feat: launch desfoto.de as a standalone photography site and retire the old redirect

2026-09-19 16:02:16 +02:00
commit 160ec017eb
218 changed files with 7518 additions and 0 deletions
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -0,0 +1,112 @@
+# Deployment — desfoto.de
+
+## Zielumgebung
+
+| Baustein | Wert |
+| --- | --- |
+| Produktionshost | `prod-main` = `opencode-prod@87.106.24.138` (NOPASSWD sudo) |
+| Live-Verzeichnis | `/home/denny/stacks/desfoto/` (Owner `denny:denny`) |
+| Release-Snapshots | `/home/denny/stacks/desfoto-releases/<stamp>-<sha>/` |
+| Compose-Dateien | `compose.yml` + `compose.vps.yml`, Projektname `desfoto` |
+| Container | `desfoto-web-1` (`nginx:1.28-alpine`), gebunden an `127.0.0.1:18430` |
+| Netzwerk | externes Docker-Netzwerk `web` (Traefik-Docker-Provider) |
+| Reverse Proxy | Traefik v3 im Projekt `stack` (`/srv/stack/docker-compose.yml`) |
+| Entrypoints | `http` und `https`, ACME-Resolver `le`, HTTP-01-Challenge |
+| Zertifikate | `/srv/traefik/acme.json` |
+| Domains | `desfoto.de` (kanonisch) und `www.desfoto.de` → 301 auf Apex |
+
+Der Proxy wird **niemals** neu gestartet oder neu erzeugt. Die Anbindung erfolgt
+ausschließlich über Labels in `compose.vps.yml`.
+
+## Ablauf einer Veröffentlichung
+
+```bash
+/home/king/bin/oc-release /home/king/projects/desfoto \
+  "feat: ..." <geänderte Dateien...>
+```
+
+`oc-release` committet und pusht die genannten Dateien und ruft danach die
+getrackten Hooks auf:
+
+1. `.ocauto/deploy <sha>`
+   - prüft, dass `HEAD` dem Release entspricht und `site/`, `nginx.conf`,
+     `compose.yml`, `compose.vps.yml` keine uncommitteten Änderungen haben;
+   - packt diese Pfade in ein Archiv und lädt es nach `prod-main:/tmp`;
+   - legt auf dem Server zuerst einen Snapshot der aktuell laufenden Version an
+     (`/home/denny/stacks/desfoto-releases/<stamp>-<sha>/`, zusätzlich als
+     `previous` verlinkt);
+   - entpackt die neue Version nach `/home/denny/stacks/desfoto/`, setzt den
+     Owner auf `denny:denny` und schreibt die Release-Kennung nach `RELEASE`;
+   - `docker compose -f compose.yml -f compose.vps.yml up -d --remove-orphans`
+     und wartet auf `healthy`;
+   - entfernt einmalig die veralteten `desfoto.de`-Weiterleitungs-Labels aus
+     `/srv/stack/docker-compose.yml`: Es werden ausschließlich Traefik-Label-Zeilen
+     mit `desfoto`-Bezug sowie der zugehörige Kommentar entfernt, das Ergebnis wird
+     zuerst als Compose-Projekt validiert (`config --quiet`) und danach per atomarem
+     `mv` an die Stelle der Live-Datei gesetzt. Eine Vorher-Fassung liegt im
+     Snapshot (`docker-compose.yml.stack-backup`) und daneben als
+     `docker-compose.yml.bak.<stamp>`. Danach wird ausschließlich der
+     `landing`-Container mit `--no-deps` neu erzeugt, damit `dennyapp.de` und
+     `dennyschulz.de` unverändert weiterlaufen. Bleibt eine `desfoto`-Referenz
+     übrig (z. B. ein eigener Service-Block), wird sie als WARNUNG ausgegeben.
