Separate ViGet from Progmasoft Account infrastructure

Move the Progmasoft mail operations baseline to its owning Progmaweb repository, remove the retired Astro account UI and duplicate identity backend, keep only the ViGet health boundary, add canonical sitemap signals, strengthen dependency CI, and adopt Patent Grant 1.1 across project-owned files.

10 files changed, 14 insertions, 167 deletions

diff --git a/ops/mail/README.md b/ops/mail/README.md
deleted file mode 100644
index 98f60d7..0000000
--- a/ops/mail/README.md
+++ /dev/null
@@ -1,53 +0,0 @@
-<!--
-SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
-SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.0
--->
-
-# Transactional mail boundary
-
-The registry API submits verification and password-recovery messages to Postfix over the loopback interface. Postfix
-requires TLS for remote SMTP delivery and signs `progmasoft.com` mail with OpenDKIM selector `registry`. The automated
-`noreply@progmasoft.com` sender remains non-login. `support@progmasoft.com` is the only interactive mailbox and is
-delivered as Maildir to the dedicated, non-shell `support` account.
-
-Production DNS publishes:
-
-- an unproxied `mail.progmasoft.com` address record;
-- an MX record with priority 10 targeting `mail.progmasoft.com`;
-- a strict SPF record authorizing the registry host;
-- a 2048-bit `registry._domainkey` public key;
-- a strict-alignment DMARC policy, initially in monitor mode and raised to enforcement after SPF, DKIM, and alignment
-  have been verified in received messages.
-
-The private DKIM key and ASP.NET Core connection/OAuth secrets live only on the host. They are never committed. The
-hosting provider should set reverse DNS for `193.111.77.89` to `mail.progmasoft.com`; this cannot be configured through
-Cloudflare DNS.
-
-Install `postfix`, `opendkim`, `opendkim-tools`, `dovecot`, and `certbot`. Keep the selector private key owned by
-`opendkim:opendkim` with mode `0600`, and make every parent key directory traversable by the `opendkim` group. On SELinux
-hosts, restore packaged contexts before starting the services.
-
-The support password is supplied only through `XSHARP_SUPPORT_EMAIL_PASSWORD` while provisioning. It is converted to the
-host's password hash and must never be copied into a repository, environment file, or Postfix/Dovecot configuration.
-Remove the legacy `support: postmaster` alias before enabling local delivery, because aliases take precedence over the
-local account.
-
-The dedicated home and every Maildir directory are owned by `support:support` with mode `0700`. Because this deployment
-keeps mail under `/var/lib/xsharp-mail` instead of `/home`, SELinux must persist `user_home_dir_t` on the account home and
-`mail_home_rw_t` on `Maildir(/.*)?` through `semanage fcontext`, followed by `restorecon`. A generic `var_lib_t` context
-allows login but blocks both Postfix delivery and Dovecot index writes.
-
-Client settings:
-
-- address and username: `support@progmasoft.com`;
-- incoming mail: IMAPS at `mail.progmasoft.com:993`, TLS required;
-- outgoing mail: submission at `mail.progmasoft.com:587`, STARTTLS required;
-- SMTP sender: exactly `support@progmasoft.com`.
-
-Port 25 accepts mail for the local domain but never authenticates users or acts as an open relay. Port 587 requires
-Dovecot authentication and rejects an authenticated account that tries to use another sender address. Certificate
-renewal installs `certbot-deploy-hook.sh` so Postfix and Dovecot reload the renewed key material.
-
-The deployment follows Gmail's sender requirements: the SMTP hostname has matching forward and reverse DNS, outbound
-mail uses TLS, messages are RFC 5322 compliant, and the visible `From` domain aligns with both SPF and DKIM. Registry
-verification and recovery messages are transactional; the service does not send subscription or promotional mail.
diff --git a/ops/mail/certbot-deploy-hook.sh b/ops/mail/certbot-deploy-hook.sh
deleted file mode 100644
index 3fd4e98..0000000
--- a/ops/mail/certbot-deploy-hook.sh
+++ /dev/null
@@ -1,7 +0,0 @@
-#!/bin/sh
-# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
-# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.0
-
-set -eu
-systemctl reload postfix
-systemctl reload dovecot
diff --git a/ops/mail/dovecot-local.conf b/ops/mail/dovecot-local.conf
deleted file mode 100644
index c91cdc6..0000000
--- a/ops/mail/dovecot-local.conf
+++ /dev/null
@@ -1,36 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
-# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.0
-
-protocols = imap
-listen = *, ::
-mail_location = maildir:~/Maildir
-mail_privileged_group = mail
-first_valid_uid = 1000
-
-disable_plaintext_auth = yes
-auth_mechanisms = plain login
-auth_username_format = %Ln
-
-ssl = required
-ssl_min_protocol = TLSv1.2
-ssl_prefer_server_ciphers = yes
-ssl_cert = </etc/letsencrypt/live/mail.progmasoft.com/fullchain.pem
-ssl_key = </etc/letsencrypt/live/mail.progmasoft.com/privkey.pem
-
-service auth {
-  unix_listener /var/spool/postfix/private/auth {
-    mode = 0660
-    user = postfix
-    group = postfix
-  }
-}
-
-service imap-login {
-  inet_listener imap {
-    port = 0
-  }
-  inet_listener imaps {
-    port = 993
-    ssl = yes
-  }
-}
diff --git a/ops/mail/opendkim.conf b/ops/mail/opendkim.conf
deleted file mode 100644
index 93aedcb..0000000
--- a/ops/mail/opendkim.conf
+++ /dev/null
@@ -1,18 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
-# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.0
-
-Syslog yes
-SyslogSuccess yes
-LogWhy yes
-Canonicalization relaxed/simple
-Mode s
-SubDomains no
-OversignHeaders From
-Domain progmasoft.com
-Selector registry
-KeyFile /etc/opendkim/keys/progmasoft.com/registry.private
-Socket inet:8891@127.0.0.1
-PidFile /run/opendkim/opendkim.pid
-UMask 007
-UserID opendkim:opendkim
-RequireSafeKeys yes
diff --git a/ops/mail/postfix-master-submission.txt b/ops/mail/postfix-master-submission.txt
deleted file mode 100644
index 625392d..0000000
--- a/ops/mail/postfix-master-submission.txt
+++ /dev/null
@@ -1,13 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
-# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.0
-
-submission inet n       -       n       -       -       smtpd
-  -o syslog_name=postfix/submission
-  -o smtpd_tls_security_level=encrypt
-  -o smtpd_sasl_auth_enable=yes
-  -o smtpd_sasl_type=dovecot
-  -o smtpd_sasl_path=private/auth
-  -o smtpd_sasl_security_options=noanonymous
-  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
-  -o smtpd_sender_login_maps=lmdb:/etc/postfix/sender_login
-  -o smtpd_sender_restrictions=reject_authenticated_sender_login_mismatch
diff --git a/ops/mail/postfix-settings.txt b/ops/mail/postfix-settings.txt
deleted file mode 100644
index 1fe0f1d..0000000
--- a/ops/mail/postfix-settings.txt
+++ /dev/null
@@ -1,28 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
-# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.0
-
-myhostname = mail.progmasoft.com
-mydomain = progmasoft.com
-myorigin = $mydomain
-inet_interfaces = all
-inet_protocols = ipv4
-mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
-mynetworks = 127.0.0.0/8
-home_mailbox = Maildir/
-disable_vrfy_command = yes
-smtpd_relay_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination
-smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination
-smtp_tls_security_level = encrypt
-smtp_tls_CApath = /etc/pki/tls/certs
-smtp_tls_loglevel = 1
-smtpd_tls_cert_file = /etc/letsencrypt/live/mail.progmasoft.com/fullchain.pem
-smtpd_tls_key_file = /etc/letsencrypt/live/mail.progmasoft.com/privkey.pem
-smtpd_tls_security_level = may
-smtpd_tls_auth_only = yes
-smtpd_sasl_type = dovecot
-smtpd_sasl_path = private/auth
-smtpd_sasl_auth_enable = no
-milter_default_action = tempfail
-milter_protocol = 6
-smtpd_milters = inet:127.0.0.1:8891
-non_smtpd_milters = inet:127.0.0.1:8891
diff --git a/ops/mail/sender_login b/ops/mail/sender_login
deleted file mode 100644
index 39b1b48..0000000
--- a/ops/mail/sender_login
+++ /dev/null
@@ -1,4 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
-# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.0
-
-support@progmasoft.com support
diff --git a/ops/nginx/repository-security-headers.conf b/ops/nginx/repository-security-headers.conf
index 59a3a0d..84dfe0a 100644
--- a/ops/nginx/repository-security-headers.conf
+++ b/ops/nginx/repository-security-headers.conf
@@ -1,5 +1,5 @@
 # SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
-# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.0
+# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
 
