mirror of https://codeberg.org/PostERG/xamxam.git synced 2026-09-25 01:53:03 +02:00

Files

T

Pontoporeia 0e009c49d4 docs: align deployment/setup docs with current code

- nginx/docs/PRODUCTION_DEPLOYMENT.md: drop stale htpasswd/Basic-auth model,
  manual server-side deploy step, /var/www/posterg paths and hardcoded IP; describe
  the PHP-layer AdminAuth, automated 📋 Deploying nginx configuration…
xamxam.conf

sent 145 bytes  received 125 bytes  540.00 bytes/sec
total size is 10,012  speedup is 37.08
deploy-server.sh

sent 143 bytes  received 113 bytes  512.00 bytes/sec
total size is 8,519  speedup is 33.28, and what deploy-server.sh
  actually does.
- nginx/docs/QUICK_REFERENCE.md: replace htpasswd user management with AdminAuth
  guidance; fix php8.2->php8.4, log paths, admin rate limit (300r/m), socket path.
- nginx/README.md, nginx/SETUP.md: note 📋 Deploying nginx configuration…
xamxam.conf

sent 145 bytes  received 125 bytes  540.00 bytes/sec
total size is 10,012  speedup is 37.08
deploy-server.sh

sent 143 bytes  received 113 bytes  170.67 bytes/sec
total size is 8,519  speedup is 33.28 automates
  deploy-server.sh (no manual ssh/sudo step).
- docs/deployment.md: correct deploy-code scope (code-only, no --chown), fix the
  /var/log/xamxam provisioning step (deploy-server.sh via deploy-nginx, not
  deploy-code), document the setup-server.sh prerequisite and fresh-box caveat.
- README.md: replace the incomplete manual first-time setup snippet with the
  real setup-server.sh + provision-server flow and a fresh-box caveat.

2026-09-18 16:26:49 +02:00

2.9 KiB

Raw Blame History

Nginx Configuration - XAMXAM

This directory contains nginx configuration and documentation for the XAMXAM TFE website.

📁 Files

xamxam.conf - Complete nginx configuration file
docs/ - Documentation
- PRODUCTION_DEPLOYMENT.md - Deployment guide
- QUICK_REFERENCE.md - Command reference
- SECURITY_HEADERS.md - Security headers reference
- PHP_AUTH_LAYER.md - Authentication layer documentation
- HTACCESS_TO_NGINX.md - Apache to nginx migration notes
- TEST_DATABASE_SETUP.md - Test database deployment

🚀 Quick Start

Deploy nginx configuration

# From your local machine — this uploads nginx/xamxam.conf + scripts/deploy-server.sh,
# runs the script as root, then cleans up the remote temp files. No server-side step needed.
just deploy-nginx

The deployment script (scripts/deploy-server.sh) will:

✅ Fix file permissions (www-data:xamxam)
✅ Install nginx configuration
✅ Test and reload nginx
✅ Reload php-fpm (session-GC tuning) and verify it is running

Manage admin password

The admin password is managed via the admin panel at /admin/parametres → Account tab.

🔒 Security Features

Admin Panel Protection

Password required for /admin/ (password-only, no username)
PHP session-based authentication (AdminAuth)
Rate limited: 300 req/min, burst=30

File Access Protection

Database files (.db) - BLOCKED
Sensitive files (.md, .sql, .env) - BLOCKED
/src directory - BLOCKED
/templates directory - BLOCKED
/config directory - BLOCKED
/storage directory - BLOCKED
Hidden files (.git, etc.) - BLOCKED

Rate Limiting

General requests: 30/minute
Search endpoint: 30/minute
Admin panel: 300 req/min (burst=30)

Security Headers

✅ X-Frame-Options (clickjacking protection)
✅ X-Content-Type-Options (MIME sniffing protection)
✅ Strict-Transport-Security (force HTTPS)
✅ Referrer-Policy (referrer control)
✅ Permissions-Policy (disable browser features)

📚 Documentation

docs/PRODUCTION_DEPLOYMENT.md - Complete deployment guide
docs/QUICK_REFERENCE.md - Command reference and troubleshooting
docs/SECURITY_HEADERS.md - Security headers reference

🧪 Testing

# Test admin authentication
curl -I https://xamxam.erg.be/admin/

# Test file protection
curl -I https://xamxam.erg.be/storage/test.db

# Test security headers
curl -I https://xamxam.erg.be/ | grep -E "X-|Strict-Transport"

🆘 Quick Help

502 Bad Gateway

sudo systemctl status php8.4-fpm
sudo systemctl restart php8.4-fpm

Configuration errors

sudo nginx -t

📊 Monitoring

# Watch logs
sudo tail -f /var/log/nginx/xamxam-nginx-access.log
sudo tail -f /var/log/nginx/xamxam-nginx-error.log

# Check nginx status
sudo systemctl status nginx

2.9 KiB Raw Blame History