Live VPS source reconciliation

Source of truth

This reconciliation imports the already deployed application source from /root/anwarpi into web/. The owner explicitly confirmed that the VPS copy, including its package manifest and lockfile, is authoritative. It does not deploy or restart the website.

Included features:

Admin-only user creation and protected administrative user fields.
Free early-access reading with registration, checkout and notification signup disabled.
The exact trial banner, current policy pages and support contact.
Arabic branding «أنور پآي» and site-wide «محتوى» labels.
SEO titles/descriptions, utility-page noindex and absolute Article image URLs.
Most-read homepage cards based on the published collection's cumulative views.
Click-to-load privacy-enhanced YouTube embeds and same-origin inline raster images.
Bundled Readex Pro font with its OFL license.
The deployed daily backup script and cron definition under ops/.

Deliberate exclusions

Do not import .env files, secrets, database dumps, backups, uploads/media, private files, build output, dependency directories or TypeScript build caches into Git. Published article records remain in the production CMS database; they are not application-source files.

Generated payload-types.ts remains generated/ignored. The repository's existing removal of a hardcoded publishing key from web/docs/agent-publish-api.md is retained rather than copying that key back from an older live document.

Dependencies and security

The deployed web/package.json and web/package-lock.json are imported as requested. This replaces repository-only dependency/tooling edits and CVE overrides that were not on the live VPS. This release is a source reconciliation, not a security upgrade, and does not claim to resolve dependency advisories. Keep the existing recorded Next.js risk acceptance visible and evaluate upgrades separately.

Verification

Before publication, the reconciled application passed:

npm ci --ignore-scripts --no-audit --no-fund.
npm run test:launch: 10 tests passed, 0 failed.
npm run generate:types.
npx tsc --noEmit.
npm run build: Next.js production build completed successfully.

Added-line credential/injection screening found no literal credentials. Linting is skipped by the deployed build configuration; these results do not claim a separate lint pass or a remote CI run. The independent pre-publication review is recorded in the reconciliation's private evidence, not treated as a substitute for the commands above.

Operational files

ops/daily_backup.py is the deployed /root/anwarpy-daily-backup.py; ops/anwarpy-backup.cron is the deployed cron definition. Their paths and container names reflect the current installation. Merely merging these files does not install cron or run a backup.

Backup archives include runtime configuration and potentially sensitive data. Keep their destination root-only and never publish archive contents. This workflow did not read or change production data, invoke a backup, apply migrations, or deploy a replacement image.

3.1 KiB Raw Permalink Blame History