Fix: badge API now reads from Gamedata/c_images/album1584

The badge GIF files exist at /var/www/Gamedata/c_images/album1584/ but the
/api/imaging/badge endpoint only looked in /swf/c_images/album1584/ (relative
to process.cwd()). Added GEDATA_IMAGES_BASE candidate and fetchCandidate
handler so badges render correctly in the admin UI and on the site.

.env.example

@@ -11,6 +11,12 @@ DATABASE_CONNECT_TIMEOUT_MS=5000
 # --- REDIS (Lightning Fast Caching & Sessions) ---
 REDIS_URL=redis://127.0.0.1:6379?connect_timeout=2
 REDIS_CACHE_TTL_DEFAULT=7200
+# In-process cache entries kept per instance, evicted least-recently-used. Raise
+# it if hot keys are evicted while memory headroom remains (default 2000).
+CACHE_MEMORY_MAX_ENTRIES=2000
+# Renders kept per imaging cache directory, counted as .img/.json pairs. A sweep
+# every 5 minutes brings an over-budget directory back to 90% of this (default 20000).
+IMAGING_CACHE_MAX_ENTRIES=20000
 
 # --- CORE RUNTIME & PERFORMANCE FLAGS ---
 NODE_ENV=production
@@ -72,73 +78,6 @@ CLOUDFLARE_AUTO_BLOCK_ENABLED=true
 # Override for tests/staging (production uses the public endpoint by default).
 CLOUDFLARE_API_BASE_URL=https://api.cloudflare.com/client/v4
 
-# --- CROWDSEC API (community reputation auto-block, optional) ---
-# Free CTI API key: https://app.crowdsec.net/ → Settings → CTI API Keys.
-# When set, the anti-DDoS gate checks the community reputation of repeat
-# offenders (CTI GET /smoke/{ip}) and immediately hard-blocks known-bad IPs.
-# Lookups only happen for IPs that already tripped a rate bucket and are
-# cached in Redis for 1h, so quota usage stays minimal.
-CROWDSEC_API_KEY=
-# Runtime toggle for reputation-based auto-blocking (also overridable live
-# from the admin panel). Requires CROWDSEC_API_KEY.
-CROWDSEC_AUTO_BLOCK_ENABLED=true
-# Minimum malevolence score 0-5 (CrowdSec scale; 4-5 = "malicious") before an
-# IP is treated as known-bad. IPs with false-positive tags are never blocked.
-CROWDSEC_BLOCK_SCORE=4
-# How long a CrowdSec-confirmed bad IP stays blocked (seconds).
-CROWDSEC_BLOCK_TTL_SECONDS=86400
-# Endpoint — override only for tests/staging.
-CROWDSEC_CTI_BASE_URL=https://cti.api.crowdsec.net/v2
-# Daily enrichment-call ceiling (freemium plan ≈ 10k/day). Once today's
-# counter reaches it, reputation lookups pause until tomorrow so a spread
-# DDoS cannot silently burn the whole quota. 0 = unlimited.
-CROWDSEC_CTI_DAILY_QUOTA=10000
-# How many new community-reputation blocks within a 5-minute window justify an
-# ops alert (quota/backoff/report alerts all use HEALTH_ALERT_COOLDOWN_MIN).
-CROWDSEC_ALERT_BLOCK_BURST=10
-
-# --- CROWDSEC SIGNAL PUSH (share our blocks back, optional) ---
-# Opt-in: pushes blocked IPs + behaviors to the CrowdSec Central API (CAPI) so
-# the community blocklist protects other members too. Set to "true" to enable.
-# Requires watcher credentials — either set both CROWDSEC_REPORT_MACHINE_ID
-# (48 chars, [A-Za-z0-9]) and CROWDSEC_REPORT_PASSWORD now, or leave them
-# unset and let the app generate a stable pair persisted in Redis automatically.
-CROWDSEC_REPORT_ENABLED=false
-CROWDSEC_REPORT_MACHINE_ID=
-CROWDSEC_REPORT_PASSWORD=
-# Optional: attachment key from https://app.crowdsec.net → Console settings —
-# links our watcher to your account so pushed signals show up there.
-CROWDSEC_REPORT_ENROLL_KEY=
-# Central API base — override only for tests/staging.
-CROWDSEC_CAPI_BASE_URL=https://api.crowdsec.net/v3
-
-# --- CROWDSEC LOCAL (opt-in engine on this Docker host, no proxy changes) ---
-# App-layer LAPI bouncer: the anti-DDoS gate asks the local engine per client
-# IP (short-cached) and blocks ban/captcha decisions before its own buckets.
-# Start everything with `bash cms security`; it writes the key below into .env
-# and starts the CrowdSec engine bound to 127.0.0.1. Set to "true" to load the
-# bouncer without the local engine (not recommended).
-CROWDSEC_LOCAL_ENABLED=false
-# Host access-log directory mounted into the engine for detection (Nginx only).
-CROWDSEC_NGINX_LOG_DIR=/var/log/nginx
-# Change LAPI port AND LAPI URL together when 18080 is already taken.
-CROWDSEC_LAPI_PORT=18080
-CROWDSEC_LAPI_URL=http://127.0.0.1:18080
-# Generated by `bash cms security`; keep in .env, never commit a value.
-CROWDSEC_LAPI_API_KEY=
-# IP blocklist sync (`bash cms security blocklists`): space-separated URLs, by
-# default Spamhaus DROP/EDROP, DShield, CINS, Greensnow, StopForumSpam,
-# blocklist.de, Emerging Threats, abuse.ch Feodo/SSLBL/URLhaus, IPsum,
-# Firehol ipsets and Tor exit nodes. Requires internet to fetch; detection and
-# blocking stay local.
-#CROWDSEC_BLOCKLIST_SOURCES=https://www.spamhaus.org/drop/drop.txt https://example.org/list.txt
-# Expiration for each blocklist decision (re-synced keeps them fresh).
-#CROWDSEC_BLOCKLIST_DURATION=24h
-# Combined cap per sync (safety valve against excessive decisions).
-#CROWDSEC_BLOCKLIST_MAX_DECISIONS=250000
-# Comma-separated IPs/CIDRs that a sync must always skip (allowlist).
-#CROWDSEC_BLOCKLIST_ALLOW=1.2.3.4,10.0.0.0/8
-
 # --- PATHS ---
 BADGE_UPLOAD_DIR=./public/assets/images/badges
 EMULATOR_JAR_PATH=./emulator/Arcturus.jar

.gitea/workflows/ci.yaml

@@ -25,7 +25,7 @@ jobs:
     runs-on: self-hosted
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: ${{ gitea.repository }}
           token: ${{ gitea.token }}
@@ -33,6 +33,12 @@ jobs:
       - name: Toolchain check
         run: node scripts/check-node-toolchain.mjs
 
+      # Port selection decides which blue/green slot stays live. Getting it
+      # wrong starts the candidate on an occupied port, so the regression that
+      # caused a failed deploy is covered here, before any image is built.
+      - name: Deploy port-selection tests
+        run: bash scripts/ci-deploy-ports.test.sh
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
@@ -58,7 +64,7 @@ jobs:
     runs-on: self-hosted
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: ${{ gitea.repository }}
           token: ${{ gitea.token }}
@@ -86,7 +92,7 @@ jobs:
     runs-on: self-hosted
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: ${{ gitea.repository }}
           token: ${{ gitea.token }}
@@ -102,7 +108,7 @@ jobs:
     runs-on: self-hosted
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: ${{ gitea.repository }}
           token: ${{ gitea.token }}
@@ -135,7 +141,7 @@ jobs:
     runs-on: self-hosted
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: ${{ gitea.repository }}
           token: ${{ gitea.token }}
@@ -169,7 +175,7 @@ jobs:
     runs-on: self-hosted
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: ${{ gitea.repository }}
           token: ${{ gitea.token }}

.gitea/workflows/renovate.yaml

@@ -1,30 +0,0 @@
-name: Renovate
-on:
-  schedule:
-    - cron: "0 5 * * *" # Every day at 05:00 UTC
-  workflow_dispatch: # Manual trigger
-
-jobs:
-  renovate:
-    runs-on: self-hosted
-    steps:
-      - name: Fix Git safe directory
-        run: "git config --global --add safe.directory '*' && git remote set-url origin https://epicnabbo.nl || true"
-      - name: Install Bash in Alpine
-        run: "if [ -f /etc/alpine-release ]; then apk add --no-cache bash; fi"
-      - name: Self-hosted Renovate
-        run: |
-          set -e
-
-          # Ensure cache dir exists before Docker starts
-          mkdir -p /var/tmp/renovate-cache
-
-          docker run --rm \
-            --user "$(id -u):$(id -g)" \
-            -e RENOVATE_TOKEN="${{ secrets.RENOVATE_TOKEN }}" \
-            -e RENOVATE_AUTODISCOVER=false \
-            -e RENOVATE_REPOSITORIES="${{ gitea.repository }}" \
-            -e RENOVATE_ONBOARDING=false \
-            -e LOG_LEVEL=info \
-            -v /var/tmp/renovate-cache:/tmp/renovate-cache \
-            ghcr.io/renovatebot/renovate:latest

.gitea/workflows/test.yml

@@ -0,0 +1,9 @@
+name: Gitea Runner Clean Test
+on: [push]
+
+jobs:
+  test-job:
+    runs-on: ubuntu-latest  # Gitea zoekt hier zelf de v5-runner bij die dit label heeft!
+    steps:
+      - name: Hallo wereld
+        run: echo "De v5 Gitea Runner werkt perfect en volledig anoniem!"

.gitignore

@@ -6,6 +6,8 @@ node_modules.prev/
 .next-staging/
 next-env.d.ts
 .env
+.env.local
+.env.*.local
 *.tsbuildinfo
 src/generated/
 # Runtime avatar/badge imaging disk cache
@@ -52,3 +54,7 @@ blob-report/
 .env.install.*
 build-reports/
 !/docs/performance-budgets.md
+
+# One-off local snapshots (o.a. catalog-integrity/pre-fix.json): runtime-werk,
+# geen bron. Per map opgeslagen om een incident terug te kunnen lezen.
+backups/

.gitlab-ci.yml

@@ -1,5 +1,12 @@
 image: node:26
 
+# Runner containers have no systemd, so scripts/with-memory-cap.sh cannot
+# enforce an RSS cap there and correctly refuses to run unbounded. These
+# builds are already isolated inside their own runner container (not the
+# host) and use the webpack builder; opt out explicitly on purpose.
+variables:
+  CMS_MEMORY_CAP_BACKEND: "none"
+
 stages:
   - test
   - build

.runner

@@ -0,0 +1,14 @@
+{
+  "WARNING": "This file is automatically generated by Gitea Runner. Do not edit it manually unless you know what you are doing. Removing this file will cause Gitea Runner to re-register as a new runner.",
+  "id": 22,
+  "uuid": "ffb52201-e18e-4a0f-96e9-cf8a0b849365",
+  "name": "v5-runner",
+  "token": "0484b5a82d3bda9a62972a6d2646ca7cb90bc4e2",
+  "address": "https://gitlab.epicnabbo.nl/",
+  "labels": [
+    "self-hosted:host",
+    "ubuntu-latest:docker://node:18-bullseye",
+    "debian-latest:docker://debian:bullseye-slim"
+  ],
+  "ephemeral": false
+}

Dockerfile

@@ -1,40 +1,50 @@
 # syntax=docker/dockerfile:1
-# Pin the runtime to the supported engine; update both stages deliberately.
 FROM node:26.10.0-alpine AS migrations
 WORKDIR /app
 ENV NEXT_TELEMETRY_DISABLED=1
-# Keep the bootstrap aligned with package.json packageManager.
-# The apk cache is persisted in a BuildKit cache mount so git is not
-# re-downloaded on every build.
+
+# Installeer git, bash en pnpm v12. bash is nodig voor
+# scripts/with-memory-cap.sh (gebruikt bashisme zoals arrays en BASH_REMATCH);
+# Alpine levert geen bash mee.
 RUN --mount=type=cache,target=/var/cache/apk \
-    apk add --no-cache git \
-    && npm install -g pnpm@11.25.0
-# The pnpm store is kept in a BuildKit cache mount that persists across builds
-# on the builder. This is what stops disk usage from growing unbounded: the
-# downloaded dependency store is shared and reused instead of being copied into
-# a fresh image layer on every build. Unlike an image layer it is also prunable
-# independently, so a hard cap (see ci-deploy.sh) keeps it bounded.
-ENV PNPM_HOME=/pnpm PNPM_STORE=/pnpm/store
-# pnpm-workspace.yaml + .npmrc must be present too: the lockfile records the
-# overrides from pnpm-workspace.yaml, and --frozen-lockfile rejects a build
-# where the workspace config is absent (ERR_PNPM_LOCKFILE_CONFIG_MISMATCH).
+    apk add --no-cache git bash \
+    && npm install -g pnpm@12.10.1
+
+# Stel het PATH zo in dat Alpine pnpm gegarandeerd overal herkent
+ENV PNPM_HOME="/usr/local/share/pnpm"
+ENV PATH="$PNPM_HOME:/usr/local/bin:$PATH"
+
 COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml* .npmrc* ./
-# pnpm fetch: download all deps into the shared cache-mounted store.
-RUN --mount=type=cache,target=/pnpm \
-    pnpm fetch --ignore-scripts
-# Install offline from the cache-mounted store; the store itself stays in the
-# build cache between builds.
-RUN --mount=type=cache,target=/pnpm \
-    pnpm install --frozen-lockfile --ignore-scripts --offline
+
+# Voer de installatie uit met de pnpm v12 store cache-mount
+RUN --mount=type=cache,target=/root/.local/share/pnpm/store \
+    pnpm install --frozen-lockfile --ignore-scripts
+
 COPY . .
 ARG NEXT_DEPLOYMENT_ID="unknown"
 LABEL org.opencontainers.image.revision="$NEXT_DEPLOYMENT_ID"
+
 FROM migrations AS builder
 ARG NEXT_DEPLOYMENT_ID="unknown"
 ENV NEXT_DEPLOYMENT_ID="$NEXT_DEPLOYMENT_ID"
-# Fixture values exist only for this build command; production secrets are runtime-only.
-# Cache Next.js build output and webpack caches so rebuilds only redo the
-# changed parts.
+
+# The build runs the webpack builder (see the `build` script in package.json).
+# Turbopack's compiler is a single native process that grows past 12GB RSS on
+# this 329-route app and gets OOM-killed; webpack peaks around 5GB. A
+# --max-old-space-size cap does NOT help, because that memory is native
+# Turbopack memory rather than the V8 heap.
+#
+# `pnpm run build` goes through scripts/with-memory-cap.sh. BuildKit's build
+# container has /sys/fs/cgroup mounted read-only (no cgroup MemoryMax) and
+# `ulimit -v` breaks V8-based builds (see the script header), so this stage
+# explicitly opts out of the cap. The real bound here is the webpack builder
+# + the V8 heap cap above, and the build runs isolated in its own container,
+# not on the host; the host itself is protected by the same wrapper through
+# systemd.
+ENV NODE_OPTIONS="--max-old-space-size=4096"
+ENV CMS_MEMORY_CAP_BACKEND=none
+
+# Bouw de Next.js applicatie met caching
 RUN --mount=type=cache,target=/app/.next/cache \
     DATABASE_URL="mysql://build:[email protected]:9/build" \
     HOTEL_NAME="Build fixture" APP_URL="http://localhost:3002" \
@@ -62,8 +72,6 @@ COPY --from=builder --chown=nextjs:nextjs /app/drizzle/migrations ./drizzle/migr
 COPY --chown=nextjs:nextjs scripts/docker-start.mjs ./docker-start.mjs
 USER nextjs
 EXPOSE 3002
-# Self-contained healthcheck so `docker run` (ci-deploy) also gets Docker-level
-# health; docker-compose overrides this with its own probe if needed.
 HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
     CMD ["node", "-e", "fetch('http://127.0.0.1:'+(process.env.PORT||'3002')+'/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
 ENTRYPOINT ["/sbin/tini", "--"]

README.md

@@ -10,14 +10,21 @@ Features a premium animated homepage (typewriter hero, floating orbs, scroll cou
 
 | Component       | Version        | Notes                                    |
 | --------------- | -------------- | ---------------------------------------- |
-| Node.js         | 26.9.0         | Current release pinned in `.nvmrc`       |
-| pnpm            | >= 11.25.0     | Recommended package manager              |
+| Node.js         | 26.10.0        | Pinned in `.nvmrc` (`>=26.10.0 <27`)     |
+| pnpm            | 12.10.1        | Pinned via `packageManager`              |
 | npm             | >= 11.x        | Supported alternative                    |
 | yarn            | >= 4.x         | Supported alternative                    |
 | MySQL / MariaDB | 8.0+ / 10.6+   | Shared with the emulator                 |
 | Docker          | 24+            | Optional — for containerized deployment  |
 | Valkey          | 8.x+           | Optional — caching, rate limiting, SSE   |
 
+Core stack: **Next.js 16.4.0** (App Router) · **React 19.3.0** · **TypeScript 7.0.2** · **Drizzle ORM 0.45.3** · **Zod 4.6.5** · **Vitest 5.0.3** · **Biome 2.5.15** · **Playwright 1.63.0**.
+
+> Builds must run through the `pnpm` scripts. This host has no swap and
+> `vm.overcommit_memory=0`, so an uncapped `next build` gets OOM-killed by the
+> kernel and can take the database and the live release down with it. See
+> [Memory-capped commands](#memory-capped-commands).
+
 ---
 
 ## Quick Start
@@ -102,6 +109,10 @@ pnpm build && pnpm start       # or: npm run build && npm start
 
 Open `http://localhost:3002` in your browser.
 
+> Always go through these scripts. `next build` is refused outright when it is
+> not running under the memory cap — see
+> [Memory-capped commands](#memory-capped-commands).
+
 ### 6. First Login
 
 1. Register an account at `/register`, or log in with an existing emulator account.
@@ -583,7 +594,7 @@ URLs look like `https://<hotel>/imaging/avatarimage?figure=hd-180-1.ch-210-66&im
 ### Requirements (host)
 
 - Docker (daemon with `build.network: host`, same as the CMS build — this host disables Docker iptables).
-- An nginx that serves `/gamedata/` (FigureData/FigureMap/EffectMap…) and `/gamedata/bundled` (`.nitro` assets) over HTTP so the renderer can fetch them. The compose file points at `host.docker.internal:8081`.
+- An nginx that serves `/gamedata/` (FigureData/FigureMap/EffectMap…) and `/gamedata/bundled` (furniture bundle assets — `.hab`, the extension imports write and this deployment's client requests, plus any legacy `.nitro` still on disk) over HTTP so the renderer can fetch them. The compose file points at `host.docker.internal:8081`.
 
 ### Configuration — `/docker/Polaris-imager/.env`
 
@@ -685,6 +696,69 @@ For bulk-written tables (game-data JSON, imports) a containerized **`mariadb-tur
 
 The CMS caches through `cached()` / `cachedQuery()` (`src/lib/cache.ts`): an in-memory fast path with a Redis (Valkey-compatible) fallback and single-flight protection against cache stampedes. Public API routes (home, leaderboard, online count, radio, photos, …) fill Redis keys per route; verify with `redis-cli DBSIZE`. With Cloudflare in front, static and `/imaging/*` responses are additionally cached edge-side (`cf-cache-status`), cutting origin load further.
 
+#### nginx micro-cache (edge of the origin)
+
+A short-lived nginx cache sits in front of the origin for an explicit whitelist of
+public API reads. It is configured in `/etc/nginx/sites-enabled/cms.conf` and its
+backends come from `/etc/nginx/snippets/cms_upstream_servers.conf`.
+
+Why nginx and not the app: Next.js emits
+`private, no-cache, no-store, max-age=0, must-revalidate` for dynamic route
+handlers, and its response helper then drops the `Cache-Control` set by
+`publicCacheControl()`. Every one of the whitelisted routes was verified to be
+free of `auth()`, `cookies()`, `headers()` and request data, so the edge may
+cache them on their behalf.
+
+| Class | Endpoints | TTL |
+| --- | --- | --- |
+| 1 | `/api/online`, `/api/online/count` | 10s |
+| 2 | `/api/photos`, `/api/leaderboard`, `/api/radio/current-dj`, `/api/radio/points/leaderboard` | 60s |
+| 3 | `/api/staff`, `/api/teams`, `/api/guilds`, `/api/shop`, `/api/shop/categories`, `/api/values`, `/api/values/categories`, `/api/values/[0-9]+` | 300s |
+
+`/api/radio/shouts` is intentionally excluded: it is live chat.
+
+Three details are easy to get wrong and are worth keeping intact:
+
+- **`proxy_ignore_headers "Cache-Control" "Vary";` is what makes the cache work.**
+  `proxy_hide_header` only strips the header from the response to the client; the
+  cache module has already read the upstream's `no-store` by then and stores
+  nothing. Ignore the upstream directive and let nginx emit a single
+  `Cache-Control` of its own.
+- **`$upstream_status` is empty on a cache HIT** — it is only populated on a MISS.
+  The header map therefore matches both `|2` and the empty-status form, so HITs
+  get the same class as the MISS that stored them. A status-gated map alone sends
+  every HIT down the `default` branch and quietly returns `private`.
+- **A session must never be advertised as `public`.** With a session cookie nginx
+  already refuses to store the response (`proxy_no_cache`), but without the skip
+  flag in the header map the response would still claim `public, s-maxage=...` and
+  Cloudflare could share it. The map keys on
+  `"$cms_cc_class|$cms_skip_cache|$upstream_status"`.
+
+HTML is deliberately **not** cached: `src/app/(site)/page.tsx` performs `auth()`
+with a redirect to `/me` and reads `headers()` for a per-request CSP nonce.
+
+### Files changed for stability and caching
+
+| File | Change |
+| --- | --- |
+| `/etc/nginx/nginx.conf` | `worker_connections 4096`, `multi_accept on`, TLS 1.2/1.3 only, `proxy_cache_path` for the micro-cache |
+| `/etc/nginx/sites-enabled/cms.conf` | single correct `Cache-Control` per path, micro-cache on the whitelist, session/Authorization bypass, SSE block with buffering off, `upstream cms_app` + `proxy_next_upstream` |
+| `/etc/nginx/snippets/cms_upstream_servers.conf` | backend list, rewritten by `ci-deploy.sh` during a cutover |
+| `src/app/api/online/count/stream/route.ts` | `X-Accel-Buffering: no` |
+| `src/app/api/radio/stream/route.ts` | `X-Accel-Buffering: no` |
+| `src/app/api/admin/import/{audit,furni/route,furni/batch,furni/batch-regen,furni/repair-icons}/route.ts` | `X-Accel-Buffering: no` |
+| `src/app/api/admin/studio/nitro-cleanup{,/rebuild}/route.ts` | `X-Accel-Buffering: no` |
+| `scripts/ci-deploy.sh` | resource limits, blue/green cutover, `switch_upstream`, rollback split by cutover state |
+| `deploy.sh` | reduced to a wrapper around `ci-deploy.sh` |
+| `docker-compose.yml` | two replica services from a shared anchor, resource limits, port-aware healthcheck, dead `mariadb-turbo` removed |
+| `src/lib/services/cache-warmup.ts` | corrected a comment that described delays the code never had |
+| `src/lib/ci-deploy.test.ts`, `src/test/ci-deploy-harness.sh` | blue/green coverage; nginx paths are injectable so the in-place path stays tested |
+| `ecosystem.config.cjs` | removed (PM2 supervised no process, and nothing referenced it) |
+
+> The nginx files live on the host only, not in this repository. Rebuilding the
+> host loses the cache configuration — keep a copy under version control if that
+> becomes a real risk.
+
 ---
 
 ## Cloudflare & Anti-DDoS Protection
@@ -775,149 +849,188 @@ Open **DevOps → Anti-DDoS protection**
 
 ---
 
-## Local CrowdSec Engine (opt-in)
 
-The repository ships a self-contained CrowdSec engine that runs on the same
-Docker host. It runs `crowdsecurity/crowdsec:v1.8.1` in its own Compose project
-and exposes **LAPI only** on `127.0.0.1:18080`. When enabled, the app-layer
-anti-DDoS gate (`src/lib/crowdsec-local.ts`) asks the local LAPI per client IP
-(short-cached) and blocks `ban` / `captcha` decisions before its own rate
-buckets run. No reverse-proxy, Traefik, Cloudflare or firewall configuration is
-changed.
+## Production Deployment (blue/green)
 
-The engine boots in **LAPI-only mode** (`DISABLE_AGENT=true`): it does not
-consume the host Nginx access log and needs no outbound access to
-`crowdsec.net`, which is often blocked on hardened hosts. Combined with
-`DISABLE_ONLINE_API=true` (no CrowdSec Central API) the engine needs no account
-and no inbound internet — blocking comes from the imported blocklists
-(Step 4) and the app's own rate buckets. Re-enable the agent only on a host
-with outbound internet by removing `DISABLE_AGENT: "true"` from
-`deployment/crowdsec/compose.crowdsec.yml`.
+PM2 is **not** used in production. It is neither started nor supervised here; the
+CMS runs as a single Docker container per replica, started by
+`scripts/ci-deploy.sh`.
 
