private key for the service's AT Protocol identity. This key is used to sign responses and authenticate the service.
-
-**Examples**:
-```bash
-# did:key format (Ed25519)
-SERVICE_KEY=did:key:z42tmZxD2mi1TfMKSFrsRfednwdaaPNZiiWHP4MPgcvXkDWK
-
-# did:plc format
-SERVICE_KEY=did:plc:xyz123abc456def789
-```
-
-**Constraints**:
-- Must be a valid DID format
-- Must include the private key component
-- Should be stored securely (e.g., secrets manager, encrypted storage)
 
 ## Network Configuration
 
···
 - TTL=3600s (1 hour), threshold=0.8: Refresh after 48 minutes
 - TTL=86400s (1 day), threshold=0.8: Refresh after 19.2 hours
 
+## Static Files Configuration
+
+### `STATIC_FILES_DIR`
+
+**Required**: No  
+**Type**: String (directory path)  
+**Default**: `www`  
+
+Directory path for serving static files. This directory should contain the landing page and AT Protocol well-known files.
+
+**Directory Structure**:
+```
+www/
+├── index.html              # Landing page
+├── .well-known/
+│   ├── atproto-did        # Service DID identifier
+│   └── did.json           # DID document
+└── (other static assets)
+```
+
+**Examples**:
+```bash
+# Default (relative to working directory)
+STATIC_FILES_DIR=www
+
+# Absolute path
+STATIC_FILES_DIR=/var/www/quickdid
+
+# Docker container path
+STATIC_FILES_DIR=/app/www
+
+# Custom directory
+STATIC_FILES_DIR=./public
+```
+
+**Docker Volume Mounting**:
+```yaml
+volumes:
+  # Mount entire custom directory
+  - ./custom-www:/app/www:ro
+  
+  # Mount specific files
+  - ./custom-index.html:/app/www/index.html:ro
+  - ./well-known:/app/www/.well-known:ro
+```
+
+**Generating Well-Known Files**:
+```bash
+# Generate .well-known files for your domain
+HTTP_EXTERNAL=your-domain.com ./generate-wellknown.sh
+```
+
 ## HTTP Caching Configuration
 
 ### `CACHE_MAX_AGE`
···
 ```bash
 # .env.development
 HTTP_EXTERNAL=localhost:3007
-SERVICE_KEY=did:key:z42tmZxD2mi1TfMKSFrsRfednwdaaPNZiiWHP4MPgcvXkDWK
 RUST_LOG=debug
 ```
 
···
 # .env.production.redis
 # Required
 HTTP_EXTERNAL=quickdid.example.com
-SERVICE_KEY=${SECRET_SERVICE_KEY}  # From secrets manager
 
 # Network
 HTTP_PORT=8080
···
 # .env.production.sqlite
 # Required
 HTTP_EXTERNAL=quickdid.example.com
-SERVICE_KEY=${SECRET_SERVICE_KEY}  # From secrets manager
 
 # Network
 HTTP_PORT=8080
···
 # .env.ha.redis
 # Required
 HTTP_EXTERNAL=quickdid.example.com
-SERVICE_KEY=${SECRET_SERVICE_KEY}
 
 # Network
 HTTP_PORT=8080
···
 # .env.hybrid
 # Required
 HTTP_EXTERNAL=quickdid.example.com
-SERVICE_KEY=${SECRET_SERVICE_KEY}
 
 # Network
 HTTP_PORT=8080
···
     image: quickdid:latest
     environment:
       HTTP_EXTERNAL: quickdid.example.com
-      SERVICE_KEY: ${SERVICE_KEY}
       HTTP_PORT: 8080
       REDIS_URL: redis://redis:6379/0
       CACHE_TTL_MEMORY: 600
···
     image: quickdid:latest
     environment:
       HTTP_EXTERNAL: quickdid.example.com
-      SERVICE_KEY: ${SERVICE_KEY}
       HTTP_PORT: 8080
       SQLITE_URL: sqlite:/data/quickdid.db
       CACHE_TTL_MEMORY: 600
···
 ### Required Fields
 
 1. **HTTP_EXTERNAL**: Must be provided
-2. **SERVICE_KEY**: Must be provided
+2. **HTTP_EXTERNAL**: Must be provided
 
