Retire registry authentication from xsharp-lang.xyz. Restrict the language host from serving the shared static /repo tree, remove the legacy api.xsharp-lang.xyz Nginx endpoint and backend host allowance, and identify the same-origin API as ViGet. Document that login, registration, and registry APIs belong exclusively to viget.progmasoft.com while preserving the dedicated legacy ViGet redirect.

4 files changed, 16 insertions, 31 deletions

diff --git a/README.md b/README.md
index 8318bcd..3f2cd43 100644
--- a/README.md
+++ b/README.md
@@ -27,6 +27,10 @@ ViGet keeps DSL plugins and Visual X# packages in separate canonical catalogs:
 These paths reserve catalog identity; they do not imply that publishing or downloading is available before the registry
 HTTP contract is implemented.
 
+Authentication and registry APIs are same-origin under `https://viget.progmasoft.com/api/`. The Visual X# language host
+does not expose registry pages, login or registration routes, and the retired `api.xsharp-lang.xyz` host is not part of
+the production contract.
+
 The PostgreSQL provider is selected solely by `ConnectionStrings__Registry`. Production uses the PostgreSQL instance on
 the project-owned server over a local Unix socket; the database is not delegated to a hosted database service or exposed
 to the browser. Google OAuth client credentials, the database connection, auth-code pepper, and data-protection
diff --git a/backend/Program.cs b/backend/Program.cs
index 65ddf5e..d800d20 100644
--- a/backend/Program.cs
+++ b/backend/Program.cs
@@ -114,7 +114,7 @@ app.UseAuthentication();
 app.UseAuthorization();
 
 app.MapHealthChecks("/health");
-app.MapGet("/api/v1/status", () => Results.Ok(new ServiceStatus("xsharp-lang", "online", true)));
+app.MapGet("/api/v1/status", () => Results.Ok(new ServiceStatus("viget", "online", true)));
 app.MapAuthEndpoints();
 app.MapTokenEndpoints();
 
diff --git a/backend/appsettings.json b/backend/appsettings.json
index 735b2bc..17fff0a 100644
--- a/backend/appsettings.json
+++ b/backend/appsettings.json
@@ -5,7 +5,7 @@
       "Microsoft.AspNetCore": "Warning"
     }
   },
-  "AllowedHosts": "localhost;api.xsharp-lang.xyz;viget.progmasoft.com",
+  "AllowedHosts": "localhost;viget.progmasoft.com",
   "ConnectionStrings": {
     "Registry": "Host=127.0.0.1;Port=5432;Database=xs_registry;Username=xsharp_web"
   },
diff --git a/ops/nginx/xsharp.conf b/ops/nginx/xsharp.conf
index 4216c68..7881759 100644
--- a/ops/nginx/xsharp.conf
+++ b/ops/nginx/xsharp.conf
@@ -21,6 +21,16 @@ server {
     add_header X-Content-Type-Options "nosniff" always;
     add_header X-Frame-Options "DENY" always;
 
+    # Registry pages are built in the same static artifact but belong only to
+    # viget.progmasoft.com. The language host must never expose auth surfaces.
+    location = /repo {
+        return 404;
+    }
+
+    location ^~ /repo/ {
+        return 404;
+    }
+
     location / {
         try_files $uri $uri/ =404;
     }
@@ -154,32 +164,3 @@ server {
     add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
     return 308 https://xsharp-lang.xyz$request_uri;
 }
-
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
-    server_name api.xsharp-lang.xyz;
-    server_tokens off;
-
-    ssl_certificate /etc/letsencrypt/live/xsharp-lang.xyz/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/xsharp-lang.xyz/privkey.pem;
-    include /etc/letsencrypt/options-ssl-nginx.conf;
-    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
-
-    add_header Referrer-Policy "no-referrer" always;
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-Frame-Options "DENY" always;
-
-    client_max_body_size 1m;
-
-    location / {
-        proxy_http_version 1.1;
-        proxy_pass http://127.0.0.1:5080;
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Forwarded-Proto https;
-        proxy_set_header X-Real-IP $remote_addr;
-    }
-}