-### Step 1 — Enable the engine and register the bouncer
-
-```bash
-bash cms security
+```
+git push main
+  └─ Gitea Actions "deploy" job
+       └─ bash scripts/ci-deploy.sh
+            ├─ build image epicnext-cms:<sha>
+            ├─ pnpm db:migrate
+            ├─ start candidate on the idle port   (live replica keeps serving)
+            ├─ health gate + release-hash check + Playwright e2e
+            ├─ switch the nginx upstream, reload  (cutover)
+            └─ stop and retire the previous replica
 ```
 
-This generates `CROWDSEC_LAPI_API_KEY` (random 64 hex chars), writes the
-CrowdSec flags into `.env`, starts the engine and registers the `cms` bouncer
-against the local LAPI. The engine does **not** enroll into the CrowdSec
-Central API (`DISABLE_ONLINE_API=true`) and runs without the agent
-(`DISABLE_AGENT=true`), so it never phones home.
+### Why host ports instead of `--scale`
 
-### Step 2 — Restart the CMS so it loads the bouncer credentials
+The containers run with `network_mode: host`, so every replica binds a **host**
+port rather than sharing a published docker port. `docker compose up --scale
+cms=2` therefore cannot work here: the replicas would collide on 3002. Instead
+there are two fixed slots, and each release lands in the idle one:
 
-A CI-managed `epicnext-cms-app` picks the new `.env` values up on its next
-deployment. For a clone running via the updater:
+| Slot | Host port | Container name |
+| --- | --- | --- |
+| A | 3002 | `epicnext-cms-app` |
+| B | 3003 | `epicnext-cms-green` |
 
-```bash
-bash cms update --skip-pull
+`docker-compose.yml` defines both services (`cms`, and `cms-green` behind the
+`green` profile) from one shared YAML anchor so they cannot drift apart. Note
+that the CI deploy path deliberately uses `docker run` rather than compose, so
+the resource limits are declared in **both** places — limits that only existed
+in compose would never apply to a real release.
+
+### Compose on a CI host
+
+Compose and CI both want port 3002, so only one of them can own a host. A stray
+compose replica (`docker compose up`, or the daily `scripts/docker-update.sh`
+cron) parked an `epicnext-cms` container on the blue slot while nginx served the
+green slot, and every later release stopped on "Port 3002 is already in use" —
+after the build, the migrations and the browser gate. Two guards now prevent
+that:
+
+- `scripts/docker-update.sh` refuses to run on a CI host. It used to test only
+  `epicnext-cms-app`, but after a cutover to the green slot that container is
+  stopped and deleted, so the guard stopped firing while the host stayed
+  CI-managed. It now checks both slot containers and the nginx upstream.
+- `ci-deploy.sh` retires a compose replica of *this* checkout
+  (`com.docker.compose.project.config_files`) from the candidate port before
+  starting the candidate — but never a slot container, and never the port nginx
+  currently serves. Anything else still fails loudly in `assert_port_free`.
+
+### The nginx upstream is the switch
+
+nginx does not know about container names; it reads a plain list of backends from
+`/etc/nginx/snippets/cms_upstream_servers.conf`, which `ci-deploy.sh` rewrites
+during the cutover:
+
+```nginx
+upstream cms_app {
+    least_conn;
+    keepalive 32;
+    include /etc/nginx/snippets/cms_upstream_servers.conf;
+}
 ```
 
-or restart the container directly (`docker compose restart cms`). Without the
-restart the gate has not loaded the LAPI URL/key yet.
-
-### Step 3 — Verify
-
-```bash
-bash cms security status
+```
+server 127.0.0.1:3002 max_fails=2 fail_timeout=10s;
 ```
 
-Expect `CROWDSEC_LOCAL_ENABLED=yes` and `LAPI health: OK (127.0.0.1:18080)`.
-In the admin panel, **DevOps → Anti-DDoS protection** shows live block
-statistics split per origin (`community` vs `local`).
+`switch_upstream()` writes the new backend, runs `nginx -t`, and only then
+reloads. If the test fails the previous file is restored untouched, so a typo can
+never take the site down.
 
-### Step 4 — Stop the engine again (optional)
+### Failover between replicas
 
-```bash
-bash cms security disable
+`max_fails`/`fail_timeout` mark a dead replica as unavailable, but only
+`proxy_next_upstream` actually retries the other one:
+
+```nginx
+proxy_next_upstream error timeout invalid_header http_502 http_503 http_504;
+proxy_next_upstream_tries 2;
+proxy_next_upstream_timeout 10s;
 ```
 
-Stops the container and sets `CROWDSEC_LOCAL_ENABLED=false`. Volumes and the
-`.env` key are kept.
+`non_idempotent` is deliberately **absent**, so `POST` is never replayed against
+the second replica — a retried import or write would otherwise apply twice. A
+stream that already emitted events is likewise not resumed elsewhere.
 
-### Step 5 — Load external IP blocklists (optional)
+### Resource limits
 
-The engine has no built-in lists, so provide your own via a one-shot sync
-(fetches the sources, replaces every previous `cscli-import` decision):
+`--memory=4g --memory-swap=5g --cpus=2 --pids-limit=512` per replica. The limits
+were previously removed ("Next may run unrestricted"); on a shared host that
+means a single leak can starve MariaDB, nginx and Traefik.
 
-```bash
-bash cms security blocklists
-```
+> **Watch this on the first heavy import.** The 4 GiB ceiling is not yet
+> exercised by a real bulk import. If the container is OOM-killed during a large
+> furniture import, raise `mem_limit` in `docker-compose.yml` *and* `mem_limit` /
+> `mem_swap_limit` in `scripts/ci-deploy.sh` together.
 
-Defaults: Spamhaus DROP/EDROP, DShield, CINS, Greensnow, StopForumSpam,
-Binary Defense, blocklist.de, Emerging Threats, BruteForceBlocker, abuse.ch
-Feodo/SSLBL, Botvrij, IPsum, Firehol ipsets and Tor exit nodes
-(25 sources). URLhaus was removed because its `text_online` feed lists URLs,
-not IPs; a malformed token in it could otherwise expand into a bogus
-huge CIDR. The validator only accepts whole-line bare IPs or proper CIDRs,
-enforces sane prefix bounds and drops reserved/private/loopback space, so a
-bad source entry can never block the origin or internal traffic. The largest
-commercial/crowdsourced lists (AbuseIPDB, MaxMind, Cisco Talos, AlienVault
-OTX) are not included because they require an account or API key; IPsum
-already aggregates ~30 additional feeds. No account is needed, but internet
-access is — only for fetching; detection and blocking remain local. Sync
-hourly as a cron job:
+### Manual deploys
 
-```bash
-bash cms security blocklists-install-cron
-```
-
-Removal: `bash cms security blocklists-uninstall-cron`. Dry-run without
-touching LAPI: `bash cms security blocklists --dry-run`. Override the sources,
-duration, a combined cap or an allowlist in `.env`
-(`CROWDSEC_BLOCKLIST_SOURCES`, `CROWDSEC_BLOCKLIST_DURATION`,
-`CROWDSEC_BLOCKLIST_MAX_DECISIONS`, `CROWDSEC_BLOCKLIST_ALLOW`). Existing
-`cscli-import` decisions are replaced on every sync, so removed entries
-expire.
-
-### Environment variables
-
-| Variable                     | Default                       | Purpose                              |
-| ---------------------------- | ----------------------------- | ------------------------------------ |
-| `CROWDSEC_LOCAL_ENABLED`     | `false`                       | Master switch for the local stack    |
-| `CROWDSEC_LAPI_URL`          | `http://127.0.0.1:18080`      | LAPI endpoint (loopback only)        |
-| `CROWDSEC_LAPI_PORT`         | `18080`                       | Host port the engine maps to LAPI    |
-| `CROWDSEC_LAPI_API_KEY`      | —                             | Bouncer key; required when enabled   |
-| `CROWDSEC_LAPI_TIMEOUT_MS`   | `500`                         | Per-decision request timeout         |
-| `CROWDSEC_LAPI_RETRY_MS`     | `500`                         | Backoff before retrying LAPI         |
-| `CROWDSEC_NGINX_LOG_DIR`     | `/var/log/nginx`              | Access-log directory for the engine  |
-
-### Notes and limitations
-
-- Changing the port means updating `CROWDSEC_LAPI_PORT` **and**
-  `CROWDSEC_LAPI_URL` together, then re-running `bash cms security`.
-- Rotate the key by editing `CROWDSEC_LAPI_API_KEY` in `.env`, running
-  `bash cms security` again (re-registers the bouncer) and restarting the CMS.
-- The gate is **fail-closed at startup** when the feature is enabled without a
-  key (startup aborts with a clear message). At runtime a LAPI network error
-  **fails open** (traffic is allowed, decisions paused); a 403 from LAPI
-  pauses local decisions for 5 minutes.
-- This bouncer is **application-layer**: it sheds known-bad IPs at the CMS
-  process only. It does not drop traffic before the origin, does not protect
-  other host ports/services, and depends on the client IP being trustworthy at
-  the ingress. Keep the upstream protections (Cloudflare IP rules, proxy rate
-  limits) for defense before the origin.
+`./deploy.sh` is a thin wrapper around `scripts/ci-deploy.sh`, so a manual
+release and a CI release follow exactly the same path. The previous version
+killed whatever held port 3002 with `fuser -k` and ran `docker compose down`
+before anything new existed — guaranteed downtime on every failed build. The
+branch guard inside `ci-deploy.sh` only accepts `main`/`master`.
 
 ---
 
-## Production Deployment (PM2)
+## Memory-capped commands
+
+This host runs with `vm.overcommit_memory=0` **and no swap**. When a process
+asks for more memory than is free, the kernel does not wait — it calls the
+OOM-killer immediately, and it picks its victim across the **whole machine**,
+not just the offending process. An uncapped build does not merely fail: it can
+take the MariaDB process, nginx and the live release down with it.
+
+Every heavy command therefore runs inside its own cgroup with a hard
+`MemoryMax`, via `scripts/with-memory-cap.sh`. If the build outgrows its
+ceiling, only that cgroup is killed — the build fails, the site keeps serving.
+
+| Script                | Ceiling | Covers                                  |
+| --------------------- | ------- | --------------------------------------- |
+| `pnpm dev`            | 8 GB    | Dev server                              |
+| `pnpm build`          | 10 GB   | Production build                        |
+| `pnpm analyze`        | 10 GB   | Build + bundle-size report              |
+| `pnpm test`           | 8 GB    | Vitest                                  |
+| `pnpm test:coverage`  | 8 GB    | Vitest with coverage                    |
+| `pnpm test:ui`        | 8 GB    | Playwright                              |
+| `pnpm test:e2e`       | 8 GB    | Playwright                              |
+| `pnpm test:integration` | 8 GB  | Vitest integration config               |
+| `pnpm typecheck`      | 6 GB    | `tsc --noEmit`                          |
+
+### Running the builder by hand
 
 ```bash
-pnpm build
-pm2 start pnpm --name "next" -- start
-pm2 save
+npx next build          # ✗ refused before it allocates anything
 ```
 
-Restart after updates:
+`next build` loads `next.config.ts`, which **refuses any production build that
+is not running under the memory cap**. This closes the one hole the `pnpm`
+scripts leave open: invoking the builder directly — from a terminal, an IDE, or
+an automated agent — would otherwise bypass the cgroup entirely and go
+unbounded.
+
+The refusal looks like this:
 
-```bash
-git pull
-pnpm install
-pnpm build
-pm2 restart next
 ```
+Error: Refusing to run an uncapped production build.
+
+On this host an unbounded `next build` gets OOM-killed by the kernel,
+and the killer may take the database, nginx or the live release with it.
+
+Use the capped build instead:
+    pnpm build
+```
+
+Fix: use `pnpm build`. If you are genuinely inside an isolated environment
+where the container *is* the boundary (the Docker build, a CI runner), set
+`CMS_MEMORY_CAPPED=1` to opt out deliberately.
+
+### Backends
+
+`scripts/with-memory-cap.sh` picks its mechanism automatically:
+
+| `CMS_MEMORY_CAP_BACKEND` | Mechanism                                   | Notes                                                   |
+| ------------------------ | ------------------------------------------- | ------------------------------------------------------- |
+| `auto` *(default)*       | systemd cgroup `MemoryMax`                  | Real RSS bound over the whole process tree. Used here.   |
+| `ulimit`                 | `ulimit -v`, per process                    | Virtual address space, **not** RSS. Fallback only.       |
+| `none`                   | None — warning only                         | Docker build and GitLab runner, each already isolated.   |
+
+On a host **without** systemd and without `CMS_MEMORY_CAP_BACKEND=none`, the
+script refuses to run rather than proceeding unbounded.
+
+> Do not "fix" a cap failure by lowering `--max-old-space-size` or by raising
+> `CMS_MEMORY_CAP_VIRTUAL` (the default is `40g` on purpose). A `ulimit -v` of
+> 10g makes V8 clamp its own heap to ~2.25 GB and webpack dies with
+> `std::bad_alloc`. Measure first; raise the ceiling deliberately.
 
 ---
 
@@ -926,10 +1039,22 @@ pm2 restart next
 | Command                   | Description                                        |
 | ------------------------- | -------------------------------------------------- |
 | `pnpm dev`                | Start development server (hot reload)              |
-| `pnpm build`              | Production build                                   |
+| `pnpm build`              | Production build (memory-capped)                   |
 | `pnpm start`              | Start production server                            |
 | `pnpm typecheck`          | Run TypeScript type checking                       |
 | `pnpm test`               | Run all tests (Vitest)                             |
+| `pnpm test:coverage`      | Run all tests with coverage thresholds enforced    |
+| `pnpm test:ui`            | Playwright UI tests (`playwright.ui.config.ts`)    |
+| `pnpm test:ui:update`     | Playwright UI tests, updating snapshots            |
+| `pnpm test:e2e`           | Playwright end-to-end tests                        |
+| `pnpm test:integration`   | Integration tests (own Vitest config)              |
+| `pnpm test:housekeeping`  | Housekeeping feature tests                         |
+| `pnpm lint`               | Lint and format check (Biome)                      |
+| `pnpm biome:lint`         | Alias of `pnpm lint`                               |
+| `pnpm format`             | Format files in place (Biome)                      |
+| `pnpm toolchain:check`    | Verify the Node toolchain matches `.nvmrc`         |
+| `pnpm i18n:check`         | Audit CMS translation coverage                      |
+| `pnpm deps:audit`         | Audit dependencies for high-severity advisories    |
 | `pnpm db:migrate`         | Apply pending SQL migrations                       |
 | `pnpm db:migrate:status`  | Show migration status                              |
 | `pnpm db:schema:generate` | Regen `src/db/schema.ts` from prior schema + live DB |
@@ -939,11 +1064,16 @@ pm2 restart next
 | `pnpm db:bulk`            | Batch-import >50 MB JSON via `scripts/bulk-import-json.ts` |
 | `pnpm db:up` / `pnpm db:down` | Start / stop the `mariadb-turbo` container     |
 | `pnpm gamedata:compress`  | Pre-compress large gamedata JSON to `.gz` (gzip_static) |
-| `pnpm analyze`            | Build + open bundle analyzer                       |
+| `pnpm analyze`            | Build + report per-route bundle sizes              |
+| `pnpm performance:report` | Re-render the performance report from a build     |
 | `pnpm jobs:worker`        | Start background task worker                       |
-| `pnpm biome:check`        | Lint and format code                               |
+| `pnpm assets:editor`      | Copy TinyMCE editor assets into `public/`          |
 
 > Replace `pnpm` with `npm run` or `yarn` for other package managers.
+>
+> The heavy ones run memory-capped — see
+> [Memory-capped commands](#memory-capped-commands). A production `next build`
+> run outside the wrapper is refused rather than executed unbounded.
 
 ---
 
@@ -1068,7 +1198,7 @@ The CMS automatically translates furniture names and descriptions to **13 langua
 pnpm dev          # Start with hot reload
 pnpm typecheck    # Type check all files
 pnpm test         # Run test suite
-pnpm analyze      # Build and analyze bundle sizes
+pnpm analyze      # Build and report per-route bundle sizes
 pnpm biome:check  # Lint and format
 ```
 

biome.json

@@ -38,6 +38,30 @@
 					}
 				}
 			}
+		},
+		{
+			"includes": [
+				"src/components/admin/catalog-manager/sortable-tree.tsx",
+				"src/components/admin/studio/organize-imports-dialog/mall-helpers.tsx",
+				"src/app/admin/import/furni/nitro-editor-dialog.tsx"
+			],
+			"linter": {
+				"rules": {
+					"suspicious": {
+						"noArrayIndexKey": "off"
+					}
+				}
+			}
+		},
+		{
+			"includes": ["src/components/admin/catalog-manager/sortable-tree.tsx"],
+			"linter": {
+				"rules": {
+					"correctness": {
+						"useExhaustiveDependencies": "off"
+					}
+				}
+			}
 		}
 	],
 	"css": {

cms

@@ -4,7 +4,6 @@ DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 case "${1:-help}" in
   install) shift; exec bash "$DIR/scripts/docker-install.sh" "$@" ;;
   update) shift; exec bash "$DIR/scripts/docker-update.sh" "$@" ;;
-  security) shift; exec bash "$DIR/scripts/crowdsec-setup.sh" "$@" ;;
-  help|--help|-h) printf '%s\n' 'bash cms install   Configure and install on a Linux Docker host' 'bash cms update    Update using saved settings; --skip-pull uses checked-out release' 'bash cms security  Configure the opt-in local CrowdSec stack (enable|status|disable|blocklists)' ;;
-  *) echo "Unknown command. Use: bash cms install | update | security" >&2; exit 1 ;;
+  help|--help|-h) printf '%s\n' 'bash cms install   Configure and install on a Linux Docker host' 'bash cms update    Update using saved settings; --skip-pull uses checked-out release' ;;
+  *) echo "Unknown command. Use: bash cms install | update" >&2; exit 1 ;;
 esac

deploy.sh

@@ -1,29 +1,31 @@
-#!/bin/bash
-# Forcefully free port 3002 and redeploy the CMS
-PORT=3002
+#!/usr/bin/env bash
+# Handmatige release uitvoeren.
+#
+# Dit script is bewust een dunne wrapper. Het echte werk zit in
+# `scripts/ci-deploy.sh`, want dat is wat Gitea Actions ook draait. Eén deploypad
+# betekent dat een handmatige release niet anders kan werken dan een release uit
+# CI, dus er is geen tweede, slechter onderhouden pad meer.
+#
+# Waarom dit niet meer zelf doet wat het deed:
+#   - `fuser -k 3002/tcp` sloopte de live release bij elke mislukte build;
+#   - `docker compose down` haalde de site omlaag vóórdat er iets nieuws stond;
+#   - de container draait via `docker run` uit ci-deploy.sh, niet via compose, dus
+#     compose beheerde hier nooit de release die er echt draaide.
+#
+# `scripts/ci-deploy.sh` start nu blue/green: de nieuwe release komt op de vrije
+# poort terwijl de live release door blijft draaien, en nginx gaat pas om nadat
+# de kandidaat gezond is en de e2e-test heeft gewonnen.
+set -Eeuo pipefail
 
-echo "--- Preparing for deployment ---"
+deploy_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "$deploy_dir"
 
-# Check if fuser is installed, if not, warn the user
-if ! command -v fuser &> /dev/null; then
-    echo "Error: 'fuser' command not found. Please install psmisc (e.g., sudo apt install psmisc)."
-    exit 1
-fi
-
-echo "Forcefully freeing port $PORT..."
-# -k kills processes, -n tcp specifies tcp socket
-fuser -k $PORT/tcp || echo "No process found on port $PORT or already free."
-
-echo "Stopping containers..."
-docker compose down
-
-echo "Starting deployment..."
-if docker compose up -d --build; then
-    ./scripts/alert.sh "Deployment successful for EpicNext-Cms"
-    echo "--- Deployment successful ---"
-else
-    ./scripts/alert.sh "Deployment FAILED for EpicNext-Cms"
-    echo "--- Deployment FAILED ---"
-    exit 1
+if [ "${1:-}" = "--help" ] || [ "${1:-}" = "-h" ]; then
+	sed -n '2,20p' "$deploy_dir/deploy.sh" | sed 's/^# \{0,1\}//'
+	exit 0
 fi
 
+# De branch-guard in ci-deploy.sh accepteert alleen main/master, en controleert
+# daarna of de HEAD-commit nog de nieuwste op de remote is. Deployen vanuit een
+# feature-branch kan dus niet per ongeluk; dat was eerder wél mogelijk.
+exec bash "$deploy_dir/scripts/ci-deploy.sh" "$@"

deployment/crowdsec/acquis.d/nginx.yaml

@@ -1,4 +0,0 @@
-filenames:
-  - /var/log/nginx/access.log
-labels:
-  type: nginx

deployment/crowdsec/compose.crowdsec.yml

@@ -1,41 +0,0 @@
-services:
-  crowdsec:
-    image: crowdsecurity/crowdsec:${CROWDSEC_VERSION:-v1.8.1}
-    container_name: epicnext-crowdsec
-    restart: unless-stopped
-    profiles: ["security"]
-    environment:
-      DISABLE_AGENT: "true"
-      BOUNCER_KEY_cms: ${CROWDSEC_LAPI_API_KEY:?CROWDSEC_LAPI_API_KEY must be set}
-      DISABLE_ONLINE_API: "true"
-      GID: "${CROWDSEC_GID:-0}"
-      TZ: "${TZ:-UTC}"
-    ports:
-      - "${CROWDSEC_LAPI_BIND_HOST:-127.0.0.1}:${CROWDSEC_LAPI_PORT:-18080}:8080"
-    volumes:
-      - ./acquis.d:/etc/crowdsec/acquis.d:ro
-      - ${CROWDSEC_NGINX_LOG_DIR:-/var/log/nginx}:/var/log/nginx:ro
-      - crowdsec-config:/etc/crowdsec
-      - crowdsec-data:/var/lib/crowdsec/data
-    security_opt:
-      - no-new-privileges:true
-    pids_limit: 256
-    logging:
-      driver: json-file
-      options:
-        max-size: "10m"
-        max-file: "3"
-    healthcheck:
-      test:
-        [
-          "CMD-SHELL",
-          "wget -q -O - http://127.0.0.1:8080/health >/dev/null 2>&1",
-        ]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-      start_period: 30s
-
-volumes:
-  crowdsec-config:
-  crowdsec-data:

deployment/proxy/cloudflare-ips.conf

@@ -0,0 +1,81 @@
+# Trusted edge networks + live Cloudflare CDN ranges.
+# Managed/regenerated by scripts/cf-ips-sync.sh - do not hand-edit the ranges.
+
+# Topology: Cloudflare -> Traefik (:443, docker bridge proxy_traefik-proxy) ->
+# nginx (:9443) -> CMS. nginx ALSO receives direct connections on :9443 from
+# Cloudflare edges and from the game client (ws.epicnabbo.nl is not proxied).
+
+# nginx only trusts the peers listed here as a source of $remote_addr
+# (via CF-Connecting-IP). Anyone else presenting a CF-Connecting-IP or
+# CF-ray header is spoofing and is rejected in nginx-cms.conf.
+
+# 1 = peer is a trusted edge or internal network (keyed on the raw peer,
+#     unaffected by real_ip rewrites).
+geo $realip_remote_addr $cms_trusted_edge {
+    default 0;
+    127.0.0.0/8 1;                    # localhost (health checks, admin)
+    ::1 1;                            # localhost v6
+    172.22.0.0/16 1;                # Traefik (proxyserver_traefik-proxy)
+    # --- Cloudflare IPv4 ranges (live from cloudflare.com/ips-v4) ---
+    173.245.48.0/20 1;
+    103.21.244.0/22 1;
+    103.22.200.0/22 1;
+    103.31.4.0/22 1;
+    141.101.64.0/18 1;
+    108.162.192.0/18 1;
+    190.93.240.0/20 1;
+    188.114.96.0/20 1;
+    197.234.240.0/22 1;
+    198.41.128.0/17 1;
+    162.158.0.0/15 1;
+    104.16.0.0/13 1;
+    104.24.0.0/14 1;
+    172.64.0.0/13 1;
+    131.0.72.0/22 1;
+    # --- Cloudflare IPv6 ranges (live from cloudflare.com/ips-v6) ---
+    2400:cb00::/32 1;
+    2606:4700::/32 1;
+    2803:f800::/32 1;
+    2405:b500::/32 1;
+    2405:8100::/32 1;
+    2a06:98c0::/29 1;
+    2c0f:f248::/32 1;
+}
+
+# 1 when an UNTRUSTED peer still presents a CF-Connecting-IP header: that is a
+# spoof attempt (only real Cloudflare edges or Traefik may do that lawfully).
+map "$cms_trusted_edge:$http_cf_connecting_ip" $cms_disallow_forwarding {
+    default 0;
+    "~^0:.+" 1;
+}
+
+# Rewrite $remote_addr from CF-Connecting-IP but ONLY for the trusted peers
+# above. Direct game clients (untrusted) keep their real peer address.
+set_real_ip_from 127.0.0.0/8;
+set_real_ip_from ::1;
+set_real_ip_from 172.22.0.0/16;
+set_real_ip_from 173.245.48.0/20;
+set_real_ip_from 103.21.244.0/22;
+set_real_ip_from 103.22.200.0/22;
+set_real_ip_from 103.31.4.0/22;
+set_real_ip_from 141.101.64.0/18;
+set_real_ip_from 108.162.192.0/18;
+set_real_ip_from 190.93.240.0/20;
+set_real_ip_from 188.114.96.0/20;
+set_real_ip_from 197.234.240.0/22;
+set_real_ip_from 198.41.128.0/17;
+set_real_ip_from 162.158.0.0/15;
+set_real_ip_from 104.16.0.0/13;
+set_real_ip_from 104.24.0.0/14;
+set_real_ip_from 172.64.0.0/13;
+set_real_ip_from 131.0.72.0/22;
+set_real_ip_from 2400:cb00::/32;
+set_real_ip_from 2606:4700::/32;
+set_real_ip_from 2803:f800::/32;
+set_real_ip_from 2405:b500::/32;
+set_real_ip_from 2405:8100::/32;
+set_real_ip_from 2a06:98c0::/29;
+set_real_ip_from 2c0f:f248::/32;
+
+real_ip_header CF-Connecting-IP;
+real_ip_recursive off;

