bert.hausmans
28727f246b
Remove apps/admin/ entirely — platform admin functionality now lives in apps/app/ under /platform/* routes for super_admin users. Production URL scheme changed: - Organizer app: crewli.app (was app.crewli.app) - Portal: portal.crewli.app (unchanged) - API: api.crewli.app (unchanged) - admin.crewli.app and app.crewli.app retired Backend: - Removed FRONTEND_ADMIN_URL config and admin cookie (crewli_admin_token) from SetAuthCookie, CookieBearerToken, cors.php, app.php - Updated .env and .env.example (two origins, no port 5173) - Updated cookie test: admin origin test → unknown origin fallback test Infrastructure: - Makefile: removed admin target - deploy/nginx: updated CSP comment, removed admin vhost - Updated README.md, CLAUDE.md, and all dev-docs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1.4 KiB
1.4 KiB
Crewli Deployment — Security Configuration
Nginx Security Headers
Copy the configuration snippets to your Nginx server:
API (api.crewli.app)
server {
server_name api.crewli.app;
include /path/to/deploy/nginx/security-headers.conf;
include /path/to/deploy/nginx/csp-api.conf;
# ... rest of config
}
Organizer App (crewli.app)
server {
server_name crewli.app;
include /path/to/deploy/nginx/security-headers.conf;
include /path/to/deploy/nginx/csp-spa.conf;
# ... rest of config
}
Portal (portal.crewli.app)
server {
server_name portal.crewli.app;
include /path/to/deploy/nginx/security-headers.conf;
include /path/to/deploy/nginx/csp-portal.conf;
# ... rest of config
}
CSP Rollout Process
- Start with
Content-Security-Policy-Report-Only(uncomment incsp-spa.conf) - Monitor browser console for CSP violations for 1-2 weeks
- Add any missing sources to the policy
- Switch to enforcing
Content-Security-Policy - Monitor for false positives after enforcement
DirectAdmin Integration
If using DirectAdmin with Nginx:
- Place the
.conffiles in/usr/local/directadmin/data/users/USERNAME/nginx.confor use DirectAdmin's custom Nginx configuration feature - Reload Nginx:
service nginx reload - Verify headers:
curl -I https://crewli.app | grep -i security