46 lines
3.1 KiB
Markdown
46 lines
3.1 KiB
Markdown
# Live VPS source reconciliation
|
|
|
|
## Source of truth
|
|
|
|
This reconciliation imports the already deployed application source from `/root/anwarpi` into `web/`. The owner explicitly confirmed that the VPS copy, including its package manifest and lockfile, is authoritative. It does not deploy or restart the website.
|
|
|
|
Included features:
|
|
|
|
- Admin-only user creation and protected administrative user fields.
|
|
- Free early-access reading with registration, checkout and notification signup disabled.
|
|
- The exact trial banner, current policy pages and support contact.
|
|
- Arabic branding «أنور پآي» and site-wide «محتوى» labels.
|
|
- SEO titles/descriptions, utility-page noindex and absolute Article image URLs.
|
|
- Most-read homepage cards based on the published collection's cumulative views.
|
|
- Click-to-load privacy-enhanced YouTube embeds and same-origin inline raster images.
|
|
- Bundled Readex Pro font with its OFL license.
|
|
- The deployed daily backup script and cron definition under `ops/`.
|
|
|
|
## Deliberate exclusions
|
|
|
|
Do not import `.env` files, secrets, database dumps, backups, uploads/media, private files, build output, dependency directories or TypeScript build caches into Git. Published article records remain in the production CMS database; they are not application-source files.
|
|
|
|
Generated `payload-types.ts` remains generated/ignored. The repository's existing removal of a hardcoded publishing key from `web/docs/agent-publish-api.md` is retained rather than copying that key back from an older live document.
|
|
|
|
## Dependencies and security
|
|
|
|
The deployed `web/package.json` and `web/package-lock.json` are imported as requested. This replaces repository-only dependency/tooling edits and CVE overrides that were not on the live VPS. This release is a source reconciliation, **not a security upgrade**, and does not claim to resolve dependency advisories. Keep the existing recorded Next.js risk acceptance visible and evaluate upgrades separately.
|
|
|
|
## Verification
|
|
|
|
Before publication, the reconciled application passed:
|
|
|
|
- `npm ci --ignore-scripts --no-audit --no-fund`.
|
|
- `npm run test:launch`: 10 tests passed, 0 failed.
|
|
- `npm run generate:types`.
|
|
- `npx tsc --noEmit`.
|
|
- `npm run build`: Next.js production build completed successfully.
|
|
|
|
Added-line credential/injection screening found no literal credentials. Linting is skipped by the deployed build configuration; these results do not claim a separate lint pass or a remote CI run. The independent pre-publication review is recorded in the reconciliation's private evidence, not treated as a substitute for the commands above.
|
|
|
|
## Operational files
|
|
|
|
`ops/daily_backup.py` is the deployed `/root/anwarpy-daily-backup.py`; `ops/anwarpy-backup.cron` is the deployed cron definition. Their paths and container names reflect the current installation. Merely merging these files does not install cron or run a backup.
|
|
|
|
Backup archives include runtime configuration and potentially sensitive data. Keep their destination root-only and never publish archive contents. This workflow did not read or change production data, invoke a backup, apply migrations, or deploy a replacement image.
|