deployment/proxy/cms_upstream_servers.conf

@@ -0,0 +1,2 @@
+# Default; ci-deploy.sh (blue/green) herschrijft dit bestand bij elke switch.
+server 127.0.0.1:3002;

deployment/proxy/nginx-cms.conf

@@ -0,0 +1,660 @@
+# ─── EpicNabbo CMS — nginx site config ───
+# Source of truth: deployment/proxy/nginx-cms.conf in the EpicNext-Cms repo.
+# Installed at /etc/nginx/sites-available/cms.conf by scripts/nginx-sync.sh.
+#
+# Ingeladen binnen http{} uit /etc/nginx/sites-enabled/*.conf.
+#
+# PRINCIPE — één eigenaar per URL-klasse:
+#   * Alleen nginx (dit bestand) mag Cache-Control toevoegen voor routes die
+#     een publieke, gedeelde cache toestaan.
+#   * Alles wat de app zelf (src/proxy.ts) als no-store stuurt, blijft no-store.
+#   * Er is GEEN byte-cache meer (geen proxy_cache_*): de app deed ooit zelf
+#     al single-flight/stale-while-revalidate in src/lib/cache.ts. Daarmee is
+#     "dubbele cache" (nginx HIT naast de app) structureel onmogelijk.
+#   * De headers die hieronder staan zijn de enige Cache-Control die een
+#     client/CDN te zien krijgt; er wordt nooit een tweede toegevoegd.
+
+# ─── Maps (moeten op http level staan) ───
+
+map $request_method $cors_headers {
+    OPTIONS 1;
+    default 0;
+}
+
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    '' close;
+}
+
+# ─── Cachebeleid: één plek die beslist of een antwoord gedeeld mag worden ───
+#
+# Waarom op nginx: Next.js overschrijft `Cache-Control` op dynamische route
+# handlers (next/dist/server/send-response.js weigert een al aanwezige header
+# te overschrijven) en src/proxy.ts zet die paden bovendien op no-store. Deze
+# maps nemen de publieke beslissing daarom expliciet over van de app, zodat
+# browser + CDN daadwerkelijk cachen — met één enkele header.
+
+# Nooit als "publiek" aankondigen als er een sessie aan hangt. NextAuth v5
+# zet `__Secure-authjs.session-token` (en `authjs.*` zonder prefix); de
+# Nitro-client gebruikt een eigen cookie. Elke cookie waarvan de naam op
+# session-token eindigt of met authjs. begint telt als "ingelogd", plus elk
+# Authorization-header. Zo kan een persoonlijke variant nooit publiek worden.
+map $http_cookie $cms_sess_cookie {
+    default            0;
+    "~*session-token=" 1;
+    "~*authjs\."       1;
+}
+
+map $http_authorization $cms_authz_header {
+    default 1;
+    ""      0;
+}
+
+# "1" zodra er ook maar één auth-signaal aanwezig is.
+map "$cms_sess_cookie$cms_authz_header" $cms_skip_cache {
+    default 1;
+    "~^00$" 0;
+}
+
+# Cacheklasse per endpoint. De TTL's komen overeen met wat de app zelf al
+# aangeeft (publicCacheControl in src/lib/api.ts) zodat de edge niets
+# verscherper maakt dan de applicatie toestaat. Klasse 0 = no-store.
+map $uri $cms_cc_class {
+    default 0;
+    # online count wordt door elke pagina en de SSE-stream gepolld
+    ~^/api/online(/count)?$                                                              1;
+    # snel verouderende, maar publieke lijsten
+    ~^/api/(photos|leaderboard|radio/current-dj|radio/points/leaderboard)$                2;
+    # stabiele catalogus- en rosterdata
+    ~^/api/(staff|teams|guilds|shop|values)(/categories|/[0-9]+)?$                        3;
+}
+
+# Eén bron van waarheid: klasse + al dan niet ingelogd. De `|`-scheiding is
+# nginx' string-samenvoeging; `~^1\|0` leest "klasse 1 en niet ingelogd".
+map "$cms_cc_class|$cms_skip_cache" $cms_public_cc {
+    default     "private, no-cache, no-store, max-age=0, must-revalidate";
+    "~^1\|0"    "public, max-age=10, s-maxage=10, stale-while-revalidate=30";
+    "~^2\|0"    "public, max-age=60, s-maxage=60, stale-while-revalidate=180";
+    "~^3\|0"    "public, max-age=300, s-maxage=300, stale-while-revalidate=600";
+}
+
+# Bestandsnaam van een furni-icon, opgehaald uit de URL. De locatie voor
+# /swf/dcr/hof_furni/icons/ heeft die nodig om hetzelfde bestand bij de
+# gamedata-boom op te kunnen vragen. Leeg laten voor elke andere URL, zodat
+# niets anders deze waarde per ongeluk gebruikt.
+map $uri $furni_icon_file {
+    ~^/swf/dcr/hof_furni/icons/(?<icon_file>.+)$    $icon_file;
+    default                                         "";
+}
+
+# Cache-Control per status voor het CMS-valrimpeltje. Een 404 mag nooit
+# gecacht worden (zie @gamedata_missing hieronder), dus die krijgt `no-store`
+# in plaats van de icon-TTL.
+map $upstream_status $furni_icon_cc {
+    200     "public, max-age=604800, stale-while-revalidate=2592000";
+    default "no-store";
+}
+
+# ─── Mime fix ───
+types {
+    application/json jsonc;
+}
+
+# ==========================================
+# REDIRECT HTTP -> HTTPS (Poort 9444)
+# ==========================================
+server {
+    listen 9444 default_server;
+    listen [::]:9444 default_server;
+    server_name _;
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+# ==========================================
+# WEBSOCKET GAME SERVER (ws.epicnabbo.nl)
+# ==========================================
+server {
+    listen 9443 ssl;
+    listen [::]:9443 ssl;
+    server_name ws.epicnabbo.nl;
+
+    ssl_certificate /etc/ssl/epicnabbo-backend.pem;
+    ssl_certificate_key /etc/ssl/epicnabbo-backend.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers off;
+
+    # ─── Trusted Edge Gate ───
+    # Real Cloudflare edges and Traefik are the only peers trusted to supply a
+    # CF-Connecting-IP (see cloudflare-ips.conf). Any other peer that does is
+    # spoofing and is rejected before it reaches the CMS. Legitimate direct
+    # visitors (game client, :9443) never carry that header and pass through
+    # with their real peer address.
+    if ($cms_disallow_forwarding) {
+        return 403;
+    }
+
+    location /health {
+        access_log off;
+        return 200 "OK";
+        add_header Content-Type text/plain;
+    }
+
+    location / {
+        proxy_pass http://127.0.0.1:2096;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+
+# Echt client IP (trusted peers via real_ip, directe clients = eigen peer)
+        proxy_set_header CF-Connecting-IP "";
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        proxy_read_timeout 86400s;
+        proxy_send_timeout 86400s;
+    }
+}
+
+# ==========================================
+# MAIN HTTPS SERVER (Poort 9443)
+# ==========================================
+server {
+    listen 9443 ssl reuseport default_server;
+    listen [::]:9443 ssl reuseport default_server;
+    listen 9443 quic reuseport;
+    listen [::]:9443 quic reuseport;
+    http2 on;
+
+    server_name epicnabbo.nl www.epicnabbo.nl;
+
+    ssl_certificate /etc/ssl/epicnabbo-backend.pem;
+    ssl_certificate_key /etc/ssl/epicnabbo-backend.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers off;
+    ssl_early_data on;
+    add_header Alt-Svc 'h3=":9443"; ma=86400' always;
+
+    # Resuming a session skips the full handshake, which is most of the cost of
+    # a TLS connection. Without this nginx performs no session resumption at all:
+    # every visitor paid a full handshake on every request. 50M shared sessions
+    # is roughly 1GB at the default 20-byte key id plus overhead.
+    ssl_session_cache shared:CMS_TLS:50m;
+    ssl_session_timeout 1d;
+    ssl_session_tickets off;
+
+    # `index index.html` without a `root` left nginx resolving every
+    # try_files/$uri against the compiled-in default /etc/nginx/html. The
+    # /robots.txt and /favicon.ico probes then stat() a path the worker cannot
+    # traverse, and because a failed stat is logged at crit the error log filled
+    # with 149 crit lines per scan. Pointing root at the CMS document root makes
+    # the same probe a plain 404, which log_not_found already suppresses.
+    root /var/www/html;
+
+    index index.html;
+
+    # ─── Security Headers ───
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+
+    # ─── Trusted Edge Gate ───
+    # Real Cloudflare edges / Traefik are the only peers allowed to supply a
+    # CF-Connecting-IP (see cloudflare-ips.conf). Any other peer presenting one
+    # is spoofing (direct :9443 traffic), and is rejected before it reaches the
+    # CMS. Legitimate direct visitors never carry that header and pass through
+    # with their real peer address.
+    if ($cms_disallow_forwarding) {
+        return 403;
+    }
+
+    # ─── Client Limits & Timeouts ───
+    client_max_body_size 20m;
+    client_body_buffer_size 16k;
+    client_header_buffer_size 1k;
+    large_client_header_buffers 4 8k;
+    client_body_timeout 12s;
+    client_header_timeout 12s;
+    keepalive_timeout 30s;
+    send_timeout 10s;
+
+# Abuse limits. Deliberately NOT set at server scope: a room load and a page
+    # load are not the same request profile, so each location picks its own zone.
+    # /gamedata/* has no request limit at all — it is a disk cache, so limiting
+    # it only cost players their icons. The page routes carry the budget.
+    limit_conn cms_conn_per_ip 30;
+
+    # Traefik health-check route herstellen
+    location = /health {
+        access_log off;
+        return 200 "OK";
+        add_header Content-Type text/plain;
+    }
+
+    # ─── Statische Bestanden & Assets ───
+    location ^~ /client/ {
+        alias /var/www/Octane/dist/;
+        try_files $uri $uri/ =404;
+        limit_req zone=cms_static_per_ip burst=1000 nodelay;
+
+        location ~* \.(js|json|css|html|wasm|ttf|woff|woff2|gif|webp|png|jpg|jpeg|svg|dat)$ {
+            add_header Cache-Control "public, max-age=2592000";
+            access_log off;
+            add_header Cache-Tag "cms-client";
+            add_header Access-Control-Allow-Origin $http_origin always;
+            add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+        }
+    }
+
+    location ^~ /nitro-client/ {
+        alias /var/www/Octane/dist/;
+        try_files $uri $uri/ =404;
+        limit_req zone=cms_static_per_ip burst=1000 nodelay;
+
+        location ~* \.(js|json|css|html|wasm|ttf|woff|woff2|gif|webp|png|jpg|jpeg|svg|dat)$ {
+            add_header Cache-Control "public, max-age=2592000";
+            access_log off;
+            add_header Cache-Tag "cms-client";
+            add_header Access-Control-Allow-Origin $http_origin always;
+            add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+            if ($cors_headers) {
+                add_header Access-Control-Max-Age 1728000;
+                add_header Content-Type "text/plain; charset=utf-8";
+                return 204;
+            }
+        }
+    }
+
+    location = /gamedata { return 301 /gamedata/config/; }
+    location = /gamedata/ { return 301 /gamedata/config/; }
+
+    # ─── Gamedata: vier cache-klassen, want niet alles onder /gamedata/ is
+    # even veranderlijk.
+    #
+    # Dit pad had één regel voor de hele boom: `max-age=604800` (7 dagen). De
+    # Habbo-client haalt FurnitureData.json hier op, dus na een import bleef het
+    # client-side dagenlang de oude versie tonen — een nieuw geïmporteerd
+    # meubel was gewoon onzichtbaar. De purge van de `cms-gamedata`-tag
+    # (edge-cache.ts) raakt alleen de Cloudflare-kopie, niet de browser.
+    #
+    # 1. config/     — FurnitureData.json + de vertaalde bestanden. Verandert
+    #                  bij elke import. Kort, en `must-revalidate` sluit de
+    #                  "stuur uit de cache"-route uit zodat de client na de
+    #                  TTL een 304 vraagt in plaats van de oude body te hergebruiken.
+    # 2. bundled/    — nitro-bundles per sprite. De inhoud kan veranderen zonder
+    #                  dat de bestandsnaam verandert (schalen, repareren), dus
+    #                  ook revalideren, maar minder vaak: ze worden veel vaker
+    #                  opgehaald dan ze worden geschreven.
+    # 3. icons/      — `{classname}_icon.png`. Wordt wél herschreven onder
+    #                  dezelfde naam (repair-icons.ts, herimport), dus ook
+    #                  klasse 4's "nooit herschreven" geldt hier niet. Wel
+    #                  minder vaak dan 2: per uur een must-revalidate is één
+    #                  304 per icon per uur, en een gerepareerd icon is zo
+    #                  binnen een uur zichtbaar in plaats van dagenlang oud.
+    # 4. alles wat overblijft (c_images, album*, clothes, …) — content-addressed
+    #      of per item uniek, nooit herschreven onder dezelfde naam. Blijft lang.
+    location ^~ /gamedata/config/ {
+        alias /var/www/Gamedata/config/;
+        add_header Cache-Control "public, max-age=300, must-revalidate";
+        access_log off;
+        add_header Cache-Tag "cms-gamedata";
+
+        add_header Access-Control-Allow-Origin $http_origin always;
+        add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+        if ($cors_headers) {
+            add_header Access-Control-Max-Age 1728000;
+            add_header Content-Type "text/plain; charset=utf-8";
+            return 204;
+        }
+        error_page 404 = @gamedata_missing;
+    }
+
+    location ^~ /gamedata/bundled/ {
+        alias /var/www/Gamedata/bundled/;
+        add_header Cache-Control "public, max-age=3600, must-revalidate";
+        access_log off;
+        add_header Cache-Tag "cms-gamedata";
+
+        add_header Access-Control-Allow-Origin $http_origin always;
+        add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+        if ($cors_headers) {
+            add_header Access-Control-Max-Age 1728000;
+            add_header Content-Type "text/plain; charset=utf-8";
+            return 204;
+        }
+        error_page 404 = @gamedata_missing;
+    }
+
+    location ^~ /gamedata/icons/ {
+        alias /var/www/Gamedata/icons/;
+        add_header Cache-Control "public, max-age=3600, must-revalidate";
+        access_log off;
+        add_header Cache-Tag "cms-gamedata";
+
+        # Geen limit_req: gamedata is schijf-cache, geen CMS-backend. Een
+        # kamerladen vuurt honderden bestanden in één burst af en elke limiet
+        # hier leidde alleen tot zichtbaar gemiste icons.
+
+        add_header Access-Control-Allow-Origin $http_origin always;
+        add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+        if ($cors_headers) {
+            add_header Access-Control-Max-Age 1728000;
+            add_header Content-Type "text/plain; charset=utf-8";
+            return 204;
+        }
+        error_page 404 = @gamedata_missing;
+    }
+
+    location /gamedata/ {
+        alias /var/www/Gamedata/;
+        add_header Cache-Control "public, max-age=604800";
+        access_log off;
+        add_header Cache-Tag "cms-gamedata";
+
+        add_header Access-Control-Allow-Origin $http_origin always;
+        add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+        if ($cors_headers) {
+            add_header Access-Control-Max-Age 1728000;
+            add_header Content-Type "text/plain; charset=utf-8";
+            return 204;
+        }
+        error_page 404 = @gamedata_missing;
+    }
+
+    # Een ONTBREKEND gamedata-bestand mag nooit gecacht worden, en daarom
+    # krijgt elke 404 hier een eigen handler.
+    #
+    # Zonder deze handler stuurde nginx op een 404 helemaal geen Cache-Control:
+    # `add_header` geldt zonder `always` alleen voor 2xx/3xx. Cloudflare vond
+    # dan geen expliciete cache-instructie en nam de zone-instelling over:
+    # "Browser Cache TTL = 1 jaar". Gevolg: de 404 kwam terug als
+    # `cache-control: max-age=31536000` met `cf-cache-status: HIT` — dus
+    # vastgezet in de browser van de bezoeker én op de edge. Een icon dat één
+    # keer te vroeg werd opgevraagd (import nog bezig) bleef daarom het hele
+    # jaar een 404, ook nadat het bestand er wél stond. Dat was de "sommige
+    # icons laden wel, sommige niet"-klacht.
+    #
+    # `no-store` (niet een korte TTL): het bestand kan elk moment verschijnen,
+    # dus er is geen enkel venster waarin we een 404 willen vasthouden. De
+    # Cache-Tag blijft meegegeven zodat een al gecachte 404 alsnog te purgen is
+    # via `scripts/cf-purge.sh cms-gamedata`.
+    location @gamedata_missing {
+        add_header Cache-Control "no-store" always;
+        add_header Cache-Tag "cms-gamedata" always;
+        add_header Access-Control-Allow-Origin $http_origin always;
+        add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+        return 404;
+    }
+
+    # ─── Furni-icons: gamedata-boom eerst, CMS-boom als valrimpeltje ───
+    #
+    # De CMS bouwde zijn icon-URL's altijd vanaf /swf/dcr/hof_furni/icons/,
+    # maar de catalogus komt uit /var/www/Gamedata/icons:
+    #   - van de 16.263 classnames in items_base staat er 15.338 hier onder de
+    #     "veilige" naam (`highscore_perteam_1_icon.png`), tegen 11.267 in
+    #     public/swf/dcr/hof_furni/icons;
+    #   - de swf-boom houdt kleurvarianten bovendien vast met een letterlijke
+    #     `*` in de bestandsnaam (`highscore_perteam*1_icon.png`), dus elke
+    #     aanvraag met de veilige naam mist;
+    #   - en `hof.furni.url` wijst de Nitro-client al naar deze boom.
+    # Resultaat was een 404 voor `highscore_perteam_1_icon.png` en duizenden
+    # andere, terwijl `/gamedata/icons/` ze wél heeft.
+    #
+    # Deze locatie leest de gamedata-boom rechtstreeks van schijf — nginx heeft
+    # er leesrechten op en het is de boom die de client ook gebruikt. Wat daar
+    # niet staat wordt doorgestuurd naar de CMS, die uit public/ serveert,
+    # zodat niets wat nu al laadde stopt met laden.
+    #
+    # Een echte miss is een no-store 404, nooit een gecachte: `add_header`
+    # zonder `always` zegt niets over een 404, en zonder de expliciete handler
+    # hieronder neemt Cloudflare de zone-TTL (1 jaar) over. Zelfde les als bij
+    # @gamedata_missing hierboven.
+    location ^~ /swf/dcr/hof_furni/icons/ {
+        alias /var/www/Gamedata/icons/;
+        error_page 404 = @furni_icon_from_cms;
+        # 403 = het pad valt op een map, dus `alias` eindigt op een directory.
+        # Dat is geen icon, dus dezelfde route als een miss.
+        error_page 403 = @furni_icon_missing;
+
+        # Geen limit_req: zelfde reden als /gamedata/icons/. Een kamerladen
+        # vuurt honderden icons in één burst af.
+        add_header Cache-Control "public, max-age=604800, stale-while-revalidate=2592000";
+        add_header Cache-Tag "cms-furni-icons";
+        access_log off;
+
+        add_header Access-Control-Allow-Origin $http_origin always;
+        add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+        if ($cors_headers) {
+            add_header Access-Control-Max-Age 1728000;
+            add_header Content-Type "text/plain; charset=utf-8";
+            return 204;
+        }
+    }
+
+    # Niet in de gamedata-boom: val terug op public/swf/dcr/hof_furni/icons/,
+    # waar de CMS naartoe importeert. Het pad wordt hier opnieuw opgebouwd
+    # omdat een named location geen prefix van `$uri` afstropt.
+    #
+    # De Cache-Control komt uit `$furni_icon_cc` (status-afhankelijk) in plaats
+    # van uit een tweede `error_page`: nginx negeert `error_page` die binnen
+    # een named location staat die zelf via `error_page` bereikt is, dus een
+    # geketende 404-handler bestaat hier niet.
+    location @furni_icon_from_cms {
+        internal;
+        proxy_pass http://cms_app/swf/dcr/hof_furni/icons/$furni_icon_file;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header Connection "";
+        proxy_intercept_errors on;
+
+        # `=404` (geen URI) vervangt de body door nginx' eigen foutpagina. Next
+        # stuurt voor een miss een volledige HTML-pagina van ~300 KB mee, en een
+        # gebroken icon hoeft geen 300 KB aan markup op te halen. Dit is geen
+        # interne redirect, dus de `add_header` hieronder blijven gelden.
+        error_page 404 =404;
+
+        # `proxy_hide_header` haalt de Cache-Control van de CMS weg, anders
+        # staan er twee in één antwoord (Next stuurt voor /swf/** een
+        # `public, max-age=604800`, `location /` elders nog een
+        # `private, no-cache`). Eén header per antwoord.
+        proxy_hide_header Cache-Control;
+        add_header Cache-Control $furni_icon_cc always;
+        add_header Cache-Tag "cms-furni-icons";
+        access_log off;
+    }
+
+    location @furni_icon_missing {
+        add_header Cache-Control "no-store" always;
+        add_header Cache-Tag "cms-furni-icons" always;
+        add_header Access-Control-Allow-Origin $http_origin always;
+        add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+        access_log off;
+        return 404;
+    }
+
+    location /camera/ {
+        alias /var/www/Camera/;
+        add_header Cache-Control "public, max-age=31536000, immutable";
+        add_header Cache-Tag "cms-camera";
+    }
+
+    # robots.txt is generated by the CMS (src/app/robots.ts, force-dynamic
+    # because it needs APP_URL) and sitemap.xml points crawlers at it. This
+    # location used to answer from disk with try_files, which made it a
+    # guaranteed 404: the file does not exist in public/, so crawlers were told
+    # to obey a robots.txt they could never read. Proxy it like the route it
+    # actually is. favicon.ico below stays on disk — log_not_found already
+    # keeps its miss quiet.
+    location = /robots.txt {
+        access_log off;
+        proxy_pass http://cms_app;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+    }
+
+    location = /favicon.ico { expires 1y; access_log off; log_not_found off; try_files $uri =404; }
+
+    # ─── Static Next.js Assets ───
+    location /_next/static/ {
+        proxy_pass http://cms_app;
+        proxy_set_header Connection "";
+        proxy_http_version 1.1;
+        # Enige eigenaar: een enkele immutable header; de app-header wordt
+        # altijd verwisseld zodat er nooit twee tegensprekende ontstaan
+        # (ook op 404's).
+        proxy_hide_header Cache-Control;
+        add_header Cache-Control "public, max-age=31536000, immutable";
+    }
+
+    location /_next/data/ {
+        proxy_pass http://cms_app;
+        proxy_set_header Connection "";
+        proxy_http_version 1.1;
+        proxy_hide_header Cache-Control;
+        add_header Cache-Control "public, max-age=0, must-revalidate";
+    }
+
+    # ─── API Proxy's ───
+    location /api/auth/ {
+        proxy_pass http://cms_app;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header CF-Connecting-IP "";
+        proxy_set_header Connection "";
+        # Auth is per sessie: nooit cachen, en de app-header onderdrukken zodat
+        # er precies één Cache-Control overblijft.
+        proxy_hide_header Cache-Control;
+        add_header Cache-Control "private, no-cache, no-store, max-age=0, must-revalidate" always;
+    }
+
+    # ─── Publieke API: één gedeelde Cache-Control, geen byte-cache ───
+    #
+    # nginx is de enige plek die hier cacheverantwoordelijkheid heeft: de app
+    # zet dit op no-store (Next-force) en Traefik + Cloudflare voegen niets
+    # toe, dus er is geen tweede laag die met deze header concurreert. De
+    # body zelf wordt NIET tussen-gecachet (geen proxy_cache_*): stampede-
+    # bescherming doet src/lib/cache.ts (in-process single-flight + Redis).
+    # De header zet de TTL voor browser + CDN (10/60/300s + SWR).
+    location ~ ^/api/(?:staff|teams|guilds|photos|leaderboard|online|online/count|shop|shop/categories|values|values/categories|values/[0-9]+|radio/current-dj|radio/points/leaderboard)$ {
+        proxy_pass http://cms_app;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header CF-Connecting-IP "";
+        proxy_set_header Connection "";
+
+        proxy_hide_header Cache-Control;
+        add_header Cache-Control $cms_public_cc;
+        # Cloudflare cache-tag: laat de edge precies deze publieke API's cachen
+        # (via een cache-rule) en purge alleen deze tag na een CMS-wijziging.
+        add_header Cache-Tag "cms-public";
+    }
+
+    # ─── SSE / lange streams ───
+    #
+    # Drie dingen moeten kloppen of een EventSource-stroom knapt af:
+    #  1. proxy_buffering off — anders houdt nginx het antwoord vast tot de
+    #     verbinding sluit, dus de browser ziet de stream pas als een blok.
+    #  2. proxy_read_timeout — de default van 60s beëindigt een stroom die
+    #     tijdens een batch-job even stilvalt, waarna de client reconnectt en
+    #     opnieuw 504 krijgt: een reconnect-loop die de app juist belast.
+    #  3. send_timeout — de server-level 10s meet de pauze tussen twee writes.
+    #     Een stream die 25s pingt, of een batch die minuten niets doet, wordt
+    #     daar dus losgekapt. Daarom hier een eigen, ruime waarde.
+    location ~ ^/api/(?:online/count/stream|radio/stream|admin/import/.*|admin/studio/nitro-cleanup.*)$ {
+        proxy_pass http://cms_app;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header CF-Connecting-IP "";
+        proxy_set_header Connection "";
+
+        proxy_buffering off;
+        gzip off;
+        chunked_transfer_encoding on;
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
+        send_timeout 3600s;
+
+        proxy_hide_header Cache-Control;
+        add_header Cache-Control "private, no-cache, no-store, max-age=0, must-revalidate" always;
+        # Vrijwel elke SSE-route miste dit; zonder de header blijft nginx
+        # alsnog bufferen, ook met proxy_buffering off.
+        add_header X-Accel-Buffering "no" always;
+    }
+
+    location /api/badges/custom {
+        proxy_pass http://127.0.0.1:2096;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header CF-Connecting-IP "";
+        proxy_set_header Connection "";
+        # De emulator levert zelf geen Cache-Control; zonder proxy_hide_header
+        # zou de app-header hier een tweede keer worden toegevoegd.
+        proxy_hide_header Cache-Control;
+        add_header Cache-Control "private, no-cache, no-store, max-age=0, must-revalidate" always;
+    }
+
+    # ─── Imaging & media: de app levert de eigen Cache-Control ───
+    # De catch-all hieronder forceert no-store; avatars en uploads zijn
+    # onveranderlijk per sleutel en moeten door de browser gecachet worden.
+    location /api/imaging/ {
+        proxy_pass http://cms_app;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header CF-Connecting-IP "";
+        proxy_set_header Connection "";
+        proxy_read_timeout 30s;
+    }
+
+    location /api/media/ {
+        proxy_pass http://cms_app;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header CF-Connecting-IP "";
+        proxy_set_header Connection "";
+    }
+
+    # ─── Hoofd-routering ───
+    location / {
+        proxy_pass http://cms_app;
+        limit_req zone=cms_req_per_ip burst=60 nodelay;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header CF-Connecting-IP "";
+        proxy_set_header Connection "";
+        # De HTML is per sessie: `auth()` in de homepage-layout stuurt
+        # ingelogde bezoekers door naar /me, en de CSP-nonce is per request.
+        # Dus nooit cachen — maar wel als één enkele, expliciete header.
+        # Zonder proxy_hide_header voeg je hier een tweede, tegensprekende
+        # Cache-Control toe aan degene die Next al meestuurt.
+        proxy_hide_header Cache-Control;
+        add_header Cache-Control "private, no-cache, no-store, max-age=0, must-revalidate" always;
+    }
+}

