5 Commits

Author	SHA1	Message	Date
timothykim	061213bf7e	retrigger nginx deploy for host key test	2026-03-20 16:35:34 -04:00
timothykim	03e45dc6f2	trigger nginx deploy to test host key pinning	2026-03-20 16:33:15 -04:00
timothykim	cce9b5c4c4	add ssl/tls hardening to nginx	2026-03-20 16:05:41 -04:00
timothykim	b7439b23e3	fix nginx security headers not being applied to https responses ... nginx add_header inheritance meant X-Content-Type-Options and X-Frame-Options were silently dropped from all https server blocks. moved all security headers into a shared snippet (security-headers.inc) included per server block. added pytest-based header verification that auto-discovers sites from conf files.	2026-03-20 15:11:56 -04:00
timothykim	5c38b0631a	replace NPM with vanilla nginx + certbot ... - nginx:alpine replaces nginx-proxy-manager - certbot on host with standalone issuance and auto-renewal - per-site nginx configs in conf.d/ (HTTP->HTTPS, bare->www) - container names use underscores (timothykim_net) - setup.sh: automated cert issuance, dynamic app startup - deploy.sh: nginx -t guard, graceful image-not-found - new-app.sh: Gitea API repo creation, nginx conf generation - add ARCHITECTURE.md, USECASES.md, CLAUDE.md - remove old NPM data/certs from tracking	2026-03-16 00:55:13 -04:00