+
+2. `.ocauto/verify <sha>`
+   - vergleicht den Dateibaum unter `/home/denny/stacks/desfoto/site` mit dem
+     committeten `site/` (SHA-256 über alle Dateien außer den datierten
+     `sitemap.xml`/`security.txt`);
+   - prüft alle 13 Routen, die 404-Seite, `robots.txt`, `sitemap.xml`,
+     `.well-known/security.txt`, Bilder und Schriften;
+   - prüft die Weiterleitungen `http → https` und `www → Apex`;
+   - prüft die Sicherheits-Header, dass kein `Set-Cookie` gesetzt wird und dass
+     das Zertifikat noch mindestens sieben Tage gültig ist;
+   - prüft, dass `www.dennyschulz.de` und `dennyapp.de` weiterhin erreichbar sind.
+
+## Routing
+
+`desfoto.de` wird vor dem Aufräumen bereits vom neuen Container bedient, weil die
+Routers in `compose.vps.yml` eine explizite Traefik-Priorität `200` tragen und die
+alten Weiterleitungsrouters keine Priorität setzen (damit gilt dort die
+Regel-Länge). Der Container wird also zuerst gesund geprüft, und erst danach werden
+die alten Labels entfernt — der Übergang hat damit kein Fenster ohne Antwort.
+
+`www.desfoto.de` wird über die Middleware `desfoto-canonical` dauerhaft auf
+`https://desfoto.de/...` umgeschrieben. Für `http` greift die globale
+Entrypoint-Weiterleitung von Traefik auf `https`; die ACME-HTTP-01-Challenge
+beantwortet Traefik selbst, bevor diese Weiterleitung greift.
+
+## Rollback
+
+```bash
+ROLLBACK_TO=/home/denny/stacks/desfoto-releases/<stamp>-<sha> \
+  /home/king/projects/desfoto/.ocauto/deploy rollback
+```
+
+Der Befehl synchronisiert `site/`, `nginx.conf` und beide Compose-Dateien aus dem
+Snapshot zurück nach `/home/denny/stacks/desfoto/` und startet den Stack neu. Die
+frühere Version bleibt so lange verfügbar, bis sie bewusst gelöscht wird.
+
+Jeder Release legt den Snapshot an, auch der allererste. Enthält der Snapshot noch
+kein `site/` (weil vorher nichts ausgeliefert wurde), entfernt der Rollback den
+desfoto-Stack wieder und stellt den Zustand vor der Veröffentlichung her.
+
+Wurde `/srv/stack/docker-compose.yml` verändert, liegt die Vorher-Fassung sowohl im
+Snapshot als `docker-compose.yml.stack-backup` als auch daneben unter
+`docker-compose.yml.bak.<stamp>`. Beide werden vom Rollback automatisch
+zurückgespielt, gefolgt von `docker compose up -d --no-deps landing`; das Backup
+`.bak.<stamp>` bleibt zusätzlich für einen manuellen Eingriff liegen.
+
+## Betrieb
+
+```bash
+ssh prod-main
+sudo docker compose -f /home/denny/stacks/desfoto/compose.yml \
+                    -f /home/denny/stacks/desfoto/compose.vps.yml ps
+sudo docker logs --tail 50 desfoto-web-1
+sudo docker inspect --format '{{.State.Health.Status}}' desfoto-web-1
+```
+
+Access-Logs gibt es bewusst nicht (`access_log off` in `nginx.conf`). Auch Fehler
+schreibt nginx nicht weg: `error_log /dev/null crit;` verwirft sie vollständig,
+statt sie in eine Datei zu schreiben. Der JSON-Log-Treiber des Containers ist
+zusätzlich auf 5 MB × 2 Dateien begrenzt. Das entspricht der Zusage in der
+Datenschutzerklärung.
--- a/docs/font-fraunces-OFL.txt
+++ b/docs/font-fraunces-OFL.txt
@@ -0,0 +1,93 @@
+Copyright 2018 The Fraunces Project Authors (https://github.com/undercasetype/Fraunces)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.
--- a/docs/font-manrope-OFL.txt
+++ b/docs/font-manrope-OFL.txt
@@ -0,0 +1,93 @@
+Copyright 2018 The Manrope Project Authors (https://github.com/googlefonts/manrope)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.