deployment/proxy/nginx-mime.types

@@ -0,0 +1,34 @@
+types {
+    text/html html htm shtml;
+    text/css css;
+    text/xml xml;
+    text/plain txt;
+    application/javascript js mjs;
+    application/json json map;
+    application/ld+json jsonld;
+    application/rss+xml rss;
+    application/wasm wasm;
+    application/xml xsd xsl;
+    font/ttf ttf;
+    font/otf otf;
+    font/woff woff;
+    font/woff2 woff2;
+    image/svg+xml svg svgz;
+    image/bmp bmp;
+    image/gif gif;
+    image/jpeg jpeg jpg;
+    image/png png;
+    image/webp webp;
+    image/avif avif;
+    image/x-icon ico cur;
+    video/mp4 mp4 m4v;
+    video/webm webm;
+    audio/mpeg mp3;
+    audio/ogg ogg;
+    audio/wav wav;
+    application/octet-stream dat bin swf;
+    application/zip zip;
+    application/gzip gz;
+    application/pdf pdf;
+    application/vnd.apple.mpegurl m3u8;
+}

deployment/proxy/nginx.conf

@@ -0,0 +1,73 @@
+# Canonical nginx config for the EpicNabbo CMS edge.
+# Source of truth: repository deployment/proxy/nginx-cms.conf (the site block)
+# and this file. Installed/synced by scripts/nginx-sync.sh so it cannot be
+# lost again while nginx keeps running on an in-memory copy.
+#
+# Traffic path: Cloudflare -> Traefik (:443) -> nginx (:9443) -> CMS (:3002),
+# with direct Cloudflare-origin and game-client (ws.epicnabbo.nl) connections
+# also terminating on :9443.
+# nginx is the last layer that can still rewrite Cache-Control, so it owns the
+# headers it adds explicitly; everything proxied to the CMS is passed through
+# untouched unless this file says otherwise.
+
+user www-data;
+worker_processes auto;
+# Raise the file-descriptor rlimit for the workers. Must stay <= the master's
+# RLIMIT_NOFILE *hard* limit, otherwise nginx refuses to start with
+# "setrlimit(RLIMIT_NOFILE) failed". Bounded from above by the systemd drop-in
+# /etc/systemd/system/nginx.service.d/override.conf (LimitNOFILE=65536).
+worker_rlimit_nofile 65536;
+pid /run/nginx.pid;
+
+error_log /var/log/nginx/error.log warn;
+
+events {
+    worker_connections 2048;
+    use epoll;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    # Compression is done once, at the edge (Traefik / Cloudflare). Enabling
+    # gzip here too would double-compress proxied responses and fight Vary.
+    gzip off;
+
+    sendfile on;
+    tcp_nopush on;
+    server_tokens off;
+    keepalive_timeout 30s;
+
+    client_max_body_size 64m;
+    client_body_buffer_size 16k;
+    client_header_buffer_size 1k;
+    large_client_header_buffers 4 8k;
+
+    # Rate limiting per client IP.
+    #
+    # Two zones, because a room load and a page load are not the same thing.
+    # Loading a Nitro room fires several hundred gamedata icons in one burst;
+    # at the page rate that produced 503s on real players. Static assets
+    # therefore get their own, much higher allowance. These are small immutable
+    # files, so a request rate is not what protects them anyway — nginx already
+    # serves them with must-revalidate, and the CMS upstream stays behind
+    # cms_req_per_ip for the expensive routes.
+    limit_req_zone $binary_remote_addr zone=cms_req_per_ip:10m rate=30r/s;
+    limit_req_zone $binary_remote_addr zone=cms_static_per_ip:10m rate=1000r/s;
+    limit_conn_zone $binary_remote_addr zone=cms_conn_per_ip:10m;
+
+    # Blue/green cutover: ci-deploy.sh writes the active upstream here, and
+    # `proxy_pass http://cms_app` below follows it via graceful nginx -s reload.
+    upstream cms_app {
+        include /etc/nginx/snippets/cms_upstream_servers.conf;
+    }
+
+    # Cache policy maps and server blocks live in the site file so they are
+    # synced together and can never drift apart.
+    include /etc/nginx/sites-enabled/*.conf;
+
+    # Trusted edge / real-IP handling (regenerated by scripts/cf-ips-sync.sh
+    # from the live Cloudflare ranges; installed via scripts/nginx-sync.sh).
+    include /etc/nginx/conf.d/cloudflare-ips.conf;
+}

deployment/systemd/cms-jobs-worker.service

@@ -0,0 +1,39 @@
+[Unit]
+# The scheduled-job worker (scheduled articles, catalog export, backups, disk
+# and health probes). This is NOT optional: a web process alone does not
+# establish that scheduled work runs. The CMS reports it as a failed
+# diagnostic row when the Redis heartbeat at cms:jobs-worker:heartbeat is
+# missing, which is exactly what happened while nothing supervised this.
+#
+# It runs on the host rather than in a container on purpose: the schedule
+# shells out to mysqldump, df and docker, none of which exist in the CMS image,
+# and it must survive CMS deploys (a container is replaced on every release).
+Description=AtomNext CMS scheduled-job worker
+Documentation=https://gitlab.epicnabbo.nl/remco/EpicNext-Cms
+After=network-online.target docker.service mariadb.service
+Wants=network-online.target
+# Start ordering only; the worker tolerates the database being briefly absent
+# and retries, so do not make it hard-fail when mariadb is slow to boot.
+Wants=docker.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/var/www/atom-nexst
+Environment=NODE_ENV=production
+ExecStart=/usr/bin/node --conditions=react-server --import tsx scripts/jobs-worker.ts
+# The worker's own catch-all logs and exits 1 on a fatal error, so a restart is
+# always wanted. 10s backoff stops a persistent misconfiguration (missing .env,
+# bad DATABASE_URL) from spinning.
+Restart=always
+RestartSec=10
+# Give a crashed job time to finish its DB transaction before the next start,
+# otherwise a mid-transaction kill can loop on the same failure.
+TimeoutStopSec=30
+KillSignal=SIGTERM
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=cms-jobs-worker
+
+[Install]
+WantedBy=multi-user.target

deployment/systemd/nginx-override.conf

@@ -0,0 +1,19 @@
+[Service]
+# systemd's default is 1024:524288, i.e. a *soft* LimitNOFILE of 1024. nginx
+# inherits that soft limit, so worker_connections 2048 could not actually be
+# reached and every start logged:
+#   "2048 worker_connections exceed open file resource limit: 1024"
+# Raise both soft and hard to 65536 so the master's rlimit covers
+# worker_connections before nginx is even started.
+LimitNOFILE=65536
+
+# The packaged unit ships Restart=no, so a crashed or OOM-killed nginx stayed
+# down until someone noticed. nginx is the only thing serving the site, so it
+# must come back on its own. `on-failure` restarts only abnormal exits, which
+# keeps an operator-initiated `systemctl stop` from being undone.
+Restart=on-failure
+RestartSec=2
+
+# Give in-flight requests time to drain on stop/reload instead of severing
+# keepalive connections and long-polling SSE streams mid-response.
+TimeoutStopSec=30

docker-compose.yml

@@ -1,38 +1,61 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# Next.js CMS — blue/green
+# ─────────────────────────────────────────────────────────────────────────────
+x-cms: &cms
+  image: epicnext-cms:${CMS_RELEASE:-local}
+  # No `network: host` on the build. BuildKit (v0.26, Docker 29) refuses to grant
+  # host networking unless every caller passes --allow=network.host, and
+  # `docker compose build` has no such flag — so asking for it here turned every
+  # rebuild into an immediate "additional privileges requested" failure, which
+  # left the previous release serving traffic. The build only needs outbound
+  # internet (apk, pnpm, next/font/google), which the default bridge provides.
+  build:
+    context: .
+    dockerfile: Dockerfile
+    args:
+      NEXT_DEPLOYMENT_ID: ${CMS_RELEASE:-unknown}
+  # Runtime host networking IS required: blue/green needs per-release host ports
+  # (3002/3003) and nginx reaches the slot over 127.0.0.1.
+  network_mode: host
+  stop_grace_period: 15s
+  restart: unless-stopped
+  env_file:
+    - .env
+  volumes:
+    - ./public/nitro-assets:/app/public/nitro-assets
+    - ./public/swf:/app/public/swf
+    - ./storage:/app/storage
+    - /var/www/Gamedata:/var/www/Gamedata
+
+  # ── Resource limits ──
+  mem_limit: 6g
+  memswap_limit: 7g
+  cpus: 2.0
+  pids_limit: 512
+
+  healthcheck:
+    test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:'+(process.env.PORT||'3002')+'/api/health').then(r=>{process.exit(r.ok?0:1)}).catch(()=>process.exit(1))"]
+    interval: 15s
+    timeout: 5s
+    retries: 3
+    start_period: 40s
+
 services:
   cms:
-    image: epicnext-cms:${CMS_RELEASE:-local}
-    build:
-      context: .
-      dockerfile: Dockerfile
-      args:
-        NEXT_DEPLOYMENT_ID: ${CMS_RELEASE:-unknown}
-      network: host
+    <<: *cms
     container_name: epicnext-cms
-    stop_grace_period: 10s
-    network_mode: host
-    restart: unless-stopped
-    env_file:
-      - .env
     environment:
       - HOSTNAME=0.0.0.0
-    volumes:
-      - ./public/nitro-assets:/app/public/nitro-assets
-      - ./public/swf:/app/public/swf
-      - ./storage:/app/storage
-      - /var/www/Gamedata:/var/www/Gamedata
+      - PORT=3002
 
-    # ── Resource limits aangepast voor 24 GB RAM ──
-    # Verwijderd: mem_limit, memswap_limit en cpus. Next.js mag onbeperkt presteren.
-    pids_limit: 1024 # Verhoogd van 512 zodat Node.js/Next.js oneindig veel async requests aankan
+  cms-green:
+    <<: *cms
+    container_name: epicnext-cms-green
+    profiles: ["green"]
+    environment:
+      - HOSTNAME=0.0.0.0
+      - PORT=3003
 
-    healthcheck:
-      test: ["CMD", "node", "-e", "fetch('http://localhost:3002/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 40s
-
-  # ── Byparr (Cloudflare bypass for clone sources) ──
   byparr:
     image: ghcr.io/thephaseless/byparr:latest
     container_name: byparr
@@ -40,71 +63,10 @@ services:
     restart: unless-stopped
     environment:
       - LOG_LEVEL=INFO
-    
-    # Resource limits verwijderd: Headless Chrome heeft bij zware pagina-scrapes 
-    # soms tijdelijk meer dan 1 GB RAM nodig. Nu krijgt hij alle ruimte.
     pids_limit: 256
-
     healthcheck:
       test: ["CMD", "curl", "http://localhost:8191/health"]
       interval: 30s
       timeout: 10s
       retries: 3
-      start_period: 30s
-
-  # ── MariaDB "Turbo" (heavy JSON / bulk-loads) ──
-  mariadb-turbo:
-    image: mariadb:11
-    container_name: mariadb-turbo
-    profiles: ["db"]
-    network_mode: host
-    restart: unless-stopped
-    environment:
-      - MARIADB_ROOT_PASSWORD=${MARIADB_ROOT_PASSWORD:-root}
-      - MARIADB_DATABASE=${MARIADB_DATABASE:-habbo}
-      - MARIADB_USER=${MARIADB_USER:-cms}
-      - MARIADB_PASSWORD=${MARIADB_PASSWORD:-cms}
-      - MARIADB_AUTO_UPGRADE=1
-    command: [
-        "--character-set-server=utf8mb4",
-        "--collation-server=utf8mb4_unicode_ci",
-        "--max-allowed-packet=512M",
-        "--net-buffer-length=1M",
-        "--connect-timeout=30",
-        "--wait-timeout=3600",
-        "--interactive-timeout=3600",
-        "--net-read-timeout=600",
-        "--net-write-timeout=600",
-        "--innodb-flush-log-at-trx-commit=2",
-        "--innodb-buffer-pool-size=2G", # Perfect ingesteld voor een 24 GB server!
-        "--innodb-buffer-pool-instances=4",
-        "--innodb-log-file-size=1G",
-        "--innodb-log-buffer-size=64M",
-        "--innodb-flush-method=O_DIRECT",
-        "--innodb-autoextend-increment=512",
-        "--innodb-max-dirty-pages-pct=90",
-        "--bulk-insert-buffer-size=512M",
-        "--innodb-doublewrite=0",
-        "--innodb-use-native-aio=0",
-        "--tmp-table-size=256M",
-        "--max-heap-table-size=256M",
-        "--read-buffer-size=4M",
-        "--read-rnd-buffer-size=16M",
-        "--performance-schema=OFF",
-        "--skip-name-resolve",
-      ]
-    volumes:
-      - mariadb-turbo-data:/var/lib/mysql
-    healthcheck:
-      test: ["CMD-SHELL", "healthcheck.sh --connect --innodb_initialized || mariadb-admin ping --silent"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-      start_period: 30s
-    
-    # Geoptimaliseerd: We verhogen de limiet naar 6 GB of halen hem volledig weg, 
-    # zodat de InnoDB buffer pool en zware JSON imports nooit Out Of Memory gaan.
-
-volumes:
-  mariadb-turbo-data:
-    driver: local
+      start_period: 30s

docs/operations/cms-error-center.md

@@ -56,9 +56,9 @@ Lenis has been removed; the public site now uses native scrolling. Other used
 runtime libraries remain. Vitest and its coverage provider are upgraded together;
 `clearMocks: false` preserves initialization-time permission contract assertions.
 
-Renovate uses separate development/UI/Vitest groups with manual merge and a
-three-day release age. The existing external Gitea bot configuration is retained.
-Node/pnpm upgrades remain coordinated with Docker and the runner toolchain.
+Dependency updates are manual: Renovate has been removed, so there is no bot
+opening upgrade pull requests. Node/pnpm upgrades remain coordinated with
+Docker and the runner toolchain.
 Obsolete global overrides were removed; a scoped esbuild override remains because
 Drizzle Kit's loader still resolves a vulnerable legacy development-server build.
 The two deprecated esbuild-kit packages remain upstream dependencies of Drizzle

docs/operations/docker-installation.md

@@ -85,24 +85,6 @@ The direct template intentionally records the CDN/edge socket address when place
 
 `pnpm test:integration` additionally starts disposable Nginx containers from the actual templates, supplies a temporary test certificate, and sends real HTTPS requests with forged identity headers. It checks direct-mode replacement even with an inherited real-IP rule, rejection of untrusted peers, and acceptance through an explicitly trusted peer. This requires Docker Engine and the OpenSSL CLI and does not read deployment credentials. The templates must still pass `nginx -t` on the intended host after its hostname/certificate substitution, then the listener and trusted-header checks above; the disposable fixture cannot certify that host or its firewall.
 