 ### Value Constraints
 
···
 
 ```bash
 # Validate configuration
-HTTP_EXTERNAL=test SERVICE_KEY=test quickdid --help
+HTTP_EXTERNAL=test quickdid --help
 
 # Test with specific values
 CACHE_TTL_MEMORY=0 quickdid --help  # Will fail validation
 
 # Check parsed configuration (with debug logging)
-RUST_LOG=debug HTTP_EXTERNAL=test SERVICE_KEY=test quickdid
+RUST_LOG=debug HTTP_EXTERNAL=test quickdid
 ```
 
 ## Best Practices
 
 ### Security
 
-1. **Never commit SERVICE_KEY** to version control
-2. Use environment-specific key management (Vault, AWS Secrets, etc.)
-3. Rotate SERVICE_KEY regularly
-4. Use TLS for Redis connections in production (`rediss://`)
+1. Use environment-specific configuration management
+2. Use TLS for Redis connections in production (`rediss://`)
+3. Never commit sensitive configuration to version control
 5. Implement network segmentation for Redis access
 
 ### Performance
···
 ### Deployment
 
 1. Use `.env` files for local development
-2. Use secrets management for production SERVICE_KEY
+2. Use secrets management for production configurations
 3. Set resource limits in container orchestration
 4. Use health checks to monitor service availability
 5. Implement gradual rollouts with feature flags

docs/production-deployment.md

···
 #   - localhost:3007 (for testing only)
 HTTP_EXTERNAL=quickdid.example.com
 
-# Private key for service identity (DID format)
-# Generate a new key for production using atproto-identity tools
-# SECURITY: Keep this key secure and never commit to version control
-# Example formats:
-#   - did:key:z42tmZxD2mi1TfMKSFrsRfednwdaaPNZiiWHP4MPgcvXkDWK
-#   - did:plc:xyz123abc456
-SERVICE_KEY=did:key:YOUR_PRODUCTION_KEY_HERE
-
 # ----------------------------------------------------------------------------
 # NETWORK CONFIGURATION
 # ----------------------------------------------------------------------------
···
 PROACTIVE_REFRESH_THRESHOLD=0.8
 
 # ----------------------------------------------------------------------------
+# STATIC FILES CONFIGURATION
+# ----------------------------------------------------------------------------
+
+# Directory path for serving static files (default: www)
+# This directory should contain:
+#   - index.html (landing page)
+#   - .well-known/atproto-did (service DID identifier)
+#   - .well-known/did.json (DID document)
+# In Docker, this defaults to /app/www
+# You can mount custom files via Docker volumes
+STATIC_FILES_DIR=/app/www
+
+# ----------------------------------------------------------------------------
 # PERFORMANCE TUNING
 # ----------------------------------------------------------------------------
 
···
     container_name: quickdid-sqlite
     environment:
       HTTP_EXTERNAL: quickdid.example.com
-      SERVICE_KEY: ${SERVICE_KEY}
       HTTP_PORT: 8080
       SQLITE_URL: sqlite:/data/quickdid.db
       CACHE_TTL_MEMORY: 600
···
 
 ### 1. Service Key Protection
 
-- **Never commit** the `SERVICE_KEY` to version control
+- **Never commit** sensitive configuration to version control
 - Store keys in a secure secret management system (e.g., HashiCorp Vault, AWS Secrets Manager)
 - Rotate keys regularly
 - Use different keys for different environments
···
 docker logs quickdid
 
 # Verify environment variables
-docker exec quickdid env | grep -E "HTTP_EXTERNAL|SERVICE_KEY"
+docker exec quickdid env | grep -E "HTTP_EXTERNAL|HTTP_PORT"
 
 # Test Redis connectivity
 docker exec quickdid redis-cli -h redis ping
···
 ### Required Fields
 
 - **HTTP_EXTERNAL**: Must be provided
-- **SERVICE_KEY**: Must be provided
+- **HTTP_EXTERNAL**: Must be provided
 
 ### Value Constraints
 
···
 
 ```bash
 # Validate configuration without starting service
-HTTP_EXTERNAL=test SERVICE_KEY=test quickdid --help
+HTTP_EXTERNAL=test quickdid --help
 
 # Test with specific values (will fail validation)
 CACHE_TTL_MEMORY=0 quickdid --help
 
 # Debug configuration parsing
-RUST_LOG=debug HTTP_EXTERNAL=test SERVICE_KEY=test quickdid
+RUST_LOG=debug HTTP_EXTERNAL=test quickdid
 ```
 