 add_header Content-Security-Policy "default-src 'self'; connect-src 'self'; img-src 'self' data:; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; object-src 'none'" always;
 add_header Referrer-Policy "strict-origin-when-cross-origin" always;
diff --git a/ops/nginx/xsharp.conf b/ops/nginx/xsharp.conf
index d9ca5d6..340bf51 100644
--- a/ops/nginx/xsharp.conf
+++ b/ops/nginx/xsharp.conf
@@ -1,5 +1,5 @@
 # SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
-# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.0
+# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
 
 server {
     listen 443 ssl;
@@ -88,6 +88,16 @@ server {
 
     include /etc/nginx/snippets/repository-security-headers.conf;
 
+    location = /robots.txt {
+        alias /srv/xsharp/website/current/frontend/viget-robots.txt;
+        default_type text/plain;
+    }
+
+    location = /sitemap.xml {
+        alias /srv/xsharp/website/current/frontend/viget-sitemap.xml;
+        default_type application/xml;
+    }
+
     location = /login {
         return 308 https://account.progmasoft.com/login$is_args$args;
     }
diff --git a/ops/systemd/xsharp-web-api.service b/ops/systemd/xsharp-web-api.service
index e7826cf..e6138fc 100644
--- a/ops/systemd/xsharp-web-api.service
+++ b/ops/systemd/xsharp-web-api.service
@@ -1,9 +1,9 @@
 # SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
-# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.0
+# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
 
 [Unit]
 Description=Visual X# website and registry API
-After=network-online.target postgresql.service postfix.service
+After=network-online.target
 Wants=network-online.target
 
 [Service]
@@ -16,10 +16,6 @@ EnvironmentFile=/etc/xsharp/web-api.env
 Environment=ASPNETCORE_URLS=http://127.0.0.1:5080
 Environment=ASPNETCORE_ENVIRONMENT=Production
 Environment=DOTNET_EnableDiagnostics=0
-Environment=DataProtection__Path=/var/lib/xsharp-web/keys
-Environment=DataProtection__CertificatePath=%d/dataprotection.pfx
-LoadCredential=dataprotection.pfx:/etc/xsharp/dataprotection.pfx
-StateDirectory=xsharp-web
 Restart=on-failure
 RestartSec=3s
 TimeoutStopSec=15s