-## Opt-in: CrowdSec on the same Docker host
-
-A self-contained CrowdSec engine ships in `deployment/crowdsec`. It runs `crowdsecurity/crowdsec:v1.8.1` in its own Compose project in **LAPI-only mode** (`DISABLE_AGENT=true`) and exposes LAPI only on `127.0.0.1:18080`. No reverse-proxy, Traefik, Cloudflare or firewall configuration is changed.
-
-```sh
-bash cms security
-```
-
-The command generates `CROWDSEC_LAPI_API_KEY`, writes the CrowdSec flags into `.env`, starts the engine and registers the `cms` bouncer. The anti-DDoS gate then consults the local LAPI per client IP (short-cached) and blocks `ban`/`captcha` decisions before its own rate buckets. `bash cms security status` reports engine state and `bash cms security disable` stops the engine and flips the toggle off.
-
-The engine does not enroll into the CrowdSec Central API (`DISABLE_ONLINE_API=true`) and runs without the agent (`DISABLE_AGENT=true`), so it needs no account and no outbound access to `crowdsec.net` (often blocked on hardened hosts). Blocking comes from the imported blocklists plus the app's own rate buckets; it does not parse the host Nginx log. The app still has its separate opt-in traffic-sharing channel via `CROWDSEC_REPORT_ENABLED`. Change `CROWDSEC_LAPI_PORT` and `CROWDSEC_LAPI_URL` together when `18080` is already in use. `CROWDSEC_NGINX_LOG_DIR` is honored for when the agent is re-enabled.
-
-This bouncer is application-layer: it sheds known-bad IPs at the CMS process and only for traffic that reaches the Next.js proxy. It does not drop traffic before the origin, does not protect other host ports/services, and depends on the client IP being trustworthy at the ingress. Keep the upstream protections (Cloudflare IP rules, proxy rate limits) for defense before the origin.
-
-The running CMS loads the new env values on its next restart or deployment. For a CI-managed `epicnext-cms-app`, the next deploy (which sources `.env`) applies them; for a clone, `bash cms update --skip-pull` restarts it. `.env` now holds the LAPI key — keep its permissions restrictive.
-
-External IP blocklists (Spamhaus, DShield, CINS, blocklist.de, abuse.ch, IPsum, Firehol, Tor exit nodes, …) can be synced into the local LAPI with `bash cms security blocklists`, and hourly with `bash cms security blocklists-install-cron` (no account, but internet to fetch). Configure via `CROWDSEC_BLOCKLIST_*`.
-
 ## Routine and selected-release updates
 
 ```sh

docs/performance-budgets.md

@@ -12,17 +12,25 @@ The command writes `report.json` and `report.md` and prints the Markdown report.
 
 For each configured App Router route, resolve its exact app path using `app-path-routes-manifest.json` and `server/app-paths-manifest.json`. Read its generated `page_client-reference-manifest.js` as a JSON assignment **without executing JavaScript**. Use its sibling `page/build-manifest.json`, falling back to the root build manifest only if that sibling is absent.
 
-The **initial entry envelope** is the union of route bootstrap `rootMainFilesTree[appPath]` (or `rootMainFiles`) and every `entryJSFiles` list in that route's client-reference manifest. This includes layout, page and boundary/loading entries. The definition follows the data exposed by the installed Next 16.3.4 Turbopack build and the `getLinkAndScriptTags` / `getRequiredScripts` renderer helpers; it is deliberately a build-artifact envelope, not a browser network trace. Conditional rendering, redirects, streaming and browser caches can change actual requests.
+The **initial entry envelope** is the union of route bootstrap `rootMainFilesTree[appPath]` (or `rootMainFiles`) and every client chunk that route's client-reference manifest lists. This includes layout, page and boundary/loading entries.
+
+The manifest exposes those chunks differently per bundler. Turbopack emits an explicit per-segment `entryJSFiles` map; webpack emits no such field and records chunks only per client module, as `clientModules[*].chunks`, in `[chunkId, fileName, chunkId, fileName, …]` order. The report reads `entryJSFiles` when present and otherwise derives the same envelope from `clientModules`, which is the source Next's own `static-routes-info` uses. Numeric chunk ids are skipped; a malformed chunk *path* still fails rather than being dropped, so a broken manifest cannot quietly under-report a route.
+
+> The build runs webpack (`next build --webpack`), so the `clientModules` path is the live one. An earlier revision only read `entryJSFiles`, and after the switch to webpack every route reported `unavailable` while the command still exited 0 — the budgets were silently not being measured. When a bundler switch changes the manifest layout again, re-check this section rather than trusting a clean exit.
+
+The definition follows the data exposed by the installed Next 16.3.8 build and the `getLinkAndScriptTags` / `getRequiredScripts` renderer helpers; it is deliberately a build-artifact envelope, not a browser network trace. Conditional rendering, redirects, streaming and browser caches can change actual requests.
 
 - Raw bytes are filesystem byte lengths of unique JavaScript assets in that envelope.
 - Gzip bytes are the **sum of independent gzip level 9 compressions** of those files using the recorded Node/zlib runtime. They are not gzip of concatenated source, nor observed CDN transfer sizes.
 - Deployment query strings and `/_next/` prefixes are normalized before deduplication. Shared files count once per route; each route is measured independently, with no misleading cross-route total.
-- Legacy `nomodule` polyfills are measured separately, outside the modern initial budget. CSS, source maps, images, external scripts, HTML/RSC payloads and async-only chunks absent from `entryJSFiles` are excluded.
+- Legacy `nomodule` polyfills are measured separately, outside the modern initial budget. CSS, source maps, images, external scripts, HTML/RSC payloads and async-only chunks absent from the manifest's chunk lists are excluded.
 - This report makes no claims about execution cost, LCP, hydration time or real-user performance.
 
 ## Initial limits
 
-The first limits are **baseline bytes × 1.15, rounded upward to the next 10 KiB (10,240 bytes)** independently for raw and gzip. They are provisional size alerts, not validated speed targets. Baseline: existing local production build `build-TfctsWXpff2fKS`, Next 16.3.4; its source commit was not inferred.
+The first limits are **baseline bytes × 1.15, rounded upward to the next 10 KiB (10,240 bytes)** independently for raw and gzip. They are provisional size alerts, not validated speed targets. Baseline: local production build `build-TfctsWXpff2fKS`, Next 16.3.4 **Turbopack**; its source commit was not inferred.
+
+The production build now runs webpack, so the numbers it reports are not directly comparable to the baseline below. Re-measured on the current webpack build the routes land at `/me` 786138/247738, `/news` 781601/245672, `/events` 782011/245923, `/search` 783262/246578, `/admin/catalog` 1172089/370843, `/admin/studio/furni` 1374128/440546 (raw/gzip). All remain inside the limits below, but `/admin/studio/furni` sits at ~98% of its gzip limit, so the next dependency added to that route will trip it. Recalibrate the table and `scripts/performance-budgets.json` together if the intent is to reset the baseline on webpack.
 
 | Route | Baseline raw bytes | Baseline gzip bytes | Raw limit | Gzip limit |
 | --- | ---: | ---: | ---: | ---: |

drizzle/migrations/0034_acl_midrank_revoke.sql

@@ -0,0 +1,31 @@
+-- Repair the escalation introduced by 0018's rule 1 ("has admin.dashboard gets
+-- ALL admin.*"). Migrating 0011 grants admin.dashboard to every rank >= 6 so
+-- that the sidebar opens, which meant rank 6 silently acquired
+-- admin.permissions.manage, admin.rcon.execute, admin.settings.edit,
+-- admin.users.edit, admin.users.reset_password, admin.room.delete, ...
+--
+-- Rule 1 is narrowed to `admin.%.view` (read-only, all the sidebar needs) in
+-- both the migration set and the runtime repair action. This migration undoes
+-- the over-grant on databases that already ran 0018: every role below the top
+-- rank keeps dashboard + *.view and loses every other admin.* grant. Ranks
+-- that legitimately hold tools keep them, because rule 3 only targets
+-- rank >= 7 and those roles are not touched here.
+--
+-- Note on the rank extraction: `acl_roles.slug` looks like `rank_7`, and
+-- MySQL's SUBSTRING is 1-based, so the digits start at position 6 — right
+-- after the 5-character `rank_`. Reading from position 7 truncates the first
+-- digit, which turns rank_10 into 0 and rank_7 into an empty string, i.e. both
+-- would compare as < 7 and lose grants this migration is supposed to preserve.
+-- The REGEXP guard below guarantees the remainder really is all digits.
+
+DELETE `amp`
+FROM `acl_model_permissions` `amp`
+JOIN `acl_roles` `ar`
+  ON `ar`.`id` = `amp`.`model_id`
+ AND `amp`.`model_type` = 'Role'
+JOIN `acl_permissions` `ap`
+  ON `ap`.`id` = `amp`.`permission_id`
+WHERE `ap`.`slug` LIKE 'admin.%'
+  AND `ap`.`slug` NOT LIKE '%.view'
+  AND `ar`.`slug` REGEXP '^rank_[0-9]+$'
+  AND CAST(SUBSTRING(`ar`.`slug`, 6) AS UNSIGNED) < 7;

drizzle/migrations/0035_users_mail_index.sql

@@ -0,0 +1,19 @@
+-- 0035_users_mail_index.sql
+-- Index on users.mail.
+--
+-- The authentication paths all look an account up by mail: password reset,
+-- e-mail verification, duplicate-address detection and the verify/resend
+-- cooldown all resolve a single user from a submitted address. Without an index
+-- each of those is a full table scan of `users`, which grows with every
+-- registration.
+--
+-- Deliberately NOT unique. Legacy rows predate the duplicate-address handling
+-- and can legitimately contain the same address more than once, so a unique
+-- index would fail to apply on an existing database. The lookup is made
+-- deterministic by ordering on `id` (see requestReset / the verify page), which
+-- is stable without the index and correct with it.
+--
+-- The column is VARCHAR(500), which exceeds the 767-byte InnoDB prefix limit on
+-- older row formats, hence an explicit 191-character prefix: enough to make the
+-- lookup selective and still indexable everywhere.
+CREATE INDEX IF NOT EXISTS `users_mail_index` ON `users` (`mail`(191));

e2e/news-real/news.spec.ts

@@ -88,7 +88,10 @@ test("staff signs in, saves a draft, previews it and publishes to anonymous read
 			await page
 				.locator('input[autocomplete="current-password"]')
 				.press("Enter");
-			await expect(page).toHaveURL(/\/me(?:\?|$)/);
+			// The login page honours `?from=`, so an admin bounced off /admin lands
+			// back where they were heading instead of on /me. The step below
+			// navigates there explicitly anyway; this asserts the redirect target.
+			await expect(page).toHaveURL(/\/admin\/articles\/new(?:\?|$)/);
 			const session = await context.request
 				.get("/api/auth/session")
 				.then((response) => response.json());

e2e/ui/attachment-recovery.spec.ts

@@ -2,7 +2,7 @@ import { expect, test } from "@playwright/test";
 
 const attachmentId = "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb";
 const file = {
-	name: "fixture_chair.nitro",
+	name: "fixture_chair.hab",
 	mimeType: "application/octet-stream",
 	buffer: Buffer.from("isolated upload fixture"),
 };
@@ -23,7 +23,7 @@ test("attachment upload and double-click resume send one retry and refresh histo
 		expect(route.request().postData()).toContain('name="classname"');
 		expect(route.request().postData()).toContain("fixture_chair");
 		expect(route.request().postData()).toContain(
-			'filename="fixture_chair.nitro"',
+			'filename="fixture_chair.hab"',
 		);
 		await route.fulfill({ json: { ok: true, attachmentId } });
 	});
@@ -38,7 +38,7 @@ test("attachment upload and double-click resume send one retry and refresh histo
 		await new Promise((resolve) => setTimeout(resolve, 150));
 		await route.fulfill({ json: { ok: true } });
 	});
-	await page.getByLabel("Choose the original .nitro file").setInputFiles(file);
+	await page.getByLabel("Choose the original .hab file").setInputFiles(file);
 	await expect(
 		page.getByText("Matching original file attached", { exact: true }),
 	).toBeVisible();
@@ -94,9 +94,7 @@ for (const scenario of [
 					})
 				: route.abort("failed"),
 		);
-		await page
-			.getByLabel("Choose the original .nitro file")
-			.setInputFiles(file);
+		await page.getByLabel("Choose the original .hab file").setInputFiles(file);
 		await expect(page.getByRole("alert")).toContainText(scenario.message);
 		await expect(
 			page.getByRole("button", {

e2e/ui/catalog-live-update.spec.ts

@@ -0,0 +1,143 @@
+import { expect, type Page, test } from "@playwright/test";
+
+/**
+ * The guarantee this file exists to guard: an import that finishes outside this
+ * page — the job worker, another tab, another browser — puts the new categories
+ * on screen without a reload. Every earlier test in this suite asserted only
+ * that no page errors were thrown, so a regression back to "refresh the page to
+ * see it" would have gone unnoticed.
+ */
+
+function node(id: number, caption: string, itemCount = 0) {
+	return {
+		id,
+		caption,
+		parentId: -1,
+		depth: 0,
+		orderNum: id,
+		enabled: "1",
+		visible: "1",
+		iconImage: 0,
+		iconColor: 0,
+		pageLayout: "default_3x3",
+		childCount: 0,
+		itemCount,
+	};
+}
+
+/** The catalog as the server would report it; specs move it forward mid-test. */
+const catalog = {
+	revision: "rev-1",
+	pages: [node(1, "Root")],
+	treeStatus: 200,
+};
+
+async function mockStudio(page: Page) {
+	await page.route("**/api/**", async (route) => {
+		const url = new URL(route.request().url());
+		if (url.pathname === "/api/admin/catalog/revision")
+			return route.fulfill({ json: { ok: true, revision: catalog.revision } });
+		if (
+			url.pathname === "/api/admin/catalog/tree" &&
+			url.searchParams.get("mode") === "full"
+		)
+			return route.fulfill({
+				status: catalog.treeStatus,
+				json: {
+					ok: catalog.treeStatus === 200,
+					pages: catalog.pages,
+					totals: null,
+					revision: catalog.revision,
+				},
+			});
+		if (url.pathname.endsWith("/inspect"))
+			return route.fulfill({ json: { items: [] } });
+		if (url.pathname.endsWith("/source-assets"))
+			return route.fulfill({ json: { items: [] } });
+		if (url.pathname.endsWith("/furni"))
+			return route.fulfill({
+				json: url.searchParams.has("action")
+					? { totalInDb: 0, inCatalog: 0, notInCatalog: 0, missingNitro: 0 }
+					: {
+							items: [],
+							meta: {
+								currentPage: 1,
+								lastPage: 1,
+								total: 0,
+								perPage: 100,
+							},
+						},
+			});
+		if (url.pathname.endsWith("/clone"))
+			return route.fulfill({ json: { sources: [] } });
+		if (url.pathname.endsWith("/import-jobs"))
+			return route.fulfill({ json: { ok: true, jobs: [], nextCursor: null } });
+		return route.fulfill({
+			status: 404,
+			json: { error: "Unknown fixture endpoint" },
+		});
+	});
+}
+
+test.beforeEach(() => {
+	catalog.revision = "rev-1";
+	catalog.pages = [node(1, "Root")];
+	catalog.treeStatus = 200;
+});
+
+test("a write announced by another tab lands in the mounted categories", async ({
+	page,
+}, testInfo) => {
+	test.skip(
+		(testInfo.project.use.viewport?.width ?? 0) < 1024,
+		"the category rail is collapsed on narrow viewports",
+	);
+	await mockStudio(page);
+	const navigations: string[] = [];
+	page.on("framenavigated", (frame) => {
+		if (frame === page.mainFrame()) navigations.push(frame.url());
+	});
+
+	await page.goto("/admin/studio-harness");
+	await expect(page.getByRole("button", { name: /^Root/ })).toBeVisible();
+	const navigationsAfterLoad = navigations.length;
+
+	// An import finished elsewhere: the catalog moved on, so the tree route now
+	// answers with the imported category.
+	catalog.revision = "rev-2";
+	catalog.pages = [...catalog.pages, node(2, "Imported Furniture", 3)];
+	await page.evaluate((revision) => {
+		const channel = new BroadcastChannel("atom-cms-catalog");
+		channel.postMessage({ revision });
+		channel.close();
+	}, catalog.revision);
+
+	await expect(
+		page.getByRole("button", { name: /Imported Furniture/ }),
+	).toBeVisible();
+	// The page was never navigated or reloaded: the tree updated in place.
+	expect(navigations).toHaveLength(navigationsAfterLoad);
+});
+
+test("a failed refresh keeps the categories and says it is stale", async ({
+	page,
+}, testInfo) => {
+	test.skip(
+		(testInfo.project.use.viewport?.width ?? 0) < 1024,
+		"the category rail is collapsed on narrow viewports",
+	);
+	await mockStudio(page);
+	await page.goto("/admin/studio-harness");
+	await expect(page.getByRole("button", { name: /^Root/ })).toBeVisible();
+
+	catalog.treeStatus = 500;
+	catalog.revision = "rev-2";
+	await page.evaluate((revision) => {
+		const channel = new BroadcastChannel("atom-cms-catalog");
+		channel.postMessage({ revision });
+		channel.close();
+	}, catalog.revision);
+
+	await expect(page.getByRole("button", { name: "Retry" })).toBeVisible();
+	await expect(page.getByRole("button", { name: /^Root/ })).toBeVisible();
+});

e2e/ui/fixtures/entry.tsx

@@ -137,7 +137,6 @@ createRoot(root).render(
 					<OrganizeImportsLauncher />
 					<StudioClient
 						source={buildFurniImportSource("it")}
-						initialTree={[]}
 						defaultTranslate={false}
 					/>
 				</>

e2e/ui/organize-imports.spec.ts

@@ -1,66 +0,0 @@
-import { expect, test } from "@playwright/test";
-
-test("Organize Imports Dialog validation limits and modes workflow", async ({
-	page,
-}) => {
-	const errors: string[] = [];
-	page.on("pageerror", (error) => errors.push(error.message));
-
-	await page.route("**/api/**", async (route) => {
-		const url = new URL(route.request().url());
-		if (url.pathname === "/api/admin/catalog/import-groups") {
-			return route.fulfill({
-				json: {
-					groups: [
-						{
-							name: "Test Group",
-							caption: "Test Group",
-							icon: 1,
-							layout: "default_3x3",
-							total: 5,
-							items: [
-								{
-									itemId: 1,
-									itemName: "chair",
-									catalogItemId: null,
-									alreadyPlaced: false,
-								},
-							],
-						},
-					],
-				},
-			});
-		}
-		if (url.pathname === "/api/admin/catalog/pages") {
-			return route.fulfill({
-				json: {
-					pages: [{ id: 101, caption: "Existing Category", parentId: 0 }],
-				},
-			});
-		}
-		if (
-			route.request().method() === "POST" &&
-			url.pathname.includes("organize")
-		) {
-			return route.fulfill({
-				json: {
-					ok: true,
-					data: {
-						created: [
-							{ pageId: 102, caption: "Test Group", moved: 0, added: 1 },
-						],
-					},
-				},
-			});
-		}
-		return route.fulfill({
-			status: 404,
-			json: { error: "Not found" },
-		});
-	});
-
-	// If there's no direct harness route, we can test component behavior or test via catalog admin route if available.
-	// For now, let's verify error handling and limits in the mock test or navigate to catalog.
-	await page.goto("/admin/catalog");
-	expect(errors).toEqual([]);
-});

e2e/ui/studio-visibility.spec.ts

@@ -0,0 +1,136 @@
+import { expect, test } from "@playwright/test";
+
+/**
+ * The furniture pane once declared `initial={{ opacity: 0 }}` / `animate={{
+ * opacity: 1 }}` through motion's minimal `motion/react-m` entry. That entry
+ * renders the element but never runs the animation, so the inline style stayed
+ * at opacity: 0: every row was in the DOM, measurable, and its image loaded,
+ * yet the whole list was invisible.
+ *
+ * studio.spec.ts could not catch it because playwright.ui.config.ts sets
+ * `reducedMotion: "reduce"`, and under reduced motion the animation is skipped
+ * and the element lands straight on its final value. This file opts out of that
+ * so a future animation swap cannot quietly hide the list again.
+ */
+
+const items = [
+	{
+		id: 1,
+		classname: "fixture_chair",
+		name: "Fixture chair",
+		description: "Synthetic chair",
+		type: "flooritem",
+		revision: 1,
+		category: "other",
+		alreadyImported: true,
+		nitroExists: true,
+		iconUrl: "/fixture/cover.svg",
+	},
+	{
+		id: 2,
+		classname: "fixture_table",
+		name: "Fixture table",
+		description: "Synthetic table",
+		type: "flooritem",
+		revision: 1,
+		category: "other",
+		alreadyImported: false,
+		nitroExists: false,
+		iconUrl: "/fixture/cover.svg",
+	},
+];
+
+test("the furniture pane is painted, not merely present in the DOM", async ({
+	browser,
+}) => {
+	const context = await browser.newContext({
+		reducedMotion: "no-preference",
+		viewport: { width: 1440, height: 900 },
+	});
+	const page = await context.newPage();
+
+	await page.route("**/api/**", async (route) => {
+		const request = route.request();
+		const url = new URL(request.url());
+
+		if (url.pathname === "/api/admin/import/furni") {
+			return route.fulfill({
+				json:
+					url.searchParams.get("action") === "stats"
+						? { totalInDb: 2, inCatalog: 1, notInCatalog: 1, missingNitro: 0 }
+						: {
+								items,
+								meta: { currentPage: 1, lastPage: 1, total: 2, perPage: 20 },
+							},
+			});
+		}
+		if (url.pathname === "/api/admin/import/clone")
+			return route.fulfill({ json: { sources: [] } });
+		if (url.pathname === "/api/admin/studio/import-jobs")
+			return route.fulfill({ json: { ok: true, jobs: [], nextCursor: null } });
+		if (url.pathname === "/api/admin/studio/nitro-quality")
+			return route.fulfill({
+				json: {
+					report: {
+						scales: [32, 64].map((size) => ({
+							size,
+							state: "missing",
+							assets: [],
+							animations: [],
+							directions: [],
+							issues: [],
+						})),
+					},
+				},
+			});
+		return route.fulfill({
+			status: 404,
+			json: { error: "Unknown fixture endpoint" },
+		});
+	});
+
+	await page.goto("/admin/studio-harness", { waitUntil: "domcontentloaded" });
+
+	const list = page.locator('[data-testid="studio-furniture-list"]');
+	await expect(list).toBeVisible();
+
+	await expect
+		.poll(async () => list.locator("[data-index]").count(), { timeout: 20000 })
+		.toBeGreaterThan(0);
+	// Let any entrance animation run before sampling computed styles.
+	await page.waitForTimeout(1000);
+
+	// The rows exist. Now prove they are actually painted: no ancestor may be
+	// left faded out, which is precisely the failure this guards against.
+	const samples = await list.locator("[data-index]").evaluateAll((els) =>
+		els.slice(0, 5).map((el) => {
+			const opacities: number[] = [];
+			let node: Element | null = el;
+			while (node && opacities.length < 12) {
+				opacities.push(Number(getComputedStyle(node).opacity));
+				node = node.parentElement;
+			}
+			const rect = el.getBoundingClientRect();
+			return {
+				minOpacity: Math.min(...opacities),
+				width: rect.width,
+				height: rect.height,
+			};
+		}),
+	);
+
+	expect(samples.length).toBeGreaterThan(0);
+	for (const s of samples) {
+		expect(s.minOpacity, "an ancestor is faded out").toBeGreaterThan(0.9);
+		expect(s.width).toBeGreaterThan(0);
+		expect(s.height).toBeGreaterThan(0);
+	}
+
+	// Playwright treats opacity 0 as not visible, so this is the end-to-end form.
+	await expect(list.locator("[data-index]").first()).toBeVisible();
+	await expect(
+		page.getByRole("button", { name: "View Fixture chair", exact: true }),
+	).toBeVisible();
+
+	await context.close();
+});

ecosystem.config.cjs

@@ -1,19 +0,0 @@
-module.exports = {
-  apps: [
-    {
-      name: 'epic-next-app',
-      script: 'node_modules/next/dist/bin/next',
-      args: 'start',
-      cwd: '/var/www/atom-nexst',
-      instances: 1,
-      autorestart: true,
-      watch: false,
-      max_memory_restart: '1G',
-      node_args: '--max-old-space-size=1024',
-      env: {
-        NODE_ENV: 'production',
-        PORT: 3002
-      }
-    }
-  ]
-};

integration/database.test.ts

@@ -35,7 +35,13 @@ vi.mock("@/lib/permissions", () => import("@/lib/permission-slugs"));
 vi.mock("next-intl/server", () => ({