 ## Support and Resources

generate-wellknown.sh

···
+#!/bin/bash
+
+# Script to generate .well-known static files based on QuickDID configuration
+# Usage: HTTP_EXTERNAL=quickdid.smokesignal.tools ./generate-wellknown.sh
+#
+# Note: Since we no longer process SERVICE_KEY, you'll need to manually
+# add the public key to the did.json file if you need DID document support.
+
+set -e
+
+# Check required environment variables
+if [ -z "$HTTP_EXTERNAL" ]; then
+    echo "Error: HTTP_EXTERNAL environment variable is required"
+    echo "Usage: HTTP_EXTERNAL=example.com ./generate-wellknown.sh"
+    exit 1
+fi
+
+# Ensure www/.well-known directory exists
+mkdir -p www/.well-known
+
+# Generate service DID from HTTP_EXTERNAL
+if [[ "$HTTP_EXTERNAL" == *":"* ]]; then
+    # Contains port - URL encode the colon
+    SERVICE_DID="did:web:${HTTP_EXTERNAL//:/%3A}"
+else
+    SERVICE_DID="did:web:$HTTP_EXTERNAL"
+fi
+
+echo "Generating .well-known files for $SERVICE_DID"
+
+# Write atproto-did file
+echo "$SERVICE_DID" > www/.well-known/atproto-did
+echo "Created: www/.well-known/atproto-did"
+
+# Create a basic did.json template
+# Note: You'll need to manually add the publicKeyMultibase if you need DID document support
+
+cat > www/.well-known/did.json <<EOF
+{
+  "@context": [
+    "https://www.w3.org/ns/did/v1",
+    "https://w3id.org/security/multikey/v1"
+  ],
+  "id": "$SERVICE_DID",
+  "verificationMethod": [],
+  "service": [
+    {
+      "id": "${SERVICE_DID}#quickdid",
+      "type": "QuickDIDService",
+      "serviceEndpoint": "https://${HTTP_EXTERNAL}"
+    }
+  ]
+}
+EOF
+
+echo "Created: www/.well-known/did.json"
+echo ""
+echo "Note: The did.json file is a basic template. If you need DID document support,"
+echo "you'll need to manually add the verificationMethod with your public key."

src/bin/quickdid.rs

···
 use anyhow::Result;
 use atproto_identity::{
     config::{CertificateBundles, DnsNameservers},
-    key::{identify_key, to_public},
     resolve::HickoryDnsResolver,
 };
 use quickdid::{
···
     sqlite_schema::create_sqlite_pool,
     task_manager::spawn_cancellable_task,
 };
-use serde_json::json;
 use std::sync::Arc;
 use tokio::signal;
 use tokio_util::{sync::CancellationToken, task::TaskTracker};
···
                 println!("    -V, --version    Print version information");
                 println!();
                 println!("ENVIRONMENT VARIABLES:");
-                println!("    SERVICE_KEY         Private key for service identity (required)");
                 println!(
                     "    HTTP_EXTERNAL       External hostname for service endpoints (required)"
                 );
···
     config.validate()?;
 
     tracing::info!("Starting QuickDID service on port {}", config.http_port);
-    tracing::info!("Service DID: {}", config.service_did);
     tracing::info!(
         "Cache TTL - Memory: {}s, Redis: {}s, SQLite: {}s",
         config.cache_ttl_memory,
···
 
     // Create DNS resolver
     let dns_resolver = HickoryDnsResolver::create_resolver(dns_nameservers.as_ref());
-
-    // Process service key
-    let private_service_key_data = identify_key(&config.service_key)?;
-    let public_service_key_data = to_public(&private_service_key_data)?;
-    let public_service_key = public_service_key_data.to_string();
-
-    // Create service DID document
-    let service_document = json!({
-        "@context": vec!["https://www.w3.org/ns/did/v1", "https://w3id.org/security/multikey/v1"],
-        "id": config.service_did.clone(),
-        "verificationMethod": [{
-            "id": format!("{}#atproto", config.service_did),
-            "type": "Multikey",
-            "controller": config.service_did.clone(),
-            "publicKeyMultibase": public_service_key
-        }],
-        "service": []
-    });
 
     // Create DNS resolver Arc for sharing
     let dns_resolver_arc = Arc::new(dns_resolver);
···
 
     // Create app context with the queue adapter
     let app_context = AppContext::new(
-        service_document,
-        config.service_did.clone(),
         handle_resolver.clone(),
         handle_queue,
         metrics_publisher,
         config.etag_seed.clone(),
         config.cache_control_header.clone(),
+        config.static_files_dir.clone(),
     );
 
