Merge branch 'main' into docs/code-of-conductdocs/code-of-conduct

8 files changed, 212 insertions, 15 deletions

diff --git a/ops/README.md b/ops/README.md
index 285b2ba..36b44bd 100644
--- a/ops/README.md
+++ b/ops/README.md
@@ -36,7 +36,7 @@ avoids depending on an apphost inode copied from a build machine retaining an ex
 3. Point a temporary symlink at the verified release and rename it over `current` atomically.
 4. Run `systemd-analyze verify`, `nginx -t`, then restart the two Progmaweb services and reload Nginx.
 5. Verify apex HTTPS, the canonical `www` redirect, account routes, ViGet catalog routes, host-specific robots and
-   sitemaps, `/api/v1/status`, registration validation, and the existing Tala host.
+   sitemaps, `/api/v1/status`, and registration validation.
 6. On failure, restore the previous `current` target and restart only the Progmaweb services.
 
 ## Account database
@@ -140,16 +140,14 @@ There is no scheduled backup yet; see [Known limitations](../docs/LIMITATIONS.md
 - **Keep the previous release.** A rollback is the `current` symlink pointing at the previous directory and a restart
   of the frontend service.
 
-The Progmasoft and ViGet Nginx hosts must never reuse `/srv/xsharp/website/current`. Tala compiler and language
-content belongs to `tala.run` and its subdomains; sharing an origin server does not imply sharing a document root or
-application process. The temporary ViGet status API remains on its dedicated loopback service while catalog pages are served by
-Progmaweb.
+Every host of this server that Progmaweb serves has its own server block in `ops/nginx/progmaweb.conf`;
+`viget.progmasoft.com/api/v1/status` answers from the Progmaweb API like `progmasoft.com/api/v1/status`.
 
 ## Mail boundary
 
 The `mail/` directory is the operational baseline for `mail.progmasoft.com`, transactional messages from Progmasoft
 Account, and the interactive `support@progmasoft.com` mailbox. It lives here because account verification and recovery
-are Progmaweb responsibilities; the Tala and ViGet website repository does not own identity or mail services.
+are Progmaweb responsibilities.
 
 Apply those fragments deliberately rather than copying the directory over `/etc`. The accompanying mail README records
 the DNS, TLS, OpenDKIM, Postfix, Dovecot, sender-login, filesystem-permission, and secret-handling contract.
@@ -297,6 +295,24 @@ ssh root@91.151.88.130 'chown -R root:root /srv/maven && restorecon -R /srv/mave
 
 Published versions are never changed. The certificate of `progmasoft.com` must name `maven.progmasoft.com`.
 
+## JSON Schemas
+
+`schemastore.progmasoft.com/json/` serves the JSON Schemas of Progmasoft's file formats, such as
+`progmasoft-cpp-index.json` for the `index.json` of each folder of guidelines in Progmasoft/progmasoft-cpp. The schemas
+are in `ops/schemastore/json`, under CC0-1.0, and are served from `/srv/schemastore/json` by
+`ops/schemastore/nginx/schemastore.conf` (installed as `/etc/nginx/conf.d/schemastore.conf`), to any origin, with GET
+only:
+
+```sh
+install -d -m 0755 /srv/schemastore /srv/schemastore/json
+semanage fcontext -a -t httpd_sys_content_t '/srv/schemastore(/.*)?'
+scp ops/schemastore/json/*.json root@91.151.88.130:/srv/schemastore/json/
+ssh root@91.151.88.130 'chown -R root:root /srv/schemastore && chmod 0644 /srv/schemastore/json/*.json && restorecon -R /srv/schemastore'
+```
+
+A schema's `$id` is its address. A change that would reject files the schema accepted before gets a new file name
+instead. The certificate of `progmasoft.com` must name `schemastore.progmasoft.com`.
+
 ## Git mirrors
 
