- ops/nginx/: the two nginx sites as they now run on 249. Only ArvanCloud
edges reach the app (direct hits on the IP get 403, so Arvan's DDoS/WAF
can't be skipped); the frontend gets CSP (own sources only, the one inline
script by hash), X-Frame-Options, nosniff, Referrer-Policy,
Permissions-Policy, HSTS; API body limit 100M -> 20M plus HSTS. Checked from
outside and in Chrome (all tabs and an island quiz, logged in): no CSP errors.
- Demo accounts (users 11-15, 25) and TEST_LOGIN_PHONES removed from the server;
the health warning for fixed-code logins now has a test and says how to
test instead (an OTPCode made in the admin).
- SMS daily cap on the server is 2000 (launch of ~600 users).
- CLAUDE.md: never run tests with --parallel on macOS, always --noinput
(both hang forever without an error).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- ops/pgbackup: SSH tunnel + pg_receivewal (slot zareian_247) + daily verified pg_basebackup (keep 7)
and a restore check, all run on 78.38.35.247 as systemd units
- /api/health reports offsiteBackup (slot active/lag/lost) and warns; OFFSITE_WAL_SLOT setting
- removed statuslog backup_db/backup_verify and their health warnings
- deploy.sh keeps 3 pre-deploy dumps, 3 local patches, drops manual backups after 30 days
- docs: operations backup section, security item 14 closed, CLAUDE.md status
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