     // Create router

src/config.rs

···
 //! ```bash
 //! # Minimal configuration
 //! HTTP_EXTERNAL=quickdid.example.com \
-//! SERVICE_KEY=did:key:z42tmZxD2mi1TfMKSFrsRfednwdaaPNZiiWHP4MPgcvXkDWK \
 //! quickdid
 //!
 //! # Full configuration with Redis and custom settings
 //! HTTP_EXTERNAL=quickdid.example.com \
-//! SERVICE_KEY=did:key:z42tmZxD2mi1TfMKSFrsRfednwdaaPNZiiWHP4MPgcvXkDWK \
 //! HTTP_PORT=3000 \
 //! REDIS_URL=redis://localhost:6379 \
 //! CACHE_TTL_MEMORY=300 \
···
 pub enum ConfigError {
     /// Missing required environment variable or command-line argument
     ///
-    /// Example: When SERVICE_KEY or HTTP_EXTERNAL are not provided
+    /// Example: When HTTP_EXTERNAL is not provided
     #[error("error-quickdid-config-1 Missing required environment variable: {0}")]
     MissingRequired(String),
 
···
 /// config.validate()?;
 ///
 /// println!("Service running at: {}", config.http_external);
-/// println!("Service DID: {}", config.service_did);
 /// # Ok(())
 /// # }
 /// ```
···
     /// External hostname for service endpoints (e.g., "quickdid.example.com")
     pub http_external: String,
 
-    /// Private key for service identity (e.g., "did:key:z42tm...")
-    pub service_key: String,
-
     /// HTTP User-Agent for outgoing requests (e.g., "quickdid/1.0.0 (+https://...)")
     pub user_agent: String,
-
-    /// Derived service DID (e.g., "did:web:quickdid.example.com")
-    /// Automatically generated from http_external with proper encoding
-    pub service_did: String,
 
     /// Custom DNS nameservers, comma-separated (e.g., "8.8.8.8,8.8.4.4")
     pub dns_nameservers: Option<String>,
···
     /// For example, 0.8 means refresh when an entry has lived for 80% of its TTL.
     /// Default: 0.8 (80%)
     pub proactive_refresh_threshold: f64,
+
+    /// Directory path for serving static files.
+    /// When set, the root handler will serve files from this directory.
+    /// Default: "www" (relative to working directory)
+    pub static_files_dir: String,
 }
 
 impl Config {
···
     ///
     /// This method:
     /// 1. Reads configuration from environment variables
-    /// 2. Validates required fields (HTTP_EXTERNAL and SERVICE_KEY)
-    /// 3. Generates derived values (service_did from http_external)
-    /// 4. Applies defaults where appropriate
+    /// 2. Validates required fields (HTTP_EXTERNAL)
+    /// 3. Applies defaults where appropriate
     ///
     /// ## Example
     ///
···
     /// // Parse from environment variables
     /// let config = Config::from_env()?;
     ///
-    /// // The service DID is automatically generated from HTTP_EXTERNAL
-    /// assert!(config.service_did.starts_with("did:web:"));
     /// # Ok(())
     /// # }
     /// ```
···
     ///
     /// Returns `ConfigError::MissingRequired` if:
     /// - HTTP_EXTERNAL is not provided
-    /// - SERVICE_KEY is not provided
     pub fn from_env() -> Result<Self, ConfigError> {
         // Required fields
         let http_external = env::var("HTTP_EXTERNAL")
···
             .filter(|s| !s.is_empty())
             .ok_or_else(|| ConfigError::MissingRequired("HTTP_EXTERNAL".to_string()))?;
 
-        let service_key = env::var("SERVICE_KEY")
-            .ok()
-            .filter(|s| !s.is_empty())
-            .ok_or_else(|| ConfigError::MissingRequired("SERVICE_KEY".to_string()))?;
-
         // Generate default user agent
         let default_user_agent = format!(
             "quickdid/{} (+https://github.com/smokesignal.events/quickdid)",
             env!("CARGO_PKG_VERSION")
         );
 