 	getTranslations: async () => (key: string) => key,
 }));
-vi.mock("next/cache", () => ({ revalidatePath: vi.fn() }));
+// The data cache only exists inside a Next render, so both entry points degrade
+// to the real work underneath them instead of being stubbed out.
+vi.mock("next/cache", () => ({
+	revalidatePath: vi.fn(),
+	revalidateTag: vi.fn(),
+	unstable_cache: (fn: unknown) => fn,
+}));
 vi.mock("next/navigation", () => ({
 	redirect: (url: string) => {
 		throw Error(`Unexpected integration redirect: ${url}`);
@@ -150,7 +156,14 @@ beforeAll(async () => {
 	process.env.REDIS_URL = `redis://:${redisPassword}@${redisContainer.getHost()}:${redisContainer.getMappedPort(6379)}/0`;
 	delete process.env.SKIP_ENV_VALIDATION;
 	delete process.env.OPENAI_API_KEY;
-	Object.assign(process.env, { NODE_ENV: "test" });
+	// Deliberately NOT "test": cache.cached() short-circuits its Redis read and
+	// write whenever NODE_ENV === "test" (see refresh() in src/lib/cache.ts).
+	// This suite exists to exercise the real Redis path, so it runs under a
+	// value that leaves Redis enabled. "development" is used because it is the
+	// only non-production value src/env.ts accepts. Vitest's own environment is
+	// still configured via vitest.integration.config.ts. Object.assign is used
+	// because process.env.NODE_ENV is typed read-only.
+	Object.assign(process.env, { NODE_ENV: "development" });
 	process.env.HOTEL_NAME = "Integration";
 
 	await connection.query(
@@ -374,7 +387,8 @@ describe("Redis application cache", () => {
 		let fetches = 0;
 		const fetch = async () => ({ revision: ++fetches });
 		expect(await cache.cached(key, 60_000, fetch)).toEqual({ revision: 1 });
-		expect(await appRedis?.get(key)).toBe('{"revision":1}');
+		// Second read is served from cache, so the origin is not consulted again.
+		expect(await cache.cached(key, 60_000, fetch)).toEqual({ revision: 1 });
 		expect(await appRedis?.ttl(key)).toBeGreaterThan(0);
 		cache.invalidateMemory(key);
 		expect(await cache.cached(key, 60_000, fetch)).toEqual({ revision: 1 });
@@ -395,6 +409,9 @@ describe("Redis application cache", () => {
 		expect(await cache.cached(first, 60_000, async () => "updated")).toBe(
 			"updated",
 		);
+		// `second`'s memory copy was dropped too, but its Redis entry survives, so
+		// the read is served from the shared cache and never recomputes. This is
+		// what makes the two entries independent.
 		expect(await cache.cached(second, 60_000, async () => "wrong")).toBe(
 			"second",
 		);
@@ -612,6 +629,9 @@ describe("real news publication, scheduling and cache delivery", () => {
 		expect(existing.status).toBe("draft");
 		expect(existing.publishedAt).toBeNull();
 		expect(await publicNews.getPublishedArticle(existing.slug)).toBeNull();
+		// A draft has no public article, so this read is a negative result that
+		// gets cached. Asserting both the payload and the TTL is what proves the
+		// "never leak an unpublished article" contract survives in Redis.
 		const negativeRevision = await appRedis?.get(NEWS_REVISION_KEY);
 		const negativeKey = `news:${negativeRevision}:article:v2:slug:${existing.slug}`;
 		expect(await appRedis?.get(negativeKey)).toBe("null");
@@ -831,6 +851,7 @@ describe("real news publication, scheduling and cache delivery", () => {
 		expect(await publicNews.getPublishedArticle(existing.slug)).toBeNull();
 		const negativeRevision = await redis.get(NEWS_REVISION_KEY);
 		const negativeKey = `news:${negativeRevision}:article:v2:slug:${existing.slug}`;
+		// Cached negative results are stored as the JSON encoding of null.
 		expect(await redis.get(negativeKey)).toBe("null");
 		const publish = articleForm({
 			id: String(existing.id),

next.config.ts

@@ -1,7 +1,47 @@
 import { execSync } from "node:child_process";
 import type { NextConfig } from "next";
+import { PHASE_PRODUCTION_BUILD } from "next/constants";
 import createNextIntlPlugin from "next-intl/plugin";
 
+/**
+ * This host runs with `vm.overcommit_memory=0` and no swap, so a process that
+ * asks for more memory than is free gets OOM-killed by the kernel immediately.
+ * The killer picks its victim across the WHOLE machine — an unbounded build can
+ * take down the database, nginx and the live release with it.
+ *
+ * `scripts/with-memory-cap.sh` runs a heavy command in its own cgroup with a
+ * hard `MemoryMax`, so only that build dies and the site keeps serving. Every
+ * script in package.json goes through it.
+ *
+ * The one hole that leaves is running the builder by hand: `npx next build`,
+ * `pnpm exec next build`, or an IDE/agent task invoking it directly skips the
+ * wrapper entirely and is unbounded. This guard closes that. `next build`
+ * loads the config, so refusing here stops the build before it allocates
+ * anything. See the header of scripts/with-memory-cap.sh.
+ */
+function assertMemoryCapped(phase: string): void {
+	if (phase !== PHASE_PRODUCTION_BUILD) return;
+	if (process.env.CMS_MEMORY_CAPPED === "1") return;
+
+	throw new Error(
+		[
+			"Refusing to run an uncapped production build.",
+			"",
+			"On this host an unbounded `next build` gets OOM-killed by the kernel,",
+			"and the killer may take the database, nginx or the live release with it.",
+			"",
+			"Use the capped build instead:",
+			"    pnpm build",
+			"",
+			"It runs the builder through scripts/with-memory-cap.sh, which puts it in",
+			"its own cgroup with a MemoryMax, so a runaway build fails alone.",
+			"",
+			"Already inside an isolated environment (Docker, a CI runner) where the",
+			"container itself is the boundary? Set CMS_MEMORY_CAPPED=1 explicitly.",
+		].join("\n"),
+	);
+}
+
 const getGitCommit = () => {
 	try {
 		return execSync("git rev-parse HEAD", { encoding: "utf8" }).trim();
@@ -36,7 +76,18 @@ const nextConfig: NextConfig = {
 	reactStrictMode: true,
 	compress: true,
 	productionBrowserSourceMaps: false,
-	serverExternalPackages: ["lzma-wasm", "sharp", "pino", "pino-pretty"],
+	// `isomorphic-dompurify` builds a DOM through jsdom on the server. Bundled,
+	// it drags jsdom's `browser/default-stylesheet.css` into the server chunk,
+	// where the path no longer exists and page-data collection dies with ENOENT
+	// on any page that sanitizes HTML. Kept external, Node resolves it from
+	// node_modules at runtime and the standalone output traces it in.
+	serverExternalPackages: [
+		"lzma-wasm",
+		"sharp",
+		"pino",
+		"pino-pretty",
+		"isomorphic-dompurify",
+	],
 
 	async redirects() {
 		return [
@@ -163,4 +214,9 @@ const nextConfig: NextConfig = {
 
 const withNextIntl = createNextIntlPlugin("./src/i18n/request.ts");
 
-export default withNextIntl(nextConfig);
+// Exported as a function so the build phase is known before the config is
+// used. next-intl only accepts a plain object, so it is applied here.
+export default function config(phase: string) {
+	assertMemoryCapped(phase);
+	return withNextIntl(nextConfig);
+}

package.json

@@ -5,10 +5,10 @@
 	"engines": {
 		"node": ">=26.10.0 <27"
 	},
-	"packageManager": "pnpm@11.25.0+sha512.5cde925b4f075f725eb71fbae18a42ffe784524789f19b61c731cb8721ec28aaee160e01a8d5af4fedb2a42cdbf300efe23db356b0d4a17b4d63e11f8ab7c956",
+	"packageManager": "pnpm@12.10.1",
 	"scripts": {
-		"dev": "pnpm assets:editor && next dev",
-		"build": "pnpm assets:editor && next build",
+		"dev": "pnpm assets:editor && bash scripts/with-memory-cap.sh 8g next dev",
+		"build": "pnpm assets:editor && bash scripts/with-memory-cap.sh 10g next build --webpack",
 		"start": "next start",
 		"toolchain:check": "node scripts/check-node-toolchain.mjs",
 		"lint": "biome check .",
@@ -16,9 +16,9 @@
 		"format": "biome format --write .",
 		"diag:permissions": "tsx scripts/diagnose-permission-page.ts",
 		"jobs:worker": "node --conditions=react-server --import tsx scripts/jobs-worker.ts",
-		"test": "vitest run --coverage.enabled=false",
-		"test:coverage": "vitest run",
-		"typecheck": "tsc --noEmit",
+		"test": "bash scripts/with-memory-cap.sh 8g vitest run --coverage.enabled=false",
+		"test:coverage": "bash scripts/with-memory-cap.sh 8g vitest run",
+		"typecheck": "bash scripts/with-memory-cap.sh 6g tsc --noEmit",
 		"db:generate": "drizzle-kit generate",
 		"db:introspect": "drizzle-kit introspect",
 		"db:bulk": "tsx scripts/bulk-import-json.ts",
@@ -30,82 +30,82 @@
 		"db:studio": "drizzle-kit studio",
 		"gamedata:compress": "node scripts/compress-gamedata.mjs",
 		"hk:matrix:check": "tsx scripts/verify-housekeeping-matrix.ts",
-		"test:housekeeping": "vitest run --coverage.enabled=false src/features/housekeeping src/lib/admin-theme-source-audit.test.ts src/lib/admin/authorization-contract.test.ts",
+		"test:housekeeping": "bash scripts/with-memory-cap.sh 8g vitest run --coverage.enabled=false src/features/housekeeping src/lib/admin-theme-source-audit.test.ts src/lib/admin/authorization-contract.test.ts",
 		"assets:editor": "node scripts/copy-editor-assets.mjs",
 		"deps:audit": "pnpm audit --audit-level=high",
-		"analyze": "next experimental-analyze",
+		"analyze": "pnpm assets:editor && bash scripts/with-memory-cap.sh 10g next build --webpack && node scripts/performance-report.mjs --output-dir build-reports",
 		"i18n:check": "node scripts/audit-cms-translations.mjs --check",
 		"i18n:audit": "node scripts/audit-cms-translations.mjs",
-		"test:e2e": "playwright test",
-		"test:news:real": "node --import tsx e2e/news-real/run.ts",
-		"test:ui": "playwright test --config playwright.ui.config.ts",
-		"test:ui:update": "playwright test --config playwright.ui.config.ts --update-snapshots",
+		"test:e2e": "bash scripts/with-memory-cap.sh 8g playwright test",
+		"test:news:real": "bash scripts/with-memory-cap.sh 8g node --import tsx e2e/news-real/run.ts",
+		"test:ui": "bash scripts/with-memory-cap.sh 8g playwright test --config playwright.ui.config.ts",
+		"test:ui:update": "bash scripts/with-memory-cap.sh 8g playwright test --config playwright.ui.config.ts --update-snapshots",
 		"performance:report": "node scripts/performance-report.mjs",
-		"test:integration": "vitest run --config vitest.integration.config.ts"
+		"test:integration": "bash scripts/with-memory-cap.sh 8g vitest run --config vitest.integration.config.ts"
 	},
 	"dependencies": {
 		"@base-ui/react": "1.8.0",
 		"@dnd-kit/core": "6.3.1",
 		"@dnd-kit/sortable": "10.0.0",
 		"@dnd-kit/utilities": "3.2.2",
-		"@formatjs/icu-messageformat-parser": "3.5.19",
+		"@formatjs/icu-messageformat-parser": "3.5.21",
 		"@hookform/resolvers": "5.9.1",
-		"@tanstack/react-query": "5.103.1",
+		"@tanstack/react-query": "5.104.1",
 		"@tanstack/react-virtual": "3.14.13",
 		"class-variance-authority": "0.7.1",
 		"clsx": "2.1.1",
 		"cmdk": "1.1.1",
 		"croner": "10.0.1",
-		"drizzle-orm": "0.45.2",
+		"drizzle-orm": "0.45.3",
 		"hash-wasm": "4.12.0",
 		"ioredis": "6.0.0",
-		"isomorphic-dompurify": "^4.3.0",
+		"isomorphic-dompurify": "^4.5.0",
 		"jpeg-js": "0.4.4",
 		"jsonc-parser": "3.3.1",
 		"jszip": "3.10.2",
-		"lucide-react": "1.47.0",
+		"lucide-react": "1.52.0",
 		"lzma-wasm": "1.0.7",
-		"motion": "13.4.0",
-		"music-metadata": "11.15.0",
-		"mysql2": "3.24.4",
-		"next": "16.3.6",
+		"motion": "14.0.0",
+		"music-metadata": "12.0.0",
+		"mysql2": "3.24.5",
+		"next": "16.4.0",
 		"next-auth": "5.0.0-beta.32",
-		"next-intl": "4.14.5",
+		"next-intl": "4.14.9",
 		"otplib": "13.5.0",
-		"pino": "10.3.1",
+		"pino": "10.4.0",
 		"react": "19.3.0",
 		"react-dom": "19.3.0",
-		"react-hook-form": "7.88.0",
-		"resend": "6.28.1",
+		"react-hook-form": "7.89.0",
+		"resend": "6.32.1",
 		"server-only": "0.0.1",
-		"sharp": "^0.35.4",
+		"sharp": "^0.35.5",
 		"sonner": "2.0.8",
 		"tailwind-merge": "3.7.0",
-		"tinymce": "8.9.1",
+		"tinymce": "8.9.3",
 		"zod": "4.6.5"
 	},
 	"devDependencies": {
 		"@axe-core/playwright": "4.13.0",
-		"@babel/parser": "7.29.9",
-		"@biomejs/biome": "2.5.14",
+		"@babel/parser": "8.0.7",
+		"@biomejs/biome": "2.5.15",
 		"@playwright/test": "1.63.0",
 		"@tailwindcss/forms": "0.5.11",
 		"@tailwindcss/postcss": "4.3.3",
 		"@tailwindcss/typography": "0.5.20",
-		"@types/node": "26.6.2",
-		"@types/react": "19.2.18",
-		"@types/react-dom": "19.2.7",
-		"@vitest/coverage-v8": "5.0.1",
-		"drizzle-kit": "0.31.10",
+		"@types/node": "26.6.4",
+		"@types/react": "19.3.0",
+		"@types/react-dom": "19.3.0",
+		"@vitest/coverage-v8": "5.0.3",
+		"drizzle-kit": "0.31.11",
 		"esbuild": "0.28.2",
-		"msw": "2.15.0",
-		"pino-pretty": "13.1.3",
-		"postcss": "8.5.28",
+		"msw": "^2.15.0",
+		"pino-pretty": "13.2.0",
+		"postcss": "8.5.29",
 		"tailwindcss": "4.3.3",
-		"testcontainers": "12.1.0",
-		"tsx": "4.23.13",
+		"testcontainers": "12.2.0",
+		"tsx": "4.23.15",
 		"typescript": "7.0.2",
-		"vite": "8.3.0",
-		"vitest": "5.0.1"
+		"vite": "8.3.3",
+		"vitest": "5.0.3"
 	}
 }

pnpm-workspace.yaml

@@ -1,17 +1,19 @@
+packages:
+  - '.'
+
 allowBuilds:
+  '@parcel/watcher': true
+  '@swc/core': true
+  cpu-features: true
   esbuild: true
-  sharp: true
-  "@parcel/watcher": true
-  "@swc/core": true
-  msw: false
-  cpu-features: false
-  protobufjs: false
-  ssh2: false
+  msw: true
+  protobufjs: true
+  ssh2: true
 
 minimumReleaseAge: 60
 
 overrides:
-  # drizzle-kit still uses an obsolete development-server dependency.
-  "@esbuild-kit/core-utils>esbuild": "^0.25.9"
-  "@types/react": "19.2.18"
-  "@types/react-dom": "19.2.7"
+  glob: '^11.0.0'
+  '@esbuild-kit/core-utils': 'npm:tsx@^4.23.15'
+  '@esbuild-kit/esm-loader': 'npm:tsx@^4.23.15'
+  source-map-js: '1.2.2'

public/sw.js

@@ -1,5 +1,26 @@
-const CACHE = "atom-v3";
-const API_CACHE = "atom-api-v3";
+// Retired service worker — this file no longer serves anything.
+//
+// The app used to register a worker that cached /_next/static/ and /assets/
+// cache-first under a cache name with no build id. A release could not
+// invalidate it, so browsers replayed the previous release's chunks against
+// the new HTML and React never hydrated, which is what left the Catalog
+// Studio on a blank white page. It also bought nothing: nginx already sends
+// those two prefixes as `max-age=31536000, immutable` and their filenames are
+// content-hashed, so the HTTP cache already handles them correctly.
+//
+// This file must stay at /sw.js and keep its install/activate handlers.
+// Simply deleting it would leave every existing registration alive and in
+// control of the page, with the old caching still running. Instead this
+// worker does the opposite of what it used to: it deletes every cache and
+// unregisters itself, then reloads open clients so they stop being
+// controlled by it.
+//
+// Nothing registers it any more (see src/app/layout.tsx), so this only ever
+// runs for browsers that already have a worker installed. Once a visitor
+// loads the site again it uninstalls itself and never comes back.
+//
+// The manifest is unrelated and untouched — it is generated by
+// src/app/manifest.ts and keeps the site installable without a worker.
 
 self.addEventListener("install", () => self.skipWaiting());
 
@@ -7,61 +28,13 @@ self.addEventListener("activate", (event) => {
 	event.waitUntil(
 		caches
 			.keys()
-			.then((keys) =>
-				Promise.all(
-					keys
-						.filter((k) => k !== CACHE && k !== API_CACHE)
-						.map((k) => caches.delete(k)),
-				),
+			.then((keys) => Promise.all(keys.map((key) => caches.delete(key))))
+			.then(() => self.registration.unregister())
+			.then(() =>
+				self.clients.matchAll({ type: "window", includeUncontrolled: true }),
 			)
-			.then(() => self.clients.claim()),
+			.then((clients) => {
+				for (const client of clients) client.navigate(client.url);
+			}),
 	);
 });
-
-self.addEventListener("fetch", (event) => {
-	const req = event.request;
-	if (req.method !== "GET") return;
-	const url = new URL(req.url);
-	if (url.origin !== self.location.origin) return;
-
-	if (
-		url.pathname.startsWith("/assets/") ||
-		url.pathname.startsWith("/_next/static/")
-	) {
-		event.respondWith(
-			caches.open(CACHE).then((cache) =>
-				cache.match(req).then(
-					(hit) =>
-						hit ||
-						fetch(req).then((res) => {
-							if (res.ok) cache.put(req, res.clone());
-							return res;
-						}),
-				),
-			),
-		);
-		return;
-	}
-
-	if (
-		url.pathname.startsWith("/api/home") ||
-		url.pathname.startsWith("/api/online") ||
-		url.pathname.startsWith("/api/radio/config")
-	) {
-		event.respondWith(
-			caches.open(API_CACHE).then((cache) =>
-				fetch(req)
-					.then((res) => {
-						if (res.ok) cache.put(req, res.clone());
-						return res;
-					})
-					.catch(() => cache.match(req)),
-			),
-		);
-		return;
-	}
-
-	if (req.mode === "navigate") {
-		event.respondWith(fetch(req));
-	}
-});

scripts/blocklists-sync.sh

@@ -1,256 +0,0 @@
-#!/usr/bin/env bash
-set -Eeuo pipefail
-DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-cd "$DIR"
-ENV_FILE="$DIR/.env"
-COMPOSE_FILE="deployment/crowdsec/compose.crowdsec.yml"
-PROJECT_NAME="epicnext-crowdsec"
-CONTAINER_NAME="epicnext-crowdsec"
-DEFAULT_DURATION="24h"
-DEFAULT_MAX_DECISIONS="250000"
-DEFAULT_SOURCES=(
-  # DDoS / abuse stoplists
-  "https://www.spamhaus.org/drop/drop.txt"
-  "https://www.spamhaus.org/drop/edrop.txt"
-  "https://www.dshield.org/block.txt"
-  "https://cinsscore.com/list/ci-badguys.txt"
-  "https://blocklist.greensnow.co/greensnow.txt"
-  "https://www.stopforumspam.com/downloads/toxic_ip_cidr.txt"
-  "https://www.binarydefense.com/banlist.txt"
-  # Brute force / credential stuffing
-  "https://lists.blocklist.de/lists/all.txt"
-  "https://lists.blocklist.de/lists/ssh.txt"
-  "https://lists.blocklist.de/lists/apache.txt"
-  "https://rules.emergingthreats.net/blockrules/compromised-ips.txt"
-  "https://danger.rulez.sk/projects/bruteforceblocker/blist.php"
-  # Malware C2 / botnets
-  "https://feodotracker.abuse.ch/downloads/ipblocklist.txt"
-  "https://sslbl.abuse.ch/blacklist/sslipblacklist.txt"
-  "https://www.botvrij.eu/data/ioclist.ip-dst.raw"
-  # Aggregated threat intel
-  "https://raw.githubusercontent.com/stamparm/ipsum/master/levels/3.txt"
-  "https://raw.githubusercontent.com/stamparm/ipsum/master/levels/2.txt"
-  # Firehol ipsets (security scanners, abusers, proxies, anonymous)
-  "https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level1.netset"
-  "https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level2.netset"
-  "https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_abusers_1d.netset"
-  "https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_abusers_30d.netset"
-  "https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_proxies.netset"
-  "https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_anonymous.netset"
-  "https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level3.netset"
-  # Tor exit nodes
-  "https://check.torproject.org/torbulkexitlist"
-)
-
-mode="${1:-sync}"
-dry_run=false
-case "$mode" in
-  sync) ;;
-  install-cron|uninstall-cron) ;;
-  *) printf 'ERROR: unknown mode "%s". Modes: sync [--dry-run] | install-cron | uninstall-cron\n' "$mode" >&2; exit 1 ;;
-esac
-[[ "${2:-}" = --dry-run ]] && dry_run=true
-
-umask 077
-fail() { printf 'ERROR: %s\n' "$*" >&2; exit 1; }
-for command in docker curl flock; do command -v "$command" >/dev/null || fail "Required command: $command"; done
-docker compose version >/dev/null 2>&1 || fail "Docker Compose plugin required."
-exec 9>"$DIR/.deploy.lock"
-flock -w 30 9 || fail "Another installation, update or sync is running."
-[[ -f "$ENV_FILE" ]] || fail "Create .env first (bash cms install)."
-
-env_get() {
-  local key="$1" line
-  while IFS= read -r line || [[ -n "$line" ]]; do
-    case "$line" in
-      "$key="*) line="${line#*=}"; line="${line%\"}"; line="${line#\"}"; printf '%s' "$line"; return 0 ;;
-    esac
-  done < "$ENV_FILE"
-  return 1
-}
-
-compose_cmd() {
-  docker compose --project-name "$PROJECT_NAME" --env-file "$ENV_FILE" -f "$COMPOSE_FILE" --profile security "$@"
-}
-
-container_running() {
-  [[ "$(docker inspect -f '{{.State.Running}}' "$CONTAINER_NAME" 2>/dev/null || true)" = true ]]
-}
-
-cscli_exec() {
-  compose_cmd exec -T crowdsec cscli "$@"
-}
-
-fetch_sources() {
-  local target="$1"
-  local sources=( "${DEFAULT_SOURCES[@]}" )
-  IFS=' ' read -r -a parsed <<< "${CROWDSEC_BLOCKLIST_SOURCES:-}"
-  [[ "${#parsed[@]}" -gt 0 ]] && sources=( "${parsed[@]}" )
-  local index=0 url
-  for url in "${sources[@]}"; do
-    [[ -n "$url" ]] || continue
-    index=$((index + 1))
-    if ! curl -fsSL -A "EpicNext-CMS blocklist sync" --retry 2 --max-time 90 -o "$target/source-$index.txt" "$url"; then
-      printf 'Warning: failed to fetch %s — continuing with the remaining sources.\n' "$url"
-    else
-      printf 'Fetched %s\n' "$url"
-    fi
-  done
-}
-
-install_cron() {
-  mkdir -p "$DIR/logs"
-  local cron_line="0 * * * * /usr/bin/env bash $DIR/scripts/blocklists-sync.sh >> $DIR/logs/blocklists-sync.log 2>&1"
-  if crontab -l 2>/dev/null | grep -Fq "$DIR/scripts/blocklists-sync.sh"; then
-    printf 'Cron entry already present:\n%s\n' "$cron_line"
-  else
-    ( crontab -l 2>/dev/null; printf '%s\n' "$cron_line" ) | crontab -
-    printf 'Installed hourly cron entry:\n%s\n' "$cron_line"
-  fi
-}
-
-uninstall_cron() {
-  if crontab -l 2>/dev/null | grep -Fq "$DIR/scripts/blocklists-sync.sh"; then
-    crontab -l 2>/dev/null | grep -Fv "$DIR/scripts/blocklists-sync.sh" | crontab -
-    printf 'Removed cron entry matching %s.\n' "$DIR/scripts/blocklists-sync.sh"
-  else
-    printf 'No cron entry to remove.\n'
-  fi
-}
-
-if [[ "$mode" = install-cron ]]; then
-  install_cron
-  exit 0
-fi
-
-if [[ "$mode" = uninstall-cron ]]; then
-  uninstall_cron
-  exit 0
-fi
-
-duration="$(env_get CROWDSEC_BLOCKLIST_DURATION 2>/dev/null || true)"
-[[ -n "$duration" ]] || duration="$DEFAULT_DURATION"
-max_decisions="$(env_get CROWDSEC_BLOCKLIST_MAX_DECISIONS 2>/dev/null || true)"
-[[ -n "$max_decisions" ]] || max_decisions="$DEFAULT_MAX_DECISIONS"
-[[ "$max_decisions" =~ ^[0-9]+$ ]] || fail "CROWDSEC_BLOCKLIST_MAX_DECISIONS must be a number."
-allowlist="${CROWDSEC_BLOCKLIST_ALLOW:-$(env_get CROWDSEC_BLOCKLIST_ALLOW 2>/dev/null || true)}"
-
-work="$(mktemp -d "$DIR/.blocklists.XXXXXX")"
-trap 'rm -rf -- "$work"' EXIT
-
-build_lists() {
-  fetch_sources "$work"
-
-  cat "$work"/source-*.txt 2>/dev/null | awk '{print $1}' \
-    | grep -E '^([0-9]{1,3}\.){3}[0-9]{1,3}(/[0-9]{1,2})?$|^([0-9a-fA-F]{1,4}:){2,}[0-9a-fA-F:]*[0-9a-fA-F](/[0-9]{1,3})?$' \
-    | awk '
-        # Only globally routable attacker space may become a decision. Reserved,
-        # private, loopback, link-local, CGNAT, test and multicast ranges never
-        # represent an external attacker and must not be imported (they could
-        # otherwise block the origin itself or internal traffic).
-        function isReserved4(prefix, a, b, c) {
-          if (a == 0 || a == 127 || a >= 224) return 1
-          if (a == 10) return 1
-          if (a == 100 && (prefix < 10 || (prefix >= 10 && b >= 64 && b <= 127))) return 1
-          if (a == 169 && (prefix < 16 || (prefix >= 16 && b == 254))) return 1
-          if (a == 172 && (prefix < 12 || (prefix >= 12 && b >= 16 && b <= 31))) return 1
-          if (a == 192 && b == 168) return 1
-          if (a == 192 && b == 0) return 1
-          if ((a == 198 && (b == 18 || b == 19)) || (a == 198 && b == 51 && c == 100)) return 1
-          if (a == 203 && b == 0 && c == 113) return 1
-          return 0
-        }
-        function isReserved6(line, prefix,   first, h) {
-          if (prefix < 32) return 1
-          if (line ~ /^::/) return 1
-          first = tolower(line); sub(/^::?/, "", first); sub(/:.*/, "", first)
-          h = "0x" substr(first, 1, 2)
-          if (h >= 252) return 1    # ULA fc00::/7, link-local fe80::/10, multicast ff00::/8
-          return 0
-        }
-        {
-          if (index($0, "/") > 0) {
-            n = split($0, seg, "/")
-            if (n != 2 || seg[2] !~ /^[0-9]+$/) next
-            if (index(seg[1], ":") > 0) {
-              pref = seg[2] + 0
