Rebuild Visual XSharp language website with Vue and Kotlin Spring; add leopard identity, bilingual docs, forum placeholder, site-only API, strict CSP, 21 frontend tests, deployment runbooks, and preserve legacy ViGet redirect during maintenance

4 files changed, 137 insertions, 11 deletions

diff --git a/ops/nginx/forum.conf b/ops/nginx/forum.conf
new file mode 100644
index 0000000..749d251
--- /dev/null
+++ b/ops/nginx/forum.conf
@@ -0,0 +1,43 @@
+# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
+
+# This is a standalone informational page, not a forum application.
+server {
+    listen 80;
+    listen [::]:80;
+    server_name forum.xsharp-lang.xyz;
+
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/lib/letsencrypt;
+        default_type text/plain;
+    }
+    location / { return 308 https://forum.xsharp-lang.xyz$request_uri; }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name forum.xsharp-lang.xyz;
+    root /srv/xsharp/website/current/forum;
+    index index.html;
+    server_tokens off;
+
+    ssl_certificate /etc/letsencrypt/live/forum.xsharp-lang.xyz/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/forum.xsharp-lang.xyz/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+    add_header X-Robots-Tag "noindex, nofollow" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Content-Security-Policy "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'" always;
+
+    location = / { try_files /index.html =404; }
+    location = /visual-xsharp.svg { try_files $uri =404; }
+    location = /visual-xsharp-mark.svg { try_files $uri =404; }
+    location = /site.css { try_files $uri =404; }
+    location = /site.js { try_files $uri =404; }
+    location / { return 404; }
+}
diff --git a/ops/nginx/xsharp-maintenance.conf b/ops/nginx/xsharp-maintenance.conf
new file mode 100644
index 0000000..c89205b
--- /dev/null
+++ b/ops/nginx/xsharp-maintenance.conf
@@ -0,0 +1,72 @@
+# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
+
+# The language pages remain closed during the redesign. Keep the retired
+# ViGet hostname working as a redirect; it is not a website API or page.
+server {
+    listen 80;
+    listen [::]:80;
+    server_name xsharp-lang.xyz www.xsharp-lang.xyz docs.xsharp-lang.xyz spec.xsharp-lang.xyz;
+
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/lib/letsencrypt;
+        default_type text/plain;
+    }
+    location / { return 308 https://$host$request_uri; }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name xsharp-lang.xyz www.xsharp-lang.xyz docs.xsharp-lang.xyz spec.xsharp-lang.xyz;
+    server_tokens off;
+
+    ssl_certificate /etc/letsencrypt/live/xsharp-lang.xyz/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/xsharp-lang.xyz/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+    add_header Retry-After "3600" always;
+    add_header Cache-Control "no-store" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "DENY" always;
+    add_header Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'" always;
+
+    error_page 503 /maintenance.html;
+    location = /maintenance.html {
+        internal;
+        alias /usr/share/nginx/html/maintenance/xsharp.html;
+    }
+    location / { return 503; }
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name viget.xsharp-lang.xyz;
+    server_tokens off;
+
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/lib/letsencrypt;
+        default_type text/plain;
+    }
+    location / { return 308 https://viget.progmasoft.com$request_uri; }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name viget.xsharp-lang.xyz;
+    server_tokens off;
+
+    ssl_certificate /etc/letsencrypt/live/xsharp-lang.xyz/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/xsharp-lang.xyz/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    return 308 https://viget.progmasoft.com$request_uri;
+}
diff --git a/ops/nginx/xsharp.conf b/ops/nginx/xsharp.conf
index 20d1421..dd6d3c7 100644
--- a/ops/nginx/xsharp.conf
+++ b/ops/nginx/xsharp.conf
@@ -55,8 +55,8 @@ server {
     add_header X-Content-Type-Options "nosniff" always;
     add_header X-Frame-Options "DENY" always;
 
-    # Registry pages are built in the same static artifact but belong only to
-    # viget.progmasoft.com. The language host must never expose auth surfaces.
+    # Keep retired registry paths closed on the language host. Accounts and
+    # packages belong to separate Progmasoft services, not this Vue artifact.
     location = /repo {
         return 404;
     }
@@ -65,8 +65,24 @@ server {
         return 404;
     }
 
+    # Only the language site's own public metadata crosses into Spring.
+    # A catch-all /api proxy would accidentally expose legacy registry routes.
+    location = /api/v1/site {
+        proxy_pass http://127.0.0.1:5080/api/v1/site;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_connect_timeout 2s;
+        proxy_read_timeout 5s;
+    }
+
+    location ^~ /api/ {
+        return 404;
+    }
+
     location / {
-        try_files $uri $uri/ =404;
+        # Vue Router uses history URLs; real files still win before the app shell.
+        try_files $uri $uri/ /index.html;
     }
 
     location ~ /\. {
diff --git a/ops/systemd/xsharp-web-api.service b/ops/systemd/xsharp-web-api.service
index 652ed0b..599c530 100644
--- a/ops/systemd/xsharp-web-api.service
+++ b/ops/systemd/xsharp-web-api.service
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
 
 [Unit]
-Description=Visual X# website and registry API
+Description=Visual X# language website API (Kotlin/JVM 25)
 After=network-online.target
 Wants=network-online.target
 
@@ -11,13 +11,8 @@ Type=simple
 User=xsharp_web
 Group=xsharp_web
 WorkingDirectory=/srv/xsharp/website/current/backend
-# Run the framework-dependent deployment through the installed runtime. This
-# remains stable when release files cross an SELinux-labelled staging boundary.
-ExecStart=/usr/bin/dotnet /srv/xsharp/website/current/backend/XSharp.Web.Api.dll
-EnvironmentFile=/etc/xsharp/web-api.env
-Environment=ASPNETCORE_URLS=http://127.0.0.1:5080
-Environment=ASPNETCORE_ENVIRONMENT=Production
-Environment=DOTNET_EnableDiagnostics=0
+ExecStart=/usr/bin/java -XX:MaxRAMPercentage=35 -jar /srv/xsharp/website/current/backend/visual-xsharp-website-api-1.0.0.jar
+Environment=PORT=5080
 Restart=on-failure
 RestartSec=3s
 TimeoutStopSec=15s