bchanot/bchanot-cv
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: .githooks + hooksPath clone note; deploy section synced (native-nginx prod, hardened container path, headers snippet)

Browse Source
This commit is contained in:
Bastien Chanot
2026-07-05 14:12:43 +02:00
parent 7e7bd66384
commit 840632a6f8
1 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+15 -5
View File
@@ -15,10 +15,18 @@ Static single-page site (no framework, no build step). Lives at https://bchanot.
| `.claude/` | Memory registries, tasks, audits | | `.claude/` | Memory registries, tasks, audits |
| `Dockerfile` | Container image build — copies static assets into nginx | | `Dockerfile` | Container image build — copies static assets into nginx |
| `docker-compose.yml` | Service def — host port, hardening (read-only, cap_drop), tmpfs | | `docker-compose.yml` | Service def — host port, hardening (read-only, cap_drop), tmpfs |
| `nginx.conf` | In-container nginx — security headers, CSP, gzip, cache | | `nginx.conf` | In-container nginx — CSP, gzip, cache rules |
| `nginx-security-headers.conf` | Shared security-headers snippet, re-included per location (nginx `add_header` inheritance is all-or-nothing) |
| `.env.example` | Sample env — `PORT` for the host bind | | `.env.example` | Sample env — `PORT` for the host bind |
| `.githooks/` | Versioned git hooks — pre-commit blocks direct code commits on `main`/`develop` (gitflow) |
| `favicon.*`, `apple-touch-icon.png` | Favicon set — SVG primary + ICO/PNG + 180×180 apple-touch | | `favicon.*`, `apple-touch-icon.png` | Favicon set — SVG primary + ICO/PNG + 180×180 apple-touch |
After cloning, wire the versioned hooks once:
```bash
git config core.hooksPath .githooks
```
## Local preview ## Local preview
```bash ```bash
@@ -75,10 +83,12 @@ WCAG AA contrast. Focus visible. Semantic HTML.
## Deploy ## Deploy
Production runs as a Docker container (`bchanot-web`, `nginx:1.27-alpine`) Production currently serves the static files directly from the VPS's native
behind the host's nginx reverse proxy, which terminates TLS and `proxy_pass`es nginx (which also terminates TLS). The repo additionally maintains a hardened
to it. The host port is set via `PORT` (default 8080) and bound to `127.0.0.1`, container path (`bchanot-web`, `nginxinc/nginx-unprivileged:1.28-alpine`,
so all traffic goes through the front proxy. digest-pinned, runs as uid 101 on port 8080) for when a containerized deploy
is preferred: the host port is set via `PORT` (default 8080) and bound to
`127.0.0.1`, so all traffic goes through the front proxy.
```bash ```bash
cp .env.example .env # optional: set PORT cp .env.example .env # optional: set PORT