progmaweb/ops, branch docs/api-and-web-reference

Document the architecture, the account API, localization and limitations

2026-10-03T15:18:50+00:00

The repository had a README and two operations notes. This adds the
documents a contributor or operator needs and corrects what had gone stale.

New, under docs/:
- README.md: index of the documentation.
- ARCHITECTURE.md: the two processes, the three hosts, the host-aware
  routing rules, the account flow and the trust boundaries.
- ACCOUNT-API.md: every endpoint with its request, responses and errors,
  the field rules, the Google flow outcome by outcome, cookies, limits and
  configuration. The responses were checked against a locally running API.
- LOCALIZATION.md: the four languages, how a page picks one, the cookie,
  how Hebrew text is laid out, and how to add a language.
- DEVELOPMENT.md: requirements, local setup, checks, tests, what each CI
  workflow enforces, the audit exception and the DocFX project.
- LIMITATIONS.md: what is missing or temporary, with the consequence of
  each: the in-memory account store, unverified addresses, no mail, no
  password change, the ignored returnTo parameter, the legacy ViGet status
  route, and that the API answers 500 to everything while the Google
  settings are empty.

Updated:
- README.md: languages, a documentation section, the local API command
  with its port, and the DocFX check.
- ops/README.md: restarting the API deletes every account, how to release
  a frontend-only change without that restart, and lessons from past
  releases.
- ops/mail/README.md: a status note that the API does not send mail yet.
- The pull request template names all four languages.

No source file changes.

Co-Authored-By: Claude Opus 5.5

Move the ViGet package and DSL-plugin catalogs into Progmaweb as host-aware Next.js routes, add complete en-US and German content, persistent light and dark themes, catalog-specific metadata, robots and sitemap responses, and an Nginx ownership contract for viget.progmasoft.com.

2026-09-09T17:28:06+00:00

Treat intentional Next.js shutdown as successful

2026-09-07T22:35:54+00:00

Teach systemd that the Node runtime's SIGTERM exit status is an expected graceful stop. This prevents routine atomic deployments from leaving a misleading failed result after the replacement service is already healthy.

Make Progmaweb API activation SELinux-stable

2026-09-07T22:29:57+00:00

Invoke the framework-dependent API through the installed dotnet runtime instead of relying on a copied apphost inode retaining executable SELinux metadata. Document the production service contract so immutable releases activate consistently on the AlmaLinux host.

Harden Progmaweb identity, localization, and operations

2026-09-07T18:31:05+00:00

Adopt Patent Grant 1.1, make the apex host canonical while excluding account surfaces from indexing, move the Progmasoft mail boundary into its owning repository, migrate the .NET 10 tests to native MTP, and add persistent light/dark and en-US/de-DE preferences across corporate and account experiences.

Add secure Google sign-in to Progmasoft Account. Use the server-side authorization-code flow with an exact account-domain callback, temporary hardened external cookies, verified provider email matching, canonical Account-name creation for new users, and no separate ViGet publisher identity. Add frontend entry points, provider failure guidance, locked Google authentication dependencies, service secret injection, and backend regression coverage without committing OAuth credentials.

2026-08-30T18:45:01+00:00

Establish Progmasoft copyright ownership across the corporate website and account service, license all project-owned sources under AGPL-3.0-or-later, add the shared defensive Progmasoft patent grant with SPDX and REUSE coverage, preserve source-availability obligations, and align notices, npm and .NET package metadata, frontend, API, tests, deployment configuration, and repository documentation

2026-08-29T08:01:02+00:00

Activate the account.progmasoft.com production host with dedicated HTTP and TLS virtual servers, ACME-compatible certificate routing, security headers, and loopback proxy forwarding. Correct the host-aware Next.js account landing rewrite so public HTTPS termination at Nginx does not cause the HTTP-only Next listener to receive an invalid TLS connection. Verified formatting, ESLint, generated route types, TypeScript checks, production frontend build, live Nginx syntax, Cloudflare DNS publication, and the expanded Let's Encrypt SAN set.

2026-08-28T20:50:19+00:00

Complete production activation hardening: allow the explicit loopback and canonical Progmasoft hosts used by the Next.js API proxy, and omit MemoryDenyWriteExecute only for the CoreCLR service because the .NET JIT requires managed executable mappings while all other systemd protections remain enabled.

2026-08-28T20:38:41+00:00

Correct the production Next.js service path for pnpm monorepo standalone output: run the generated apps/web/server.js beneath the preserved standalone module root and document the matching static-asset placement.

2026-08-28T20:21:59+00:00