 `git.progmasoft.com` shows read-only mirrors of the public repositories under development, such as
diff --git a/ops/git/cgitrc b/ops/git/cgitrc
index 5da9211..4499dbe 100644
--- a/ops/git/cgitrc
+++ b/ops/git/cgitrc
@@ -70,8 +70,3 @@ repo.url=progmaweb
 repo.path=/srv/git/mirrors/progmaweb.git
 repo.desc=The site and account service of Progmasoft: a Next.js frontend and an ASP.NET Core API.
 repo.homepage=https://github.com/Progmasoft/progmaweb
-
-repo.url=website
-repo.path=/srv/git/mirrors/website.git
-repo.desc=The site of tala.run: a Vue frontend and an ASP.NET Core API.
-repo.homepage=https://github.com/Progmasoft/website
diff --git a/ops/git/repositories b/ops/git/repositories
index bdd0a89..336d9f3 100644
--- a/ops/git/repositories
+++ b/ops/git/repositories
@@ -6,4 +6,3 @@ tazel.net
 catch3
 progmasoft-cpp
 progmaweb
-website
diff --git a/ops/mail/README.md b/ops/mail/README.md
index b1a1232..21a8a16 100644
--- a/ops/mail/README.md
+++ b/ops/mail/README.md
@@ -31,7 +31,7 @@ Install `postfix`, `opendkim`, `opendkim-tools`, `dovecot`, and `certbot`. Keep
 `opendkim:opendkim` with mode `0600`, and make every parent key directory traversable by the `opendkim` group. On SELinux
 hosts, restore packaged contexts before starting the services.
 
-The support password is supplied only through `XSHARP_SUPPORT_EMAIL_PASSWORD` while provisioning. It is converted to the
+The support password is supplied only through `PROGMASOFT_SUPPORT_EMAIL_PASSWORD` while provisioning. It is converted to the
 host's password hash and must never be copied into a repository, environment file, or Postfix/Dovecot configuration.
 Remove the legacy `support: postmaster` alias before enabling local delivery, because aliases take precedence over the
 local account.
diff --git a/ops/nginx/cloudflare-real-ip.conf b/ops/nginx/cloudflare-real-ip.conf
index 2162842..a9d3f05 100644
--- a/ops/nginx/cloudflare-real-ip.conf
+++ b/ops/nginx/cloudflare-real-ip.conf
@@ -3,7 +3,7 @@
 
 # Installed as /etc/nginx/conf.d/00-cloudflare-real-ip.conf on the first server.
 #
-# Cloudflare proxies the Progmasoft, Tala and Tazel hosts, so the peer of
+# Cloudflare proxies the Progmasoft and Tazel hosts, so the peer of
 # Nginx is a Cloudflare edge, and each request may come from another edge.
 # Without this file the address the API rate-limits by is that edge: the
 # sign-in limit then never fills for one visitor and is shared by unrelated
diff --git a/ops/nginx/progmaweb.conf b/ops/nginx/progmaweb.conf
index f752b80..2ed242a 100644
--- a/ops/nginx/progmaweb.conf
+++ b/ops/nginx/progmaweb.conf
@@ -173,7 +173,7 @@ server {
 
