- nginx/docs/PRODUCTION_DEPLOYMENT.md: drop stale htpasswd/Basic-auth model,
manual server-side deploy step, /var/www/posterg paths and hardcoded IP; describe
the PHP-layer AdminAuth, automated 📋 Deploying nginx configuration…
xamxam.conf
sent 145 bytes received 125 bytes 540.00 bytes/sec
total size is 10,012 speedup is 37.08
deploy-server.sh
sent 143 bytes received 113 bytes 512.00 bytes/sec
total size is 8,519 speedup is 33.28, and what deploy-server.sh
actually does.
- nginx/docs/QUICK_REFERENCE.md: replace htpasswd user management with AdminAuth
guidance; fix php8.2->php8.4, log paths, admin rate limit (300r/m), socket path.
- nginx/README.md, nginx/SETUP.md: note 📋 Deploying nginx configuration…
xamxam.conf
sent 145 bytes received 125 bytes 540.00 bytes/sec
total size is 10,012 speedup is 37.08
deploy-server.sh
sent 143 bytes received 113 bytes 170.67 bytes/sec
total size is 8,519 speedup is 33.28 automates
deploy-server.sh (no manual ssh/sudo step).
- docs/deployment.md: correct deploy-code scope (code-only, no --chown), fix the
/var/log/xamxam provisioning step (deploy-server.sh via deploy-nginx, not
deploy-code), document the setup-server.sh prerequisite and fresh-box caveat.
- README.md: replace the incomplete manual first-time setup snippet with the
real setup-server.sh + provision-server flow and a fresh-box caveat.
- Add Content-Security-Policy to main nginx server block (was only on /admin/)
- Add Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy headers
- Add includeSubDomains to HSTS header
- Set HttpOnly, Secure, SameSite=Lax session cookie params on public pages
(AdminAuth already hardens the /admin session with SameSite=Strict)
- Update xamxam.conf.reference and SECURITY_HEADERS.md to match
Pontoporeia