-        // Generate service DID from http_external
-        let service_did = if http_external.contains(':') {
-            let encoded_external = http_external.replace(':', "%3A");
-            format!("did:web:{}", encoded_external)
-        } else {
-            format!("did:web:{}", http_external)
-        };
-
         let mut config = Config {
             http_port: get_env_or_default("HTTP_PORT", Some("8080")).unwrap(),
             plc_hostname: get_env_or_default("PLC_HOSTNAME", Some("plc.directory")).unwrap(),
             http_external,
-            service_key,
             user_agent: get_env_or_default("USER_AGENT", None).unwrap_or(default_user_agent),
-            service_did,
             dns_nameservers: get_env_or_default("DNS_NAMESERVERS", None),
             certificate_bundles: get_env_or_default("CERTIFICATE_BUNDLES", None),
             redis_url: get_env_or_default("REDIS_URL", None),
···
             metrics_tags: get_env_or_default("METRICS_TAGS", None),
             proactive_refresh_enabled: parse_env("PROACTIVE_REFRESH_ENABLED", false)?,
             proactive_refresh_threshold: parse_env("PROACTIVE_REFRESH_THRESHOLD", 0.8)?,
+            static_files_dir: get_env_or_default("STATIC_FILES_DIR", Some("www")).unwrap(),
         };
 
         // Calculate the Cache-Control header value if enabled

src/http/server.rs

···
 use axum::{
     Router,
     extract::{MatchedPath, State},
-    http::{Request, StatusCode},
+    http::Request,
     middleware::{self, Next},
-    response::{Html, IntoResponse, Json, Response},
+    response::{Json, Response},
     routing::get,
 };
 use serde_json::json;
 use std::sync::Arc;
 use std::time::Instant;
+use tower_http::services::ServeDir;
 
 pub(crate) struct InnerAppContext {
-    pub(crate) service_document: serde_json::Value,
-    pub(crate) service_did: String,
     pub(crate) handle_resolver: Arc<dyn HandleResolver>,
     pub(crate) handle_queue: Arc<dyn QueueAdapter<HandleResolutionWork>>,
     pub(crate) metrics: SharedMetricsPublisher,
     pub(crate) etag_seed: String,
     pub(crate) cache_control_header: Option<String>,
+    pub(crate) static_files_dir: String,
 }
 
 #[derive(Clone)]
···
 impl AppContext {
     /// Create a new AppContext with the provided configuration.
     pub fn new(
-        service_document: serde_json::Value,
-        service_did: String,
         handle_resolver: Arc<dyn HandleResolver>,
         handle_queue: Arc<dyn QueueAdapter<HandleResolutionWork>>,
         metrics: SharedMetricsPublisher,
         etag_seed: String,
         cache_control_header: Option<String>,
+        static_files_dir: String,
     ) -> Self {
         Self(Arc::new(InnerAppContext {
-            service_document,
-            service_did,
             handle_resolver,
             handle_queue,
             metrics,
             etag_seed,
             cache_control_header,
+            static_files_dir,
         }))
     }
 
     // Internal accessor methods for handlers
-    pub(super) fn service_document(&self) -> &serde_json::Value {
-        &self.0.service_document
-    }
-
-    pub(super) fn service_did(&self) -> &str {
-        &self.0.service_did
-    }
-
     pub(super) fn etag_seed(&self) -> &str {
         &self.0.etag_seed
     }
 
     pub(super) fn cache_control_header(&self) -> Option<&str> {
         self.0.cache_control_header.as_deref()
+    }
+
+    pub(super) fn static_files_dir(&self) -> &str {
+        &self.0.static_files_dir
     }
 }
 
···
 }
 
 pub fn create_router(app_context: AppContext) -> Router {
+    let static_dir = app_context.static_files_dir().to_string();
+
     Router::new()
-        .route("/", get(handle_index))
-        .route("/.well-known/did.json", get(handle_wellknown_did_json))
-        .route(
-            "/.well-known/atproto-did",
-            get(handle_wellknown_atproto_did),
-        )
         .route("/xrpc/_health", get(handle_xrpc_health))
         .route(
             "/xrpc/com.atproto.identity.resolveHandle",
             get(super::handle_xrpc_resolve_handle::handle_xrpc_resolve_handle)
                 .options(super::handle_xrpc_resolve_handle::handle_xrpc_resolve_handle_options),
         )
+        .fallback_service(ServeDir::new(static_dir))
         .layer(middleware::from_fn_with_state(
             app_context.0.metrics.clone(),
             metrics_middleware,
         ))
         .with_state(app_context)
-}
-
-pub(super) async fn handle_index() -> Html<&'static str> {
-    Html(
-        r#"<!DOCTYPE html>
-<html>
-<head>
-    <title>QuickDID</title>
-</head>
-<body>
-    <h1>QuickDID</h1>
-    <p>AT Protocol Identity Resolution Service</p>
-</body>
-</html>"#,
-    )
-}
-
-pub(super) async fn handle_wellknown_did_json(
-    State(context): State<AppContext>,
-) -> Json<serde_json::Value> {
-    Json(context.service_document().clone())
-}
-
-pub(super) async fn handle_wellknown_atproto_did(State(context): State<AppContext>) -> Response {
-    (StatusCode::OK, context.service_did().to_string()).into_response()
 }
 