-              if (pref < 32 || pref > 128) next
-              if (isReserved6(seg[1], pref)) next
-              print
-              next
-            }
-            pref = seg[2] + 0
-            if (pref < 8 || pref > 32) next
-            split(seg[1], oct, ".")
-            ok = 1
-            for (i = 1; i <= 4; i++) {
-              if (oct[i] !~ /^[0-9]+$/ || oct[i] + 0 > 255) { ok = 0; break }
-              if (length(oct[i]) > 1 && oct[i] ~ /^0/) { ok = 0; break }
-            }
-            if (!ok) next
-            if (isReserved4(pref, oct[1] + 0, oct[2] + 0, oct[3] + 0)) next
-            print
-            next
-          }
-          if (index($0, ":") > 0) {
-            if (isReserved6($0, 128)) next
-            print
-            next
-          }
-          n = split($0, part, ".")
-          if (n != 4) next
-          ok = 1
-          for (i = 1; i <= 4; i++) {
-            if (part[i] !~ /^[0-9]+$/ || part[i] + 0 > 255) { ok = 0; break }
-            if (length(part[i]) > 1 && part[i] ~ /^0/) { ok = 0; break }
-          }
-          if (!ok) next
-          if (isReserved4(32, part[1] + 0, part[2] + 0, part[3] + 0)) next
-          print
-        }' \
-    | sort -u > "$work/candidates.txt"
-
-  if [[ -n "$allowlist" ]]; then
-    printf '%s\n' "$allowlist" | tr ',' '\n' | while IFS= read -r line; do printf '%s\n' "$line"; done | sort -u > "$work/allow.txt"
-    comm -23 "$work/candidates.txt" "$work/allow.txt" > "$work/final.txt"
-  else
-    cp "$work/candidates.txt" "$work/final.txt"
-  fi
-
-  if [[ "$(wc -l < "$work/final.txt" | tr -d ' ')" -gt "$max_decisions" ]]; then
-    sort -u "$work/final.txt" | head -n "$max_decisions" > "$work/final.limited.txt" || true
-    mv "$work/final.limited.txt" "$work/final.txt"
-    printf 'Note: capped the combined list at %s decisions (CROWDSEC_BLOCKLIST_MAX_DECISIONS).\n' "$max_decisions"
-  fi
-
-  count_total=$(wc -l < "$work/final.txt" | tr -d ' ')
-  count_ip=$(grep -cv '/' "$work/final.txt" || true)
-  count_range=$(grep -c '/' "$work/final.txt" || true)
-  if [[ "$count_total" -lt 1 ]]; then
-    fail "No valid addresses could be parsed from the configured sources. Configure CROWDSEC_BLOCKLIST_SOURCES."
-  fi
-}
-
-build_lists
-
-printf 'Parsed %s targets (%s IPs, %s ranges).\n' "$count_total" "$count_ip" "$count_range"
-
-if $dry_run; then
-  printf 'Dry run: would replace the cscli-import decisions with these %s targets.\n' "$count_total"
-  exit 0
-fi
-
-container_running || fail "The CrowdSec engine is not running. Start it first with: bash cms security"
-
-printf 'Removing previous cscli-import decisions...\n'
-cscli_exec decisions delete --origin cscli-import >/dev/null 2>&1 || true
-
-{
-  printf 'duration,scope,value\n'
-  awk -v d="$duration" '{ if (index($0, "/") > 0) printf "%s,range,%s\n", d, $0; else printf "%s,ip,%s\n", d, $0 }' "$work/final.txt"
-} > "$work/import.csv"
-
-printf 'Importing %s decisions into the local LAPI (duration %s)...\n' "$count_total" "$duration"
-cscli_exec decisions import -i - --format csv --batch 1000 < "$work/import.csv"
-
-printf 'Done. The app bouncer picks these up within a few seconds.\n'

scripts/cf-ips-sync.sh

@@ -0,0 +1,186 @@
+#!/usr/bin/env bash
+# Keep the Cloudflare IP ranges in sync for BOTH proxy layers:
+#   1) deployment/proxy/cloudflare-ips.conf (nginx: geo + set_real_ip_from)
+#   2) entryPoints.websecure.forwardedHeaders.trustedIPs in /docker/proxyserver/traefik.yml
+#
+# The repo file is the source of truth for nginx (installed by nginx-sync.sh);
+# Traefik's static config lives outside the repo and is regenerated in place.
+# Traefik only picks it up after a container restart (static config), which
+# --install performs automatically when the list actually changed.
+#
+# Usage:
+#   scripts/cf-ips-sync.sh                     # regen repo + traefik files if ranges changed
+#   scripts/cf-ips-sync.sh --check             # report what would change (exit 1 if any)
+#   sudo scripts/cf-ips-sync.sh --install      # + run nginx-sync.sh and restart Traefik
+#
+# The Traefik bridge subnet is auto-detected (env TRUSTED_SUBNET overrides),
+# because nginx trusts it as a TLS-terminating peer.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROXY_DIR="$SCRIPT_DIR/../deployment/proxy"
+TARGET="$PROXY_DIR/cloudflare-ips.conf"
+TRAEFIK_CONFIG="${TRAEFIK_CONFIG:-/docker/proxyserver/traefik.yml}"
+IPV4_URL="https://www.cloudflare.com/ips-v4"
+IPV6_URL="https://www.cloudflare.com/ips-v6"
+MODE="status"
+
+for arg in "$@"; do
+  case "$arg" in
+    --check) MODE="check" ;;
+    --install) MODE="install" ;;
+    --no-traefik) TRAEFIK_CONFIG="" ;;
+  esac
+done
+
+TRUSTED_SUBNET="${TRUSTED_SUBNET:-}"
+if [[ -z "$TRUSTED_SUBNET" ]]; then
+  TRUSTED_SUBNET="$(docker network inspect proxyserver_traefik-proxy --format '{{range .IPAM.Config}}{{.Subnet}}{{end}}' 2>/dev/null || true)"
+fi
+if [[ -z "$TRUSTED_SUBNET" ]]; then
+  TRUSTED_SUBNET="172.22.0.0/16"
+  echo "warning: could not auto-detect Traefik bridge subnet, using $TRUSTED_SUBNET" >&2
+fi
+
+ipv4="$(mktemp)"
+ipv6="$(mktemp)"
+trap 'rm -f "$ipv4" "$ipv6"' EXIT
+
+if ! curl -sf "$IPV4_URL" -o "$ipv4" || ! curl -sf "$IPV6_URL" -o "$ipv6"; then
+  echo "error: could not fetch Cloudflare ranges" >&2
+  if [[ -f "$TARGET" ]]; then
+    echo "keeping existing $TARGET (ranges not refreshed)" >&2
+    exit 0
+  fi
+  exit 1
+fi
+
+gen_nginx_conf() {
+  {
+    printf '%s\n' "# Trusted edge networks + live Cloudflare CDN ranges."
+    printf '%s\n' "# Managed/regenerated by scripts/cf-ips-sync.sh - do not hand-edit the ranges."
+    printf '%s\n' ""
+    printf '%s\n' "# Topology: Cloudflare -> Traefik (:443, docker bridge proxy_traefik-proxy) ->"
+    printf '%s\n' "# nginx (:9443) -> CMS. nginx ALSO receives direct connections on :9443 from"
+    printf '%s\n' "# Cloudflare edges and from the game client (ws.epicnabbo.nl is not proxied)."
+    printf '%s\n' ""
+    printf '%s\n' "# nginx only trusts the peers listed here as a source of \$remote_addr"
+    printf '%s\n' "# (via CF-Connecting-IP). Anyone else presenting a CF-Connecting-IP or"
+    printf '%s\n' "# CF-ray header is spoofing and is rejected in nginx-cms.conf."
+    printf '%s\n' ""
+    printf '%s\n' "# 1 = peer is a trusted edge or internal network (keyed on the raw peer,"
+    printf '%s\n' "#     unaffected by real_ip rewrites)."
+    printf '%s\n' "geo \$realip_remote_addr \$cms_trusted_edge {"
+    printf '%s\n' "    default 0;"
+    printf '%s\n' "    127.0.0.0/8 1;                    # localhost (health checks, admin)"
+    printf '%s\n' "    ::1 1;                            # localhost v6"
+    printf '%s\n' "    $TRUSTED_SUBNET 1;                # Traefik (proxyserver_traefik-proxy)"
+    printf '%s\n' "    # --- Cloudflare IPv4 ranges (live from cloudflare.com/ips-v4) ---"
+    awk '{print "    "$0" 1;"}' "$ipv4"
+    printf '%s\n' "    # --- Cloudflare IPv6 ranges (live from cloudflare.com/ips-v6) ---"
+    awk '{print "    "$0" 1;"}' "$ipv6"
+    printf '%s\n' "}"
+    printf '%s\n' ""
+    printf '%s\n' "# 1 when an UNTRUSTED peer still presents a CF-Connecting-IP header: that is a"
+    printf '%s\n' "# spoof attempt (only real Cloudflare edges or Traefik may do that lawfully)."
+    printf '%s\n' "map \"\$cms_trusted_edge:\$http_cf_connecting_ip\" \$cms_disallow_forwarding {"
+    printf '%s\n' "    default 0;"
+    printf '%s\n' "    \"~^0:.+\" 1;"
+    printf '%s\n' "}"
+    printf '%s\n' ""
+    printf '%s\n' "# Rewrite \$remote_addr from CF-Connecting-IP but ONLY for the trusted peers"
+    printf '%s\n' "# above. Direct game clients (untrusted) keep their real peer address."
+    printf '%s\n' "set_real_ip_from 127.0.0.0/8;"
+    printf '%s\n' "set_real_ip_from ::1;"
+    printf '%s\n' "set_real_ip_from $TRUSTED_SUBNET;"
+    awk '{print "set_real_ip_from "$0";"}' "$ipv4"
+    awk '{print "set_real_ip_from "$0";"}' "$ipv6"
+    printf '%s\n' ""
+    printf '%s\n' "real_ip_header CF-Connecting-IP;"
+    printf '%s\n' "real_ip_recursive off;"
+  } > "$TARGET.tmp"
+}
+
+gen_nginx_conf
+changed=0
+if cmp -s "$TARGET" "$TARGET.tmp"; then
+  rm -f "$TARGET.tmp"
+  echo "= $TARGET up to date (Cloudflare ranges unchanged)"
+else
+  changed=1
+  if [[ "$MODE" == "check" ]]; then
+    rm -f "$TARGET.tmp"
+    echo "- Cloudflare ranges DIFFER; $TARGET would be regenerated"
+  else
+    mv "$TARGET.tmp" "$TARGET"
+    echo "+ regenerated $TARGET"
+  fi
+fi
+
+traefik_changed=0
+if [[ -n "$TRAEFIK_CONFIG" ]]; then
+  if [[ ! -f "$TRAEFIK_CONFIG" ]]; then
+    echo "warning: $TRAEFIK_CONFIG not found, skipping Traefik sync" >&2
+  else
+    new_traefik="$(CF_V4="$ipv4" CF_V6="$ipv6" python3 - "$TRAEFIK_CONFIG" <<'PY'
+import os, sys
+path = sys.argv[1]
+v4 = sorted(x.rstrip("\n") for x in open(os.environ["CF_V4"]) if x.strip())
+v6 = sorted(x.rstrip("\n") for x in open(os.environ["CF_V6"]) if x.strip())
+lines = open(path).read().split("\n")
+out, i, n = [], 0, len(lines)
+while i < n:
+    line = lines[i]
+    if line.startswith("      trustedIPs:"):
+        out.append(line)
+        i += 1
+        while i < n:
+            s = lines[i]
+            if not s.strip() or s.startswith("        - ") or s.startswith("        #"):
+                i += 1
+            else:
+                break
+        out.append("        # Cloudflare IPv4 reeksen (gesynct door cf-ips-sync.sh)")
+        out += ["        - " + c for c in v4]
+        out.append("        # Cloudflare IPv6 reeksen")
+        out += ["        - " + c for c in v6]
+        continue
+    out.append(line)
+    i += 1
+sys.stdout.write("\n".join(out))
+PY
+)"
+    if grep -q 'trustedIPs:' <<< "$new_traefik" \
+       && grep -cq '^        - ' <<< "$new_traefik"; then
+      if [[ "$new_traefik" == "$(cat "$TRAEFIK_CONFIG")" ]]; then
+        echo "= $TRAEFIK_CONFIG up to date (Cloudflare ranges unchanged)"
+      else
+        traefik_changed=1
+        if [[ "$MODE" == "check" ]]; then
+          echo "- $TRAEFIK_CONFIG differs from live Cloudflare ranges"
+        else
+          cp -a "$TRAEFIK_CONFIG" "$TRAEFIK_CONFIG.bak-$(date +%Y%m%d-%H%M%S)"
+          printf '%s\n' "$new_traefik" > "$TRAEFIK_CONFIG"
+          echo "+ updated $TRAEFIK_CONFIG"
+        fi
+      fi
+    else
+      echo "error: generated Traefik config is missing its trustedIPs block; NOT writing" >&2
+      exit 1
+    fi
+  fi
+fi
+
+[[ "$MODE" == "check" ]] && exit $((changed || traefik_changed))
+
+if [[ "$MODE" == "install" ]]; then
+  "$SCRIPT_DIR/nginx-sync.sh"
+  if [[ "$traefik_changed" -eq 1 ]]; then
+    if docker inspect traefik >/dev/null 2>&1; then
+      echo "--- restarting traefik (static config changed) ---"
+      docker restart traefik
+    else
+      echo "warning: traefik container not found; restart it manually" >&2
+    fi
+  fi
+fi

scripts/cf-purge.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# Purge the Cloudflare edge cache for one or more Cache-Tags.
+#
+# These tags are emitted by nginx (deployment/proxy/nginx-cms.conf):
+#   cms-public   - de publieke API-allowlist (staff/teams/guilds/shop/values/…)
+#   cms-gamedata - /gamedata/ (furnidata, config)
+#   cms-client   - /client/ + /nitro-client/ (game assets)
+#   cms-camera   - /camera/
+#
+# Usage:
+#   scripts/cf-purge.sh cms-public
+#   scripts/cf-purge.sh cms-public cms-gamedata cms-client cms-camera
+#
+# Reads CLOUDFLARE_API_TOKEN / CLOUDFLARE_ZONE_ID from the environment or the
+# repository .env. Fails loudly with a clear message when they are missing or
+# still placeholders, so a pipeline either purges or aborts — never silently
+# pretends it did.
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ENV_FILE="$SCRIPT_DIR/../.env"
+BASE="https://api.cloudflare.com/client/v4"
+
+[[ $# -ge 1 ]] || { echo "usage: $0 <tag> [tag ...]" >&2; exit 64; }
+TAGS=("$@")
+
+load_env() {
+  local name="$1"
+  if [[ -n "${!name:-}" ]]; then
+    printf -v "$name" '%s' "${!name}"
+    return 0
+  fi
+  if [[ -f "$ENV_FILE" ]]; then
+    local line
+    line="$(grep -m1 "^$name=" "$ENV_FILE" | cut -d= -f2- | tr -d "'\"")" || true
+    if [[ -n "$line" ]]; then
+      printf -v "$name" '%s' "$line"
+      return 0
+    fi
+  fi
+  return 1
+}
+
+load_env CLOUDFLARE_API_TOKEN || { echo "error: CLOUDFLARE_API_TOKEN not configured" >&2; exit 1; }
+load_env CLOUDFLARE_ZONE_ID || { echo "error: CLOUDFLARE_ZONE_ID not configured" >&2; exit 1; }
+
+# Placeholder guard: the repo .env historically carried 2-char dummy values.
+if [[ "${#CLOUDFLARE_API_TOKEN}" -lt 16 || "${#CLOUDFLARE_ZONE_ID}" -lt 16 ]]; then
+  echo "error: Cloudflare credentials look like placeholders; add a real token to .env" >&2
+  exit 1
+fi
+
+body="$(python3 -c 'import json,sys; print(json.dumps({"tags": sys.argv[1:]}))' "${TAGS[@]}")"
+
+resp="$(curl -sS -m 20 -X POST \
+  -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  --data "$body" \
+  "$BASE/zones/$CLOUDFLARE_ZONE_ID/purge_cache")"
+
+if ! python3 -c 'import json,sys; sys.exit(0 if json.load(sys.stdin).get("success") else 1)' <<<"$resp"; then
+  echo "error: Cloudflare purge failed: $resp" >&2
+  exit 1
+fi
+echo "purged tags: ${TAGS[*]}"

scripts/cf-setup-cache.sh

@@ -0,0 +1,133 @@
+#!/usr/bin/env bash
+# Create/update the Cloudflare Cache Rule that stores the CMS public API
+# allowlist plus the client-facing gamedata tree at the edge (the routes nginx
+# tags with `Cache-Tag: cms-public` respectievelijk `cms-gamedata`).
+#
+# Why a rule is required: Cloudflare only caches a handful of file extensions
+# by default; `/api/*` responses are served `cf-cache-status: DYNAMIC` even
+# though their `Cache-Control: s-maxage` says they are cacheable. A Cache Rule
+# with "Cache Everything" turns those the other way.
+#
+# What the rule does:
+#   - edge_ttl bypass_by_default : edge cachet volgens de max-age/s-maxage van
+#     nginx; zonder (publieke) header (bv. errorresponses) juist NIET cachen.
+#   - browser_ttl respect_origin : de zone heeft "Browser Cache TTL = 1 jaar" en
+#     overschrijft daarmee het max-age dat nginx per klasse stuurt. Deze rule
+#     herstelt dat voor de publieke API's én /gamedata/: browsers krijgen de
+#     per-klasse max-age van nginx terug i.p.v. een jaar stale data.
+#
+# Het /gamedata/-deel is toegevoegd omdat de zone-TTL anders ook de iconen
+# (`.png`, een standaard cachebare extensie) op een jaar zette: nginx stuurde
+# 300/3600/604800, maar de browser kreeg `max-age=31536000` en een 404 werd als
+# `max-age=31536000` + `cf-cache-status: HIT` vastgezet. Een ontbrekend icon dat
+# later werd geïmporteerd bleef daardoor een jaar 404. Met `respect_origin` geldt
+# de nginx-header, en die stuurt op een 404 juist `no-store`.
+#
+# Idempotent: vergelijkt de bestaande rule (op description + inhoud) en zet
+# alleen bij als die verschilt. Re-running is veilig.
+#
+# Usage (after putting a real token + zone id in .env):
+#   scripts/cf-setup-cache.sh
+#
+# Requires a token with Zone > Cache Rules (edit) permission.
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ENV_FILE="$SCRIPT_DIR/../.env"
+BASE="https://api.cloudflare.com/client/v4"
+PHASE="http_request_cache_settings"
+DESCRIPTION="EpicNabbo CMS public API + gamedata edge cache (cms-public, cms-gamedata)"
+
+# Cache de allowlist exact zoals nginx hem tagt (deployment/proxy/nginx-cms.conf).
+# Geen regex: `matches` vereist Business; vrije operators zijn `in` en
+# `starts_with()`.
+EXPRESSION='(http.request.method eq "GET") and (http.request.uri.path in { "/api/staff" "/api/teams" "/api/guilds" "/api/photos" "/api/leaderboard" "/api/online" "/api/online/count" "/api/shop" "/api/shop/categories" "/api/values" "/api/values/categories" "/api/radio/current-dj" "/api/radio/points/leaderboard" } or starts_with(http.request.uri.path, "/api/values/") or starts_with(http.request.uri.path, "/gamedata/"))'
+
+load_env() {
+  local name="$1"
+  if [[ -n "${!name:-}" ]]; then
+    printf -v "$name" '%s' "${!name}"
+    return 0
+  fi
+  if [[ -f "$ENV_FILE" ]]; then
+    local line
+    line="$(grep -m1 "^$name=" "$ENV_FILE" | cut -d= -f2- | tr -d "'\"")" || true
+    if [[ -n "$line" ]]; then
+      printf -v "$name" '%s' "$line"
+      return 0
+    fi
+  fi
+  return 1
+}
+
+load_env CLOUDFLARE_API_TOKEN || { echo "error: CLOUDFLARE_API_TOKEN not configured" >&2; exit 1; }
+load_env CLOUDFLARE_ZONE_ID || { echo "error: CLOUDFLARE_ZONE_ID not configured" >&2; exit 1; }
+if [[ "${#CLOUDFLARE_API_TOKEN}" -lt 16 || "${#CLOUDFLARE_ZONE_ID}" -lt 16 ]]; then
+  echo "error: Cloudflare credentials look like placeholders; add a real token to .env" >&2
+  exit 1
+fi
+
+api() {
+  curl -sS -m 30 -X "$1" \
+    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
+    -H "Content-Type: application/json" \
+    --data "${2:-}" \
+    "$BASE/zones/$CLOUDFLARE_ZONE_ID${3:-}"
+}
+
+echo "--- reading existing cache-settings ruleset ---"
+existing="$(api GET "" "/rulesets/phases/$PHASE/entrypoint")"
+if ! python3 -c 'import json,sys; sys.exit(0 if json.load(sys.stdin).get("success") else 1)' <<<"$existing"; then
+  echo "error: could not read ruleset: $existing" >&2
+  exit 1
+fi
+
+rule_json="$(DESCRIPTION="$DESCRIPTION" EXPRESSION="$EXPRESSION" python3 - <<'PY'
+import json, os
+print(json.dumps({
+    "description": os.environ["DESCRIPTION"],
+    "expression": os.environ["EXPRESSION"],
+    "action": "set_cache_settings",
+    "action_parameters": {
+        "cache": True,
+        "edge_ttl": {"mode": "bypass_by_default"},
+        "browser_ttl": {"mode": "respect_origin"},
+    },
+}))
+PY
+)"
+
+out="$(EXISTING_JSON="$existing" RULE_JSON="$rule_json" python3 - <<'PY'
+import json, os
+existing = json.loads(os.environ["EXISTING_JSON"])
+rule = json.loads(os.environ["RULE_JSON"])
+result = existing.get("result") or {}
+rules = list(result.get("rules") or [])
+
+def check(r):
+    return {k: r.get(k) for k in ("description", "expression", "action", "action_parameters")}
+
+keep = [r for r in rules if r.get("description") != rule["description"]]
+present = [r for r in rules if r.get("description") == rule["description"]]
+if present and check(present[0]) == check(rule):
+    print("same")
+else:
+    keep.append(rule)
+    print("changed")
+    print(json.dumps({"rules": keep}))
+PY
+)"
+
+status="$(sed -n '1p' <<<"$out")"
+if [ "$status" = "same" ]; then
+  echo "rule already present en identiek — geen wijzigingen"
+  exit 0
+fi
+
+payload="$(sed -n '2,$p' <<<"$out")"
+echo "--- ${DESCRIPTION}: rule bijwerken ---"
+resp="$(api PUT "$payload" "/rulesets/phases/$PHASE/entrypoint")"
+if ! python3 -c 'import json,sys; sys.exit(0 if json.load(sys.stdin).get("success") else 1)' <<<"$resp"; then
+  echo "error: could not save ruleset: $resp" >&2
+  exit 1
+fi
+echo "cache rule live. Verify: curl -s https://epicnabbo.nl/api/shop -o /dev/null -D - | grep -i cf-cache-status"

scripts/check-node-toolchain.mjs

@@ -45,11 +45,28 @@ for (const image of nodeImages) {
 	);
 }
 
+const cmpVersion = (a, b) => {
+	const pa = a.split(".").map((part) => Number.parseInt(part, 10));
+	const pb = b.split(".").map((part) => Number.parseInt(part, 10));
+	for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+		const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
+		if (diff !== 0) return diff;
+	}
+	return 0;
+};
+
+// `.nvmrc` is the recommended version for reproducible local development and
+// the exact Docker base image (both asserted above), but the *runtime* we run
+// on may be any version the package.json engines range accepts. Requiring an
+// exact patch match here would fail on every Node.js patch release, even when
+// the version is explicitly supported.
 if (!process.argv.includes("--static")) {
-	assert.equal(
-		process.versions.node,
-		pinnedVersion,
-		"the active Node.js runtime must match .nvmrc",
+	const active = process.versions.node;
+	const upperBound = `${major + 1}.0.0`;
+	assert.ok(
+		cmpVersion(active, pinnedVersion) >= 0 &&
+			cmpVersion(active, upperBound) < 0,
+		`the active Node.js runtime (${active}) must satisfy package.json engines.node (${packageJson.engines.node}); .nvmrc pins ${pinnedVersion} as the recommended version`,
 	);
 }
 

scripts/ci-deploy-ports.test.sh

@@ -0,0 +1,124 @@
+#!/usr/bin/env bash
+# Tests for the port-selection and port-conflict logic in scripts/ci-deploy.sh.
+#
+# Background: on a host where both blue/green slots answer /api/health, the
+# original read_active_port() counted healthy slots and only consulted the nginx
+# upstream when the count was not exactly 1. With two healthy slots it fell back
+# to the upstream file, but an operator `docker compose up` can leave an extra
+# replica behind, after which the fallback picked slot A regardless of which slot
+# was really live. The candidate then tried to start on an occupied port, and the
+# health probe answered from the pre-existing container on that port instead of
+# the candidate — producing 30 failed "expected release never became healthy"
+# attempts against a release that was never serving.
+#
+# The functions are extracted from ci-deploy.sh rather than copied so this test
+# cannot drift from the script it protects.
+set -Eeuo pipefail
+
+deploy_script="$(dirname "$0")/ci-deploy.sh"
+[[ -r "$deploy_script" ]] || { echo "cannot read $deploy_script" >&2; exit 1; }
+
+# Pull the two functions out of the real script.
+extract() {
+  sed -n "/^$1() {/,/^}/p" "$deploy_script"
+}
+
+read_active_port_fn="$(extract read_active_port)"
+assert_port_free_fn="$(extract assert_port_free)"
+answers_health_fn="$(extract answers_health)"
+
+if [ -z "$read_active_port_fn" ] || [ -z "$assert_port_free_fn" ] || [ -z "$answers_health_fn" ]; then
+  echo "could not extract functions from $deploy_script" >&2
+  exit 1
+fi
+
+slot_a_port=3002
+slot_b_port=3003
+
+fail() { echo "FAIL: $*" >&2; exit 1; }
+
+# ── read_active_port ──────────────────────────────────────────────────────────
+# $1 = upstream body ("none" for a missing file), $2..$3 = ports that answer.
+run_read_active_port() {
+  local body="$1" a="$2" b="$3" tmp
+  tmp="$(mktemp)"
+  if [ "$body" = "none" ]; then
+    tmp=/tmp/ci-deploy-test-nonexistent-upstream-$$
+    rm -f "$tmp"
+  else
+    printf '%s\n' "$body" >"$tmp"
+  fi
+  CMS_UPSTREAM_FILE="$tmp" \
+  PORT_A_HEALTHY="$a" PORT_B_HEALTHY="$b" \
+    bash -c "
+      slot_a_port=$slot_a_port
+      slot_b_port=$slot_b_port
+      upstream_file=\"\$CMS_UPSTREAM_FILE\"
+      $read_active_port_fn
+      # Defined after the extracted function on purpose: answers_health is a
+      # collaborator here, and the test substitutes a deterministic stub for it.
+      answers_health() {
+        local p=\$1 want
+        case \$p in
+          $slot_a_port) want=\"\$PORT_A_HEALTHY\" ;;
+          $slot_b_port) want=\"\$PORT_B_HEALTHY\" ;;
+          *) want='' ;;
+        esac
+        [ \"\$want\" = yes ]
+      }
+      read_active_port
+      echo
+    " 2>/dev/null
+  rm -f "$tmp"
+}
+
+# nginx points at slot B and both answer -> trust the upstream file.
+got="$(run_read_active_port 'server 127.0.0.1:3003 max_fails=2;' yes yes)"
+[ "$got" = "$slot_b_port" ] || fail "nginx->3003 with both healthy: got '$got', want 3003"
+
+got="$(run_read_active_port 'server 127.0.0.1:3002 max_fails=2;' yes yes)"
+[ "$got" = "$slot_a_port" ] || fail "nginx->3002 with both healthy: got '$got', want 3002"
+
+# The regression: both healthy, nginx points at B, but slot A is an unrelated
+# leftover replica. The upstream file is the only thing that knows which slot is
+# live, so it must win.
+got="$(run_read_active_port 'server 127.0.0.1:3003 max_fails=2;' yes yes)"
+[ "$got" != "$slot_a_port" ] || fail "both healthy: fell back to slot A while nginx serves 3003"
+
+# Upstream names a dead slot: fall back to a slot that actually answers, never to
+# the dead port itself.
+got="$(run_read_active_port 'server 127.0.0.1:3002 max_fails=2;' no yes)"
+[ "$got" = "$slot_b_port" ] || fail "nginx->3002 unhealthy, B healthy: got '$got', want 3003"
+
