Self-host Rauschen B display font (Phase 0)

[manuelgeek]

Self-host Rauschen B display font (Phase 0 follow-up)

Splitting the font wiring out of the redesign plan PR (#24) so it can land as a focused change. Same font as droidconKE (droidconKE/droidconKE2022Web#123).

Decisions (already agreed)

• Self-host, woff2 only — exclude the .otf desktop file (not licensed for web distribution).
• Load via @font-face in styles/globals.css (matches the existing --font-family / --font-slab CSS-var setup).
• Licensed archive lives at docs/design/Rauschen B Font-*.zip (gitignored — repo is public).

Steps

• Extract Rauschen-BBook.woff2 → public/fonts/
• Add @font-face for Rauschen B (Book) in styles/globals.css
• Add a --font-display var + utility (or repoint the mis-set --font-slab) and apply to headlines during the redesign
• Confirm the Out of the Dark license permits webfont embedding + storage in a public repo

Open questions

• Headline "BEYOND" reads heavy — Book + outline, or a heavier cut not in the current zip (Book only)?
• Body font — also Rauschen, or a separate face?

Refs #23 · #24 · Parent: droidconKE/droidconKE2022Web#123

cc @NewtonMutugi

[manuelgeek]

Decision — licensing-safe build-time font injection

Repos are public, and the Rauschen B web license very likely prohibits storing the file in a public repo (no-redistribution / no "publicly available" clauses). So we will not commit the font. Instead:

Approach: build-time injection from a private repo

• Font lives in a private repo (e.g. droidconKE/private-fonts (shared with droidconKE)) — never in this public repo. public/fonts/ stays gitignored.
• A prebuild script fetches Rauschen-BBook.woff2 → public/fonts/, resolving auth in order:
  1. FONT_REPO_TOKEN env var — a fine-grained PAT, read-only (Contents) on the font repo. Set as an app/instance env var on EC2.
  2. else gh auth token — a dev's existing GitHub login (local builds).
  3. else free fallback font so public / external-contributor builds still succeed.
• Served via @font-face in styles/globals.css from our own server (licensed self-hosting ✅).
• Access = membership of the private font repo; revoke by removing access.

Build target: EC2 (self-hosted) — supports both the env-PAT path and a one-time gh auth login on the host.

To do

• Confirm the real EULA from the original purchase (Out of the Dark / Proof&Co. — not the MyFonts/Monotype one). If it does permit public-repo storage, we can skip all this and just commit the woff2.
• Create droidconKE/private-fonts (shared with droidconKE); add the woff2; add a read-only PAT as FONT_REPO_TOKEN on EC2 (note: fine-grained PATs expire — rotate, or use a GitHub App/deploy key for non-expiring).
• Add scripts/fetch-font.sh + prebuild hook + free fallback font.
• Source the heavier Rauschen B weight (Bold/Black) for the "BEYOND" headline — current zip has Book only.

Refs #23 · #24 · Parent: droidconKE/droidconKE2022Web#125
cc @NewtonMutugi