 pub(super) async fn handle_xrpc_health() -> Json<serde_json::Value> {

src/metrics.rs

···
         // Set up environment for noop adapter
         unsafe {
             env::set_var("HTTP_EXTERNAL", "test.example.com");
-            env::set_var("SERVICE_KEY", "did:key:test");
             env::set_var("METRICS_ADAPTER", "noop");
         }
 
···
         unsafe {
             env::remove_var("METRICS_ADAPTER");
             env::remove_var("HTTP_EXTERNAL");
-            env::remove_var("SERVICE_KEY");
         }
     }
 
···
         // Set up environment for statsd adapter
         unsafe {
             env::set_var("HTTP_EXTERNAL", "test.example.com");
-            env::set_var("SERVICE_KEY", "did:key:test");
             env::set_var("METRICS_ADAPTER", "statsd");
             env::set_var("METRICS_STATSD_HOST", "localhost:8125");
             env::set_var("METRICS_PREFIX", "test");
···
             env::remove_var("METRICS_PREFIX");
             env::remove_var("METRICS_TAGS");
             env::remove_var("HTTP_EXTERNAL");
-            env::remove_var("SERVICE_KEY");
         }
     }
 
···
         // Set up environment for statsd adapter without host
         unsafe {
             env::set_var("HTTP_EXTERNAL", "test.example.com");
-            env::set_var("SERVICE_KEY", "did:key:test");
             env::set_var("METRICS_ADAPTER", "statsd");
             env::remove_var("METRICS_STATSD_HOST");
         }
···
         unsafe {
             env::remove_var("METRICS_ADAPTER");
             env::remove_var("HTTP_EXTERNAL");
-            env::remove_var("SERVICE_KEY");
         }
     }
 
···
         // Set up environment with invalid adapter
         unsafe {
             env::set_var("HTTP_EXTERNAL", "test.example.com");
-            env::set_var("SERVICE_KEY", "did:key:test");
             env::set_var("METRICS_ADAPTER", "invalid");
             env::remove_var("METRICS_STATSD_HOST"); // Clean up from other tests
         }
···
         unsafe {
             env::remove_var("METRICS_ADAPTER");
             env::remove_var("HTTP_EXTERNAL");
-            env::remove_var("SERVICE_KEY");
         }
     }
 }

www/.well-known/atproto-did

···
+did:web:quickdid.smokesignal.tools

www/.well-known/did.json

···
+{
+  "@context": [
+    "https://www.w3.org/ns/did/v1",
+    "https://w3id.org/security/multikey/v1"
+  ],
+  "id": "did:web:quickdid.smokesignal.tools",
+  "verificationMethod": [],
+  "service": [
+    {
+      "id": "#quickdid",
+      "type": "QuickDIDService",
+      "serviceEndpoint": "https://quickdid.smokesignal.tools"
+    }
+  ]
+}

