# XAMXAM

(Anciennement *[Posterg](https://wiki.erg.be/m/#Posterg))*

Répertoire des travaux de fin d'études de l'[ERG](https://erg.be) (École de Recherche Graphique).

## Requirements

- PHP ≥ 8.4 (with `ext-json`, `ext-openssl`, `ext-pdo`, `ext-sqlite3`)
- Composer
- Node.js / npm
- nginx (production)

## Development

```bash
# one-time
composer install
npm ci

# run the dev server (builds assets, applies migrations, opens a browser)
just dev                    # http://127.0.0.1:8000 (public) and /admin/
just stop                   # stop it
```

Live CSS/JS rebuilds happen automatically via a chokidar watcher while `just dev` runs.
See [`docs/development.md`](docs/development.md) for the full workflow.

## Deployment

Files are pushed to the server with rsync — there is no repo on the remote.

```bash
just deploy     # rsync app files → xamxam:/var/www/xamxam/
just deploy-db  # push local xamxam.db → remote (only if remote DB is absent)
```

`deploy-db` refuses to run if a database already exists on the server, to avoid
accidental overwrites of production data.

### First-time server setup

First bootstrap the role/user/dirs with `scripts/setup-server.sh`, then the one-shot
remote provisioning recipe, which deploys code, nginx, and cron jobs:

```bash
# 1. role/user/dir bootstrap (creates xamxam group, /var/www/xamxam, perms):
#    equivalent to: ssh -t xamxam "sudo DEPLOY_USER=\$USER bash /tmp/setup-server.sh"
rsync scripts/setup-server.sh xamxam:/tmp/setup-server.sh
ssh -t xamxam "sudo DEPLOY_USER=\$USER bash /tmp/setup-server.sh"

# 2. full provisioning (env/APP_KEY + deploy + nginx + backup + cleanup cron + logrotate):
just provision-server
```

> **Fresh box caveat:** `provision-server` assumes `setup-server.sh` already ran.
> On a truly empty `/var/www/xamxam`, run `setup-server.sh` (or re-apply
> `deploy-server.sh` via `just deploy-nginx`) first, otherwise the deploy's
> rsync hits `Permission denied` on `storage/`.

`just deploy` / `just deploy-nginx` apply code + nginx config:

```bash
just deploy
just deploy-nginx   # included in `just deploy` and `just provision-server`
```

See [docs/deployment.md](docs/deployment.md) for the full workflow and the
podman test environment in [test-env/README.md](test-env/README.md) to validate
any of this against a fresh throwaway box.

## Security notes

- Admin panel protected by PHP session (`AdminAuth`) — password-only, no username
- Uploads stored outside webroot, served via controlled `/media` (`MediaController`)
- Rate limiting on public search (`app/src/RateLimit.php`)
- See `nginx/docs/SECURITY_HEADERS.md` for security headers reference

## More docs

See [`docs/README.md`](docs/README.md) for the full documentation index.