net10, pointed at PrivaPub, and deployed as a static site to decepub.thepra.dev

The project referenced ../SocialPub/SocialPub/SocialPub.ClientModels, a path
that has not existed since the server became PrivaPub; it references
../SocialPub/PrivaPub.ClientModels now, and CI clones SocialPub beside it.

Retargeted to net10.0 with the Microsoft packages at 10.0.9.
BlazorDownloadFileFast moves to 1.0.0.1 because 0.2.0 used
IJSUnmarshalledRuntime, which .NET 9 removed. The Visual Studio bundler and
web compiler packages are gone; the bundle they produced, css/style.min.css,
is committed and stays the stylesheet, and its stale .gz is deleted because
.NET's static-asset compression writes that path itself.

AppConfiguration.ApiBaseAddress (https://privapub.thepra.dev) is the API
client's base address; the template's placeholder OIDC section and the
Toolbelt.Blazor.HotKeys script tag, whose package is not referenced, are
removed. The vhost sends noindex while the feed shows the prototype's mock
posts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

deploy/max/setup.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# One-time root setup on Max for decePubClient at decepub.thepra.dev (static files, no unit). Idempotent.
+#   rsync -a -e $MAX/ssh.sh deploy/ root@nuvola.xyz:/root/decepub-deploy/
+#   $MAX/run.sh bash /root/decepub-deploy/max/setup.sh
+set -euo pipefail
+SRC="${1:-/root/decepub-deploy}"
+HOST=decepub.thepra.dev
+RUNNER=build-runner
+ACME=/root/.acme.sh/acme.sh
+
+echo "== directories"
+install -d -o "$RUNNER" -g www-data -m 755 /var/www/$HOST
+install -d -o "$RUNNER" -g "$RUNNER" -m 750 /var/backups/$HOST
+
+echo "== nginx snippet and bootstrap vhost"
+install -m 644 "$SRC/nginx/decepub-headers.conf" /etc/nginx/snippets/decepub-headers.conf
+if [ -f /root/.acme.sh/${HOST}_ecc/fullchain.cer ]; then
+	install -m 644 "$SRC/nginx/$HOST.conf" /etc/nginx/sites-available/$HOST.conf
+else
+	awk '/^server \{/{n++} n==1' "$SRC/nginx/$HOST.conf" > /etc/nginx/sites-available/$HOST.conf
+fi
+ln -sf /etc/nginx/sites-available/$HOST.conf /etc/nginx/sites-enabled/$HOST.conf
+nginx -t
+systemctl reload nginx
+
+echo "== certificate"
+if [ -f /root/.acme.sh/${HOST}_ecc/fullchain.cer ]; then
+	echo "$HOST: certificate present"
+else
+	$ACME --issue --server letsencrypt -d $HOST -w /var/www/acme --renew-hook "systemctl reload nginx"
+fi
+
+echo "== full vhost"
+install -m 644 "$SRC/nginx/$HOST.conf" /etc/nginx/sites-available/$HOST.conf
+nginx -t
+systemctl reload nginx
+echo "setup complete"

deploy/nginx/decepub-headers.conf

@@ -0,0 +1,5 @@
+add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+add_header X-Content-Type-Options "nosniff" always;
+add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+add_header X-Frame-Options "SAMEORIGIN" always;
+add_header X-Robots-Tag "noindex, nofollow" always;

deploy/nginx/decepub.thepra.dev.conf

@@ -0,0 +1,56 @@
+server {
+	listen 80;
+	listen [::]:80;
+	server_name decepub.thepra.dev;
+
+	location ^~ /.well-known/acme-challenge/ {
+		root /var/www/acme;
+		default_type "text/plain";
+	}
+
+	location / {
+		return 301 https://$host$request_uri;
+	}
+}
+
+server {
+	listen       443 ssl;
+	listen 8444 ssl proxy_protocol;
+	listen       [::]:443 ssl;
+	server_name  decepub.thepra.dev;
+	http2 on;
+
+	include /etc/nginx/ssl.conf;
+	ssl_certificate     /root/.acme.sh/decepub.thepra.dev_ecc/fullchain.cer;
+	ssl_certificate_key /root/.acme.sh/decepub.thepra.dev_ecc/decepub.thepra.dev.key;
+	include /etc/nginx/snippets/decepub-headers.conf;
+
+	access_log /var/log/nginx/decepub.thepra.dev.access.log;
+	error_log  /var/log/nginx/decepub.thepra.dev.error.log;
+
+	root /var/www/decepub.thepra.dev;
+	index index.html;
+	gzip_static on;
+	open_file_cache off;
+
+	location ^~ /.well-known/acme-challenge/ {
+		root /var/www/acme;
+		default_type "text/plain";
+	}
+
+	location = /index.html { expires -1; }
+	location = /build.json { expires -1; }
+	location = /appsettings.json { expires -1; }
+	location = /service-worker.js { expires -1; }
+	location = /service-worker-assets.js { expires -1; }
+
+	location ^~ /_framework/ {
+		expires 1h;
+		try_files $uri =404;
+	}
+
+	location / {
+		expires -1;
+		try_files $uri $uri/ /index.html;
+	}
+}