7 Commits

Author	SHA1	Message	Date
timothykim	5e85de9130	fix deploy race condition and harden security ... - reorder app.sh to run cert before commit/push (fixes workflow failure on first run) - quote $SSH_ORIGINAL_COMMAND in authorized_keys to prevent command injection - add port validation in service.sh nginx command - pin host key in deploy-beszel.yml workflow - fix append vs overwrite for known_hosts in deploy-nginx.yml	2026-04-10 15:00:10 -04:00
timothykim	449b763621	add goatcounter tracking to all sites via nginx sub_filter	2026-04-09 16:54:35 -04:00
timothykim	d2b9d0bce9	fix idempotency in app.sh, service.sh and nginx reload in cert handler	2026-04-07 15:56:59 -04:00
timothykim	697de3e199	add uptimerobot monitor subcommand to app.sh	2026-03-26 13:13:41 -04:00
timothykim	7daf7a267b	pin ssh host key in all workflows	2026-03-20 16:31:03 -04:00
timothykim	b7439b23e3	fix nginx security headers not being applied to https responses ... nginx add_header inheritance meant X-Content-Type-Options and X-Frame-Options were silently dropped from all https server blocks. moved all security headers into a shared snippet (security-headers.inc) included per server block. added pytest-based header verification that auto-discovers sites from conf files.	2026-03-20 15:11:56 -04:00
timothykim	3b41653c04	refactor new-app into app.sh with subcommands	2026-03-20 14:43:47 -04:00