6 Commits

Author	SHA1	Message	Date
Alexander Schmidt	25cb0e1a5d	Fix deploy permissions and exclude credentials ... - Add --chmod=D755,F644 to rsync (HestiaCP PHP-FPM needs world-readable) - Exclude scripts/.deploy.env from deploy (contains server credentials)	2026-03-27 07:55:54 +01:00
Alexander Schmidt	83e7d43a74	Add CSP, SRI, and auto-hash deploy pipeline ... - Content Security Policy via <meta> tag (blocks exfiltration to foreign domains) - Subresource Integrity on all static and dynamically loaded scripts - Nginx security headers snippet (HSTS, CSP, frame-ancestors on all responses) - Auto-minify and SRI hash update in deploy.sh (prevents stale hashes)	2026-03-27 07:51:01 +01:00
Alexander Schmidt	6f43f34d68	Fix deploy dry-run flag and generalize env example	2026-03-26 14:52:31 +01:00
Alexander Schmidt	77bf794b73	Harden deployment with data backups and restore script	2026-03-26 14:25:35 +01:00
Alexander Schmidt	32d509fe9d	Harden deploy script config handling	2026-03-26 14:07:07 +01:00
Alexander Schmidt	8ae736bbad	Add safe deploy script preserving data directory	2026-03-26 13:55:59 +01:00