mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-09-25 01:53:03 +02:00
Pontoporeia
0e009c49d4
- nginx/docs/PRODUCTION_DEPLOYMENT.md: drop stale htpasswd/Basic-auth model, manual server-side deploy step, /var/www/posterg paths and hardcoded IP; describe the PHP-layer AdminAuth, automated 📋 Deploying nginx configuration… xamxam.conf sent 145 bytes received 125 bytes 540.00 bytes/sec total size is 10,012 speedup is 37.08 deploy-server.sh sent 143 bytes received 113 bytes 512.00 bytes/sec total size is 8,519 speedup is 33.28, and what deploy-server.sh actually does. - nginx/docs/QUICK_REFERENCE.md: replace htpasswd user management with AdminAuth guidance; fix php8.2->php8.4, log paths, admin rate limit (300r/m), socket path. - nginx/README.md, nginx/SETUP.md: note 📋 Deploying nginx configuration… xamxam.conf sent 145 bytes received 125 bytes 540.00 bytes/sec total size is 10,012 speedup is 37.08 deploy-server.sh sent 143 bytes received 113 bytes 170.67 bytes/sec total size is 8,519 speedup is 33.28 automates deploy-server.sh (no manual ssh/sudo step). - docs/deployment.md: correct deploy-code scope (code-only, no --chown), fix the /var/log/xamxam provisioning step (deploy-server.sh via deploy-nginx, not deploy-code), document the setup-server.sh prerequisite and fresh-box caveat. - README.md: replace the incomplete manual first-time setup snippet with the real setup-server.sh + provision-server flow and a fresh-box caveat.
83 lines
2.7 KiB
Markdown
83 lines
2.7 KiB
Markdown
# XAMXAM
|
|
|
|
(Anciennement *[Posterg](https://wiki.erg.be/m/#Posterg))*
|
|
|
|
Répertoire des travaux de fin d'études de l'[ERG](https://erg.be) (École de Recherche Graphique).
|
|
|
|
## Requirements
|
|
|
|
- PHP ≥ 8.4 (with `ext-json`, `ext-openssl`, `ext-pdo`, `ext-sqlite3`)
|
|
- Composer
|
|
- Node.js / npm
|
|
- nginx (production)
|
|
|
|
## Development
|
|
|
|
```bash
|
|
# one-time
|
|
composer install
|
|
npm ci
|
|
|
|
# run the dev server (builds assets, applies migrations, opens a browser)
|
|
just dev # http://127.0.0.1:8000 (public) and /admin/
|
|
just stop # stop it
|
|
```
|
|
|
|
Live CSS/JS rebuilds happen automatically via a chokidar watcher while `just dev` runs.
|
|
See [`docs/development.md`](docs/development.md) for the full workflow.
|
|
|
|
## Deployment
|
|
|
|
Files are pushed to the server with rsync — there is no repo on the remote.
|
|
|
|
```bash
|
|
just deploy # rsync app files → xamxam:/var/www/xamxam/
|
|
just deploy-db # push local xamxam.db → remote (only if remote DB is absent)
|
|
```
|
|
|
|
`deploy-db` refuses to run if a database already exists on the server, to avoid
|
|
accidental overwrites of production data.
|
|
|
|
### First-time server setup
|
|
|
|
First bootstrap the role/user/dirs with `scripts/setup-server.sh`, then the one-shot
|
|
remote provisioning recipe, which deploys code, nginx, and cron jobs:
|
|
|
|
```bash
|
|
# 1. role/user/dir bootstrap (creates xamxam group, /var/www/xamxam, perms):
|
|
# equivalent to: ssh -t xamxam "sudo DEPLOY_USER=\$USER bash /tmp/setup-server.sh"
|
|
rsync scripts/setup-server.sh xamxam:/tmp/setup-server.sh
|
|
ssh -t xamxam "sudo DEPLOY_USER=\$USER bash /tmp/setup-server.sh"
|
|
|
|
# 2. full provisioning (env/APP_KEY + deploy + nginx + backup + cleanup cron + logrotate):
|
|
just provision-server
|
|
```
|
|
|
|
> **Fresh box caveat:** `provision-server` assumes `setup-server.sh` already ran.
|
|
> On a truly empty `/var/www/xamxam`, run `setup-server.sh` (or re-apply
|
|
> `deploy-server.sh` via `just deploy-nginx`) first, otherwise the deploy's
|
|
> rsync hits `Permission denied` on `storage/`.
|
|
|
|
`just deploy` / `just deploy-nginx` apply code + nginx config:
|
|
|
|
```bash
|
|
just deploy
|
|
just deploy-nginx # included in `just deploy` and `just provision-server`
|
|
```
|
|
|
|
See [docs/deployment.md](docs/deployment.md) for the full workflow and the
|
|
podman test environment in [test-env/README.md](test-env/README.md) to validate
|
|
any of this against a fresh throwaway box.
|
|
|
|
## Security notes
|
|
|
|
- Admin panel protected by PHP session (`AdminAuth`) — password-only, no username
|
|
- Uploads stored outside webroot, served via controlled `/media` (`MediaController`)
|
|
- Rate limiting on public search (`app/src/RateLimit.php`)
|
|
- See `nginx/docs/SECURITY_HEADERS.md` for security headers reference
|
|
|
|
## More docs
|
|
|
|
See [`docs/README.md`](docs/README.md) for the full documentation index.
|
|
|