fix: reconcile approved live VPS source and operations

2026-10-13 18:04:15 +03:00
parent 36f508df75
commit 6385d60dff
57 changed files with 2474 additions and 4630 deletions
@@ -0,0 +1,45 @@
+# Live VPS source reconciliation
+
+## Source of truth
+
+This reconciliation imports the already deployed application source from `/root/anwarpi` into `web/`. The owner explicitly confirmed that the VPS copy, including its package manifest and lockfile, is authoritative. It does not deploy or restart the website.
+
+Included features:
+
+- Admin-only user creation and protected administrative user fields.
+- Free early-access reading with registration, checkout and notification signup disabled.
+- The exact trial banner, current policy pages and support contact.
+- Arabic branding «أنور پآي» and site-wide «محتوى» labels.
+- SEO titles/descriptions, utility-page noindex and absolute Article image URLs.
+- Most-read homepage cards based on the published collection's cumulative views.
+- Click-to-load privacy-enhanced YouTube embeds and same-origin inline raster images.
+- Bundled Readex Pro font with its OFL license.
+- The deployed daily backup script and cron definition under `ops/`.
+
+## Deliberate exclusions
+
+Do not import `.env` files, secrets, database dumps, backups, uploads/media, private files, build output, dependency directories or TypeScript build caches into Git. Published article records remain in the production CMS database; they are not application-source files.
+
+Generated `payload-types.ts` remains generated/ignored. The repository's existing removal of a hardcoded publishing key from `web/docs/agent-publish-api.md` is retained rather than copying that key back from an older live document.
+
+## Dependencies and security
+
+The deployed `web/package.json` and `web/package-lock.json` are imported as requested. This replaces repository-only dependency/tooling edits and CVE overrides that were not on the live VPS. This release is a source reconciliation, **not a security upgrade**, and does not claim to resolve dependency advisories. Keep the existing recorded Next.js risk acceptance visible and evaluate upgrades separately.
+
+## Verification
+
+Before publication, the reconciled application passed:
+
+- `npm ci --ignore-scripts --no-audit --no-fund`.
+- `npm run test:launch`: 10 tests passed, 0 failed.
+- `npm run generate:types`.
+- `npx tsc --noEmit`.
+- `npm run build`: Next.js production build completed successfully.
+
+Added-line credential/injection screening found no literal credentials. Linting is skipped by the deployed build configuration; these results do not claim a separate lint pass or a remote CI run. The independent pre-publication review is recorded in the reconciliation's private evidence, not treated as a substitute for the commands above.
+
+## Operational files
+
+`ops/daily_backup.py` is the deployed `/root/anwarpy-daily-backup.py`; `ops/anwarpy-backup.cron` is the deployed cron definition. Their paths and container names reflect the current installation. Merely merging these files does not install cron or run a backup.
+
+Backup archives include runtime configuration and potentially sensitive data. Keep their destination root-only and never publish archive contents. This workflow did not read or change production data, invoke a backup, apply migrations, or deploy a replacement image.