     location = /api/v1/status {
         proxy_http_version 1.1;
-        proxy_pass http://127.0.0.1:5080;
+        proxy_pass http://127.0.0.1:5085;
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Host $host;
diff --git a/ops/schemastore/json/progmasoft-cpp-index.json b/ops/schemastore/json/progmasoft-cpp-index.json
new file mode 100644
index 0000000..e467d4b
--- /dev/null
+++ b/ops/schemastore/json/progmasoft-cpp-index.json
@@ -0,0 +1,118 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemastore.progmasoft.com/json/progmasoft-cpp-index.json",
+  "title": "Progmasoft C/C++ Styles guidelines index",
+  "description": "The index.json of a guidelines folder in Progmasoft C/C++ Styles (https://github.com/Progmasoft/progmasoft-cpp): the language versions it covers and every document with its chapter and the versions it applies to.",
+  "type": "object",
+  "required": ["title", "license", "standards", "documents"],
+  "additionalProperties": false,
+  "properties": {
+    "$schema": {
+      "description": "This schema: https://schemastore.progmasoft.com/json/progmasoft-cpp-index.json.",
+      "type": "string",
+      "format": "uri"
+    },
+    "title": {
+      "description": "The name of the guidelines, such as \"Progmasoft Core C++ Coding Guidelines\".",
+      "type": "string",
+      "minLength": 1
+    },
+    "license": {
+      "description": "The SPDX license identifier of the text of the guidelines.",
+      "type": "string",
+      "minLength": 1
+    },
+    "standards": {
+      "description": "The language versions the guidelines cover. Exactly one is the default.",
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/standard" },
+      "contains": {
+        "type": "object",
+        "properties": { "default": { "const": true } },
+        "required": ["default"]
+      },
+      "minContains": 1,
+      "maxContains": 1
+    },
+    "documents": {
+      "description": "Every document of the guidelines.",
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/document" }
+    }
+  },
+  "$defs": {
+    "id": {
+      "description": "A lowercase identifier: letters, digits and hyphens.",
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)*$"
+    },
+    "path": {
+      "description": "A Markdown file, relative to the folder of index.json, with forward slashes.",
+      "type": "string",
+      "pattern": "^[A-Za-z0-9_-]+(/[A-Za-z0-9_.-]+)*\\.md$"
+    },
+    "standard": {
+      "type": "object",
+      "required": ["id", "name", "default", "for", "documents"],
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/id",
+          "description": "The identifier documents use in their standards list, such as \"cpp20\"."
+        },
+        "name": {
+          "description": "The name of the version, such as \"C++20\".",
+          "type": "string",
+          "minLength": 1
+        },
+        "default": {
+          "description": "Whether a project uses this version unless it says otherwise.",
+          "type": "boolean"
+        },
+        "for": {
+          "description": "The projects this version is meant for.",
+          "type": "string",
+          "minLength": 1
+        },
+        "documents": {
+          "description": "The documents that hold the rules of this version alone.",
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/path" }
+        }
+      }
+    },
+    "document": {
+      "type": "object",
+      "required": ["id", "title", "path", "standards"],
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/id",
+          "description": "The identifier of the document, unique in the index."
+        },
+        "chapter": {
+          "description": "The chapter number of a document shared by every version; a version's own page has none.",
+          "type": "integer",
+          "minimum": 1
+        },
+        "title": {
+          "description": "The title of the document.",
+          "type": "string",
+          "minLength": 1
+        },
+        "path": { "$ref": "#/$defs/path" },
+        "standards": {
+          "description": "The identifiers of the versions the document applies to.",
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/id" }
+        }
+      }
+    }
+  }
+}
diff --git a/ops/schemastore/nginx/schemastore.conf b/ops/schemastore/nginx/schemastore.conf
new file mode 100644
index 0000000..199d3ee
--- /dev/null
+++ b/ops/schemastore/nginx/schemastore.conf
@@ -0,0 +1,69 @@
+# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
+
+# https://schemastore.progmasoft.com: the JSON Schemas of Progmasoft's file
+# formats, such as /json/progmasoft-cpp-index.json. Static files only, copied
+# from ops/schemastore/json; see ops/README.md. Installed as
+# /etc/nginx/conf.d/schemastore.conf.
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name schemastore.progmasoft.com;
+
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/lib/letsencrypt;
+        default_type text/plain;
+    }
+
+    location / {
+        return 308 https://schemastore.progmasoft.com$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name schemastore.progmasoft.com;
+
+    ssl_certificate /etc/letsencrypt/live/progmasoft.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/progmasoft.com/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+
+    root /srv/schemastore;
+    client_max_body_size 1k;
+
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    location = / {
+        return 302 https://schemastore.progmasoft.com/json/;
+    }
+
+    # Editors in the browser fetch schemas from other origins, so every origin
+    # may read them. Nothing here takes cookies or writes anything.
+    location ^~ /json/ {
+        limit_except GET {
+            deny all;
+        }
+        autoindex on;
+        charset utf-8;
+        charset_types application/json;
+        types {
+            application/json json;
+        }
+        expires 1h;
+        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+        add_header Access-Control-Allow-Origin "*" always;
+        add_header Content-Security-Policy "default-src 'none'; frame-ancestors 'none'" always;
+        try_files $uri $uri/ =404;
+    }
+
+    location / {
+        return 404;
+    }
+}