www/README.md

···
+# QuickDID Static Files Directory
+
+This directory contains static files that are served by QuickDID. By default, QuickDID serves files from the `www` directory, but this can be configured using the `STATIC_FILES_DIR` environment variable.
+
+## Directory Structure
+
+```
+www/
+├── .well-known/
+│   ├── atproto-did     # AT Protocol DID identifier
+│   └── did.json        # DID document
+├── index.html          # Landing page
+└── README.md          # This file
+```
+
+## Files
+
+### `.well-known/atproto-did`
+Contains the service's DID identifier (e.g., `did:web:example.com`). This file is used by AT Protocol clients to discover the service's DID.
+
+### `.well-known/did.json`
+Contains the DID document with verification methods and service endpoints. This is a JSON-LD document following the W3C DID specification.
+
+### `index.html`
+The landing page shown when users visit the root URL. This provides information about the service and available endpoints.
+
+## Customization
+
+### Using the Generation Script
+
+You can generate the `.well-known` files for your deployment using the provided script:
+
+```bash
+HTTP_EXTERNAL=your-domain.com ./generate-wellknown.sh
+```
+
+This will create the appropriate files based on your domain.
+
+### Manual Customization
+
+1. **Update `.well-known/atproto-did`**: Replace with your service's DID
+2. **Update `.well-known/did.json`**: Add your public key to the `verificationMethod` array if needed
+3. **Customize `index.html`**: Modify the landing page to match your branding
+
+### Docker Deployment
+
+When using Docker, you can mount custom static files:
+
+```yaml
+volumes:
+  - ./custom-www:/app/www:ro
+```
+
+Or just override specific files:
+
+```yaml
+volumes:
+  - ./custom-index.html:/app/www/index.html:ro
+  - ./custom-wellknown:/app/www/.well-known:ro
+```
+
+### Environment Variable
+
+You can change the static files directory using:
+
+```bash
+STATIC_FILES_DIR=/path/to/custom/www
+```
+
+## Security Notes
+
+- Static files are served with automatic MIME type detection
+- The `.well-known` files are crucial for AT Protocol compatibility
+- Ensure proper permissions on mounted volumes in production

www/index.html

···
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>QuickDID - AT Protocol Identity Resolution Service</title>
+    <style>
+        body {
+            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
+            line-height: 1.6;
+            margin: 0;
+            padding: 20px;
+            max-width: 800px;
+            margin: 0 auto;
+            color: #333;
+        }
+        h1 {
+            color: #2c3e50;
+            border-bottom: 2px solid #3498db;
+            padding-bottom: 10px;
+        }
+        .endpoints {
+            background: #f8f9fa;
+            border-radius: 5px;
+            padding: 20px;
+            margin: 20px 0;
+        }
+        .endpoint {
+            margin: 15px 0;
+            padding: 10px;
+            background: white;
+            border-left: 3px solid #3498db;
+            border-radius: 3px;
+        }
+        .endpoint code {
+            background: #f4f4f4;
+            padding: 2px 5px;
+            border-radius: 3px;
+            font-size: 14px;
+        }
+        .endpoint .method {
+            display: inline-block;
+            padding: 2px 6px;
+            background: #27ae60;
+            color: white;
+            border-radius: 3px;
+            font-size: 12px;
+            font-weight: bold;
+            margin-right: 10px;
+        }
+        .info {
+            background: #e3f2fd;
+            border-left: 4px solid #2196f3;
+            padding: 15px;
+            margin: 20px 0;
+            border-radius: 3px;
+        }
+        a {
+            color: #3498db;
+            text-decoration: none;
+        }
+        a:hover {
+            text-decoration: underline;
+        }
+    </style>
+</head>
+<body>
+    <h1>QuickDID</h1>
+    <p><strong>AT Protocol Identity Resolution Service</strong></p>
+    
+    <div class="info">
+        <p>QuickDID is a high-performance handle-to-DID resolution service for the AT Protocol ecosystem.</p>
+    </div>
+
+    <h2>Available Endpoints</h2>
+    
+    <div class="endpoints">
+        <div class="endpoint">
+            <span class="method">GET</span>
+            <code>/xrpc/com.atproto.identity.resolveHandle</code>
+            <p>Resolve an AT Protocol handle to its DID</p>
+            <p>Parameters: <code>?handle={handle}</code></p>
+        </div>
+        
+        <div class="endpoint">
+            <span class="method">GET</span>
+            <code>/xrpc/_health</code>
+            <p>Health check endpoint</p>
+        </div>
+        
+        <div class="endpoint">
+            <span class="method">GET</span>
+            <code>/.well-known/did.json</code>
+            <p>Service DID document</p>
+        </div>
+        
+        <div class="endpoint">
+            <span class="method">GET</span>
+            <code>/.well-known/atproto-did</code>
+            <p>Service DID identifier</p>
+        </div>
+    </div>
+
+    <h2>Example Usage</h2>
+    <div class="endpoint">
+        <code>curl "https://quickdid.example.com/xrpc/com.atproto.identity.resolveHandle?handle=alice.bsky.social"</code>
+    </div>
+
+    <h2>Documentation</h2>
+    <p>For more information, visit the <a href="https://github.com/your-org/quickdid" target="_blank">QuickDID repository</a>.</p>
+</body>
+</html>