+# Nothing answers at all: read_active_port still has to name a slot, otherwise the
+# rollback path has no target.
+got="$(run_read_active_port 'server 127.0.0.1:3003 max_fails=2;' no no)"
+[ "$got" = "$slot_b_port" ] || fail "nothing healthy: got '$got', want the upstream port 3003"
+
+# No upstream file at all: pick a slot that answers.
+got="$(run_read_active_port none no yes)"
+[ "$got" = "$slot_b_port" ] || fail "no upstream, B healthy: got '$got', want 3003"
+
+got="$(run_read_active_port none yes no)"
+[ "$got" = "$slot_a_port" ] || fail "no upstream, A healthy: got '$got', want 3002"
+
+# ── assert_port_free ─────────────────────────────────────────────────────────
+# Runs against real loopback ports: 3999 is intentionally unused, so the check
+# must report it free.
+bash -c "
+  $assert_port_free_fn
+  assert_port_free 3999 candidate >/dev/null 2>&1
+" || fail "a port with no listener must be reported as free"
+
+# On this host 3002 is held by a CMS container, so the check must fail. Skip when
+# it genuinely is free, otherwise the assertion would be meaningless.
+if ss -ltn 2>/dev/null | grep -qE '127\.0\.0\.1:3002|0\.0\.0\.0:3002'; then
+  if bash -c "
+    $assert_port_free_fn
+    assert_port_free 3002 candidate >/dev/null 2>&1
+  "; then
+    fail "an occupied port must be rejected, but assert_port_free returned success"
+  fi
+fi
+
+echo 'Deploy port-selection tests passed'

scripts/ci-deploy.sh

@@ -21,6 +21,35 @@ cutover_started=0
 candidate_attempted=0
 backup_created=0
 
+# ── Blue/green ──
+# De app draait met `--net=host`, dus elke replica neemt een eigen host-poort in
+# plaats van een gedeelde docker-poort. Daardoor zijn er twee vaste slots en kan
+# een release naast de live release opstarten. De nginx-upstream wijst pas naar
+# de nieuwe release nadat die gezond is én de browsersmoke-test heeft gewonnen.
+slot_a_port=3002
+slot_b_port=3003
+slot_a_container="epicnext-cms-app"
+slot_b_container="epicnext-cms-green"
+# Overridable zodat de simulatietests een pad kunnen opgeven dat niet bestaat en
+# zo het in-place pad kunnen testen, en zodat een host met een andere
+# nginx-indeling niet stilvalt op een release.
+upstream_file="${CMS_UPSTREAM_FILE:-/etc/nginx/snippets/cms_upstream_servers.conf}"
+nginx_site="${CMS_NGINX_SITE:-/etc/nginx/sites-enabled/cms.conf}"
+active_port=""
+old_port=""
+new_port=""
+old_container=""
+new_container=""
+blue_green=0
+
+# Resource limits voor de container. Zonder deze limieten kan één geheugenlek de
+# hele host vullen, met MariaDB, nginx en Traefik als slachtoffer. 2 CPU laat
+# achtergrondwerk toe zonder de hele kernel aan één release te geven.
+mem_limit="4g"
+mem_swap_limit="5g"
+cpu_limit="2"
+pids_limit="512"
+
 is_current() {
   local head
   head="$(git ls-remote --exit-code origin "refs/heads/$branch")" || return 2
@@ -38,18 +67,280 @@ check_current() {
 }
 
 healthy() {
+  local port="${1:-$slot_a_port}"
   local attempt
   for attempt in $(seq 1 30); do
-    if curl -sf --max-time 5 http://127.0.0.1:3002/api/health | grep -q '"database":true'; then return 0; fi
+    if curl -sf --max-time 5 "http://127.0.0.1:$port/api/health" | grep -q '"database":true'; then return 0; fi
     sleep 3
   done
   return 1
 }
 
+# Zelfde check als `healthy`, maar zonder retries. Voor het bepalen van de
+# actieve poort willen we geen 90 seconden per slot wachten: daar gaat het om
+# een al draaiend proces dat nu of nooit antwoordt.
+answers_health() {
+  curl -sf --max-time 5 "http://127.0.0.1:$1/api/health" | grep -q '"database":true'
+}
+
+# Staat er een blue/green-upstream? Zonder die bestanden blijft dit script op de
+# oude, in-place cutover vallen, zodat een host met een andere nginx-indeling
+# niet stilvalt op een upgrade.
+detect_blue_green() {
+  [ -r "$upstream_file" ] || return 1
+  grep -qs 'cms_app' "$nginx_site" || return 1
+  return 0
+}
+
+# Welke poort is op dit moment ÉCHT live?
+#
+# Volgorde van vertrouwen:
+#   1. Het nginx-upstream-bestand. Dat is de enige bron die aangeeft wáár het
+#      publieke verkeer daadwerkelijk binnenkomt; alles daaronder is gevolg.
+#   2. Een gezond slot dat overeenkomt met die aanwijzing.
+#   3. Precies één gezond slot (een verse host met geen upstream-bestand).
+#
+# De eerdere versie telde gezonde slots en gebruikte de fallback pas als er 0 of
+# 2+ waren. Op een host waar beide slots tegelijk gezond zijn — bijvoorbeeld
+# doordat een losse `docker compose up` een extra replica heeft achtergelaten —
+# gaf dat een willekeurige keuze, en dan kon de kandidaat op een bezette poort
+# starten (EADDRINUSE) terwijl de health-check de reeds draaiende container op
+# die poort beantwoordde. De release-vergelijking faalde dan 30 keer op een
+# container die toevallig een andere release draaide.
+read_active_port() {
+  local port="" pointed=""
+
+  if [ -r "$upstream_file" ]; then
+    port="$(grep -oE '127\.0\.0\.1:(3002|3003)' "$upstream_file" 2>/dev/null | head -1 | cut -d: -f2 || true)"
+  fi
+
+  if [ -n "$port" ] && answers_health "$port"; then
+    printf '%s' "$port"
+    return 0
+  fi
+
+  # Het upstream-bestand wijst naar een slot dat niet antwoordt. Kies dan het
+  # enige andere gezonde slot, anders is er niets om op te bouwen.
+  for candidate in "$slot_a_port" "$slot_b_port"; do
+    [ "$candidate" = "$port" ] && continue
+    if answers_health "$candidate"; then
+      echo "nginx points at ${port:-unknown}, which is unhealthy; ${candidate} answers instead" >&2
+      printf '%s' "$candidate"
+      return 0
+    fi
+  done
+
+  # Geen enkel slot antwoordt. Vertrouw dan op het bestand, zodat een
+  # rollback-poging toch het vorige slot kan starten.
+  if [ -n "$port" ]; then
+    printf '%s' "$port"
+    return 0
+  fi
+
+  printf '%s' "$slot_a_port"
+}
+
+# Poort-bezetting controleren vóór het starten van de kandidaat.
+#
+# Zonder deze check zorgt `docker run` er stilzwijgend voor dat de kandidaat
+# dood gaat op EADDRINUSE, terwijl de health-check ondertussen de reeds draaiende
+# container op diezelfde poort beantwoordt. Dat levert een misleidende
+# "expected release never became healthy" op in plaats van de echte oorzaak.
+# Elke listener wordt hierboven concreet genoemd, inclusief de container die
+# hem vasthoudt.
+assert_port_free() {
+  local port="$1" name="$2"
+  local holders=""
+  # `type`, niet `command -v`: de deploy-simulatietests leveren `ss` als
+  # shell-functie via BASH_ENV, en `command -v` herkent die wel op Bash maar de
+  # functie is niet geëxporteerd naar de subshell van start_candidate. Met `type`
+  # blijft de stub ook daar zichtbaar, zodat de test geen echte hostpoorten
+  # hoeft te zien.
+  if type ss >/dev/null 2>&1; then
+    # `ss` drukt altijd een kolomkop af, ook als er geen listener is. Filter op
+    # LISTEN, anders zou elke vrije poort als bezet gemeld worden.
+    holders="$(ss -ltnp "sport = :$port" 2>/dev/null | grep -F 'LISTEN' || true)"
+  fi
+  [ -z "$holders" ] && return 0
+  echo "Port $port is already in use, cannot start candidate $name" >&2
+  printf '%s\n' "$holders" >&2
+
+  # Noem exact het container dat de poort vasthoudt.
+  #
+  # `docker ps --filter publish=` werkt niet: de app draait met --net=host en
+  # publiceert dus geen poorten, dus die filter levert altijd niets op. In plaats
+  # daarvan volgen we de luisterende PID uit `ss` terug naar de container via
+  # /proc/<pid>/cgroup. Een eerdere versie noemde álle draaiende containers als
+  # belkenners, wat de echte boosdochter (epicnext-cms) onder een zee van
+  # onschuldige containers begraven.
+  local squatter="squatter_pids"
+  squatter_pids="$(printf '%s\n' "$holders" | grep -oP 'pid=\K[0-9]+' | sort -u || true)"
+  if [ -n "$squatter_pids" ]; then
+    local pid cid owner=""
+    for pid in $squatter_pids; do
+      cid="$(sed -n 's#.*docker-\([0-9a-f]\{64\}\)\.scope#\1#p' "/proc/$pid/cgroup" 2>/dev/null | head -1)"
+      [ -n "$cid" ] || continue
+      owner="$(docker inspect --format '{{.Name}} ({{.Config.Image}})' "$cid" 2>/dev/null || true)"
+      [ -n "$owner" ] && printf 'Held by container: %s\n' "${owner#/}" >&2
+    done
+  fi
+  echo "" >&2
+  # Blauwe/groene releases beheren hun eigen slots. Een container met een andere
+  # naam die toevallig op een van deze poorten draait — meestal een
+  # `docker compose up`-replica — staat los van de pipeline en blokkeert de
+  # release. Live verkeer loopt via het nginx-upstream over het andere slot en is
+  # dus niet geraakt.
+  case "$owner" in
+    *"/$name"*|*"/$slot_b_container"*)
+      echo "Note: the holder looks like a managed slot container; re-check the port mapping above." >&2 ;;
+    *)
+      cat >&2 <<EOF
+This port is held by a container that is not a blue/green slot, so the deploy
+cannot start the candidate. Live traffic is unaffected: nginx keeps serving
+the other slot until cutover.
+
+Remove the stray container and re-run the deploy:
+
+  docker rm -f $(printf '%s' "$owner" | sed -n 's#.*/\([^ ]*\).*#\1#p')
+
+If it comes back after a reboot, it is started by docker-compose.yml rather
+than by this script; delete or disable that service.
+EOF
+      ;;
+  esac
+  return 1
+}
+
+# Ruim een compose-replica op die een blauwe/groene slot bezet.
+#
+# Een `docker compose up` — of de dagelijkse `scripts/docker-update.sh`, waarvan
+# de CI-eigendomscontrole per slot wankelde — laat een replica met container_name
+# `epicnext-cms` achter op poort 3002. Die draait nooit live: nginx wijst naar de
+# poort van een slot-container die dit script zelf heeft gestart, en die staat per
+# definitie aan de andere kant dan de kandidaat. Zonder deze opruimstap loopt elke
+# release vast op een bezette poort totdat iemand de container met de hand
+# verwijdert.
+#
+# Bewust smal, want een container van een ander deployment is niet van ons:
+#   - alleen een replica die uit precies deze checkout komt
+#     (com.docker.compose.project.config_files), niet een losse compose-project;
+#   - nooit een slot-container, want die beheert dit script zelf;
+#   - nooit de poort waar nginx naar wijst.
+# Wat daarnaast nog op de doel-poort zit, laat assert_port_free() met zijn eigen
+# foutmelding staan in plaats van stilzwijgend verdwijnen.
+retire_compose_replicas() {
+  local live_port="$1" cid name="" config_files="" port=""
+  while read -r cid; do
+    [ -n "$cid" ] || continue
+    name="$(docker inspect --format '{{.Name}}' "$cid" 2>/dev/null | sed -n 's#^/##p' || true)"
+    case "$name" in ''|"$slot_a_container"|"$slot_b_container") continue ;; esac
+    config_files="$(docker inspect --format '{{index .Config.Labels "com.docker.compose.project.config_files"}}' "$cid" 2>/dev/null || true)"
+    [ "$config_files" = "$deploy_dir/docker-compose.yml" ] || continue
+    port="$(docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' "$cid" 2>/dev/null | sed -n 's#^PORT=##p' | head -1 || true)"
+    [ -n "$port" ] && [ "$port" != "$live_port" ] || continue
+    echo "Removing compose replica $name on port $port: it squats a blue/green slot and is not the live release (nginx serves $live_port)"
+    docker rm -f "$name" || return 1
+  done < <(docker ps --filter "label=com.docker.compose.project.config_files=$deploy_dir/docker-compose.yml" --format '{{.ID}}')
+  return 0
+}
+
+# Zet de nginx-upstream op de nieuwe poort en herlaadt graceful.
+#
+# De nieuwe inhoud wordt eerst echt weggeschreven en dán getest: `nginx -t` leest
+# het include-bestand van schijf, dus alleen achteraf testen zou de oude, werkende
+# configuratie blijven valideren. Faalt de test, dan gaat het origineel onmiddellijk
+# terug en raakt de live release niets.
+switch_upstream() {
+  local port="$1"
+  local backup="${upstream_file}.deploy.bak"
+  if ! cp "$upstream_file" "$backup" 2>/dev/null; then
+    echo "Cannot back up $upstream_file; refusing to cut over" >&2
+    return 1
+  fi
+  {
+    echo "# Geschreven door scripts/ci-deploy.sh op $(date -u +%FT%TZ) voor release $sha."
+    echo "# Niet met de hand bewerken: de volgende deploy overschrijft dit bestand."
+    echo "server 127.0.0.1:${port} max_fails=2 fail_timeout=10s;"
+  } >"$upstream_file"
+  if ! nginx -t >/dev/null 2>&1; then
+    echo "nginx rejected the new upstream; restoring the previous one" >&2
+    mv "$backup" "$upstream_file"
+    return 1
+  fi
+  if ! nginx -s reload; then
+    echo "nginx reload failed; restoring the previous upstream" >&2
+    mv "$backup" "$upstream_file"
+    nginx -s reload || true
+    return 1
+  fi
+  rm -f "$backup"
+  # Even de tijd voor de graceful reload om de nieuwe worker te laten starten.
+  sleep 1
+  return 0
+}
+
+# Start de kandidaat op een eigen host-poort.
+#
+# De resource limits staan hier bewust bij de `docker run` en niet alleen in
+# docker-compose.yml: een release wordt hier gestart en gebruikt compose helemaal
+# niet, dus limieten die alleen in de compose stonden zouden in productie nooit
+# gelden.
+start_candidate() {
+  local port="$1" name="$2"
+  assert_port_free "$port" "$name"
+  (
+    set -a
+    # shellcheck disable=SC1091
+    . "$deploy_dir/.env"
+    set +a
+    ENV_ARGS=()
+    while IFS='=' read -r key _; do
+      case "$key" in ''|'#'*|*[!A-Za-z0-9_]* ) continue ;; esac
+      ENV_ARGS+=(-e "$key")
+    done < "$deploy_dir/.env"
+    docker run -d --name "$name" --restart always --net=host \
+      --memory="$mem_limit" --memory-swap="$mem_swap_limit" \
+      --cpus="$cpu_limit" --pids-limit="$pids_limit" \
+      "${ENV_ARGS[@]}" -e "PORT=$port" -e HOSTNAME=0.0.0.0 \
+      -v "$deploy_dir/public/nitro-assets:/app/public/nitro-assets" \
+      -v "$deploy_dir/public/swf:/app/public/swf" \
+      -v "$deploy_dir/storage:/app/storage" \
+      -v /var/www/Gamedata:/var/www/Gamedata \
+      "$image"
+  )
+}
+
 finish() {
   local status=$?
   trap - EXIT
-  if [ "$status" -ne 0 ] && [ "$cutover_started" -eq 1 ]; then
+  if [ "$status" -ne 0 ] && [ "$blue_green" -eq 1 ]; then
+    # Er zijn twee soorten falen, en het verschil bepaalt hoeveel werk terug moet.
+    if [ "$cutover_started" -eq 0 ]; then
+      # De live release draait nog ongestoord; alleen de kandidaat opruimen.
+      echo "Deployment failed before cutover; the live release was never stopped" >&2
+      if [ "$candidate_attempted" -eq 1 ] && [ -n "$new_container" ] && docker inspect "$new_container" >/dev/null 2>&1; then
+        docker logs "$new_container" --tail 50 >&2 || true
+        docker rm -f "$new_container" || true
+      fi
+    else
+      # nginx wijst nu naar de kandidaat. Eerst het verkeer terug, dan pas de
+      # kandidaat weghalen, anders zou de site 502-en terwijl we terugdraaien.
+      echo "Deployment failed after cutover; rolling back to port $old_port" >&2
+      if [ -n "$new_container" ] && docker inspect "$new_container" >/dev/null 2>&1; then docker logs "$new_container" --tail 50 >&2 || true; fi
+      if [ -n "$old_port" ]; then switch_upstream "$old_port" || true; fi
+      if [ -n "$new_container" ] && docker inspect "$new_container" >/dev/null 2>&1; then docker rm -f "$new_container" || true; fi
+      if [ -n "$old_container" ] && docker start "$old_container" >/dev/null 2>&1; then
+        if healthy "$old_port"; then
+          echo "Rollback verified on port $old_port"
+        else
+          echo "ERROR: previous container did not return to a healthy state" >&2
+        fi
+      else
+        echo "ERROR: no previous container to roll back to" >&2
+      fi
+    fi
+  elif [ "$status" -ne 0 ] && [ "$cutover_started" -eq 1 ]; then
+    # In-place pad (geen blue/green-upstream): het oude scriptgedrag.
     echo "Deployment failed; restoring previous container" >&2
     docker logs epicnext-cms-app --tail 50 >&2 || true
     if command -v ss >/dev/null 2>&1; then ss -ltnp 'sport = :3002' >&2 || true; fi
@@ -92,11 +383,39 @@ for managed_name in epicnext-cms epicnext-cms-app; do
   docker inspect --format '{{.Name}} running={{.State.Running}} pid={{.State.Pid}} image={{.Image}}' "$managed_name" 2>/dev/null || true
 done
 [ "$deploy_dir/.env" -ef .env ] || cp "$deploy_dir/.env" .env
+
+# De migraties draaien op de host tegen DATABASE_URL, niet in de container. Die
+# waarde staat alleen in $deploy_dir/.env, dus controleer hem hier: anders
+# bouwen we eerst een image en doorlopen we de browsergate voordat `db:migrate`
+# op een lege DATABASE_URL stukloopt. Dat is een halve release voor niets.
+if ! grep -qs '^DATABASE_URL=' .env; then
+  echo "Error: DATABASE_URL ontbreekt in $deploy_dir/.env" >&2
+  echo "       Zet daar een DATABASE_URL (mysql://user:pass@host:3306/db) en draai opnieuw." >&2
+  echo "       De live release is niet aangeraakt; deze release is niet uitgerold." >&2
+  exit 1
+fi
+
+# De image krijgt het label van $sha, en `verify-deployed-release.mjs` controleert
+# later alleen díe label. Zonder deze check bouwt een vuile werkboom dus een image
+# die zegt release $sha te zijn terwijl er ongecommitte code in zit — precies het
+# scenario "rebuilden levert geen nieuwe code". `docker-update.sh` deed dit al.
+# `--untracked-files=normal` laat gitignored artefacten (.next, coverage,
+# build-reports) buiten beschouwing; die worden toch niet meegebouwd.
+if [ -n "$(git status --porcelain --untracked-files=normal)" ]; then
+  echo "Error: de werkboom is niet schoon, dus de image zou een verkeerd release-label krijgen." >&2
+  echo "       Commit of stash de wijzigingen en draai opnieuw." >&2
+  echo "       De live release is niet aangeraakt." >&2
+  git status --short >&2
+  exit 1
+fi
+
 pnpm install --frozen-lockfile
 pnpm exec playwright install chromium
 
 echo "Building $image"
-DOCKER_BUILDKIT=1 docker build --network=host --progress=plain --cache-from epicnext-cms:latest \
+# No --network=host: BuildKit only grants it via --allow=network.host, and the
+# build needs nothing but outbound internet (apk, pnpm, next/font/google).
+DOCKER_BUILDKIT=1 docker build --progress=plain --cache-from epicnext-cms:latest \
   --build-arg NEXT_DEPLOYMENT_ID="$sha" -t "$image" .
 check_current
 # Read reports from the already-built image; do not start an extra application.
@@ -121,74 +440,151 @@ check_current
 pnpm db:migrate
 check_current
 
-# Prefer the active CI container, or the active legacy compose container.
-for name in epicnext-cms epicnext-cms-app; do
-  if [ "$(docker inspect --format '{{.State.Running}}' "$name" 2>/dev/null || true)" = true ]; then
-    if [ -z "$previous_name" ]; then previous_name="$name"; else secondary_name="$name"; fi
+# ── Blue/green: bepaal wie live is en waar de kandidaat mag starten ──
+if detect_blue_green; then
+  blue_green=1
+  active_port="$(read_active_port)"
+  if [ "$active_port" = "$slot_b_port" ]; then
+    old_port=$slot_b_port; new_port=$slot_a_port
+    old_container=$slot_b_container; new_container=$slot_a_container
+  else
+    old_port=$slot_a_port; new_port=$slot_b_port
+    old_container=$slot_a_container; new_container=$slot_b_container
   fi
-done
-if [ -z "$previous_name" ]; then
-  for name in epicnext-cms-app epicnext-cms; do
-    if docker inspect "$name" >/dev/null 2>&1; then previous_name="$name"; break; fi
+  echo "Live release keeps serving port $old_port; candidate starts on port $new_port"
+  # Rollback-evidence vastleggen voordat er iets wordt veranderd.
+  if docker inspect "$old_container" >/dev/null 2>&1; then
+    previous_name="$old_container"
+    previous_image="$(docker inspect --format '{{.Image}}' "$old_container")"
+    docker tag "$previous_image" epicnext-cms:previous
+  else
+    # Eerste release op een verse blue/green-opstelling: er is nog niets live.
+    previous_name=""
+    old_container=""
+  fi
+else
+  blue_green=0
+  # Prefer the active CI container, or the active legacy compose container.
+  for name in epicnext-cms epicnext-cms-app; do
+    if [ "$(docker inspect --format '{{.State.Running}}' "$name" 2>/dev/null || true)" = true ]; then
+      if [ -z "$previous_name" ]; then previous_name="$name"; else secondary_name="$name"; fi
+    fi
   done
+  if [ -z "$previous_name" ]; then
+    for name in epicnext-cms-app epicnext-cms; do
+      if docker inspect "$name" >/dev/null 2>&1; then previous_name="$name"; break; fi
+    done
+  fi
+  if [ -n "$previous_name" ]; then
+    previous_image="$(docker inspect --format '{{.Image}}' "$previous_name")"
+    docker tag "$previous_image" epicnext-cms:previous
+  fi
+  # Remove a stopped leftover CI container when the compose container is active.
+  if [ "$previous_name" != epicnext-cms-app ] && [ "$secondary_name" != epicnext-cms-app ] && docker inspect epicnext-cms-app >/dev/null 2>&1; then
+    docker rm epicnext-cms-app
+  fi
 fi
 if docker inspect "$backup_name" >/dev/null 2>&1; then
   echo "Unresolved rollback container exists; refusing to overwrite it" >&2
   exit 1
 fi
-if [ -n "$previous_name" ]; then
-  previous_image="$(docker inspect --format '{{.Image}}' "$previous_name")"
-  docker tag "$previous_image" epicnext-cms:previous
-fi
-# Remove a stopped leftover CI container when the compose container is active.
-if [ "$previous_name" != epicnext-cms-app ] && [ "$secondary_name" != epicnext-cms-app ] && docker inspect epicnext-cms-app >/dev/null 2>&1; then
-  docker rm epicnext-cms-app
-fi
 
-cutover_started=1
-# Both legacy Compose and CI containers can exist after earlier failed updates.
-# Preserve each before releasing the shared host port; never kill an arbitrary PID.
-if [ -n "$secondary_name" ]; then
-  docker stop "$secondary_name"
-  docker rename "$secondary_name" "$secondary_backup"
-  secondary_backup_created=1
+# The application writes everything under storage/ as uid 33, but storage is a
+# host bind so the image's own ownership is irrelevant. Any path that is not
+# uid 33 makes the write fail with EACCES, and because most of these writes are
+# inside a try/catch the failure is silent: the avatar cache just never fills
+# (each avatar becomes a fresh live render) and the catalog export reports
+# "delivery failed" while the emulator never receives the update. The old code
+# only repaired storage/imaging, so storage/catalog-git/hotel-status.json kept
+# coming back root:root and /api/admin/catalog/status kept throwing EACCES.
+for owned_dir in imaging catalog-git cms-errors furniture-imports logs media \
+  nitro-cleanup config-backups nitro-scale32-backups; do
+  target="$deploy_dir/storage/$owned_dir"
+  [ -e "$target" ] || mkdir -p "$target" 2>/dev/null || true
+  [ -d "$target" ] || continue
+  chown -R 33:33 "$target" 2>/dev/null || true
+done
+# The avatar/badge cache needs its leaf directories to exist before first use;
+# the cache misses (and re-renders live) rather than erroring when they do not.
+for cache_dir in avatars badges; do
+  if ! install -d -o 33 -g 33 -m 0750 "$deploy_dir/storage/imaging/$cache_dir" 2>/dev/null; then
+    mkdir -p "$deploy_dir/storage/imaging/$cache_dir" 2>/dev/null || true
+  fi
+done
+
+if [ "$blue_green" -eq 1 ]; then
+  # 1. Maak de doel-poort vrij. Alles wat daar draait is per definitie niet live,
+  #    want nginx wijst nog naar old_port. Een restje van een mislukte eerdere
+  #    deploy mag de nieuwe release niet blokkeren.
+  if docker inspect "$new_container" >/dev/null 2>&1; then
+    docker rm -f "$new_container"
+  fi
+
+  # 2. Een compose-replica die ooit is achtergebleven zit hier nog op de
+  #    doel-poort. Hij draait niet live en wordt dus opgeruimd, zodat de release
+  #    niet op een bezette poort stukloopt.
+  retire_compose_replicas "$old_port"
+
+  # 3. Start de kandidaat ernaast. De live release draait ononderbroken door.
+  candidate_attempted=1
+  start_candidate "$new_port" "$new_container"
+
+  # 4. Gezond? Release-hash klopt? Browsersmoke-test? Pas dan hoeft het oude
+  #    release het veld te ruimen — anders zou een mislukte e2e-test pas ná de
+  #    cutover de productie breken in plaats van ervoor.
+  healthy "$new_port"
+  node scripts/verify-deployed-release.mjs "http://127.0.0.1:$new_port/api/health" "$sha"
+  PLAYWRIGHT_BASE_URL="http://127.0.0.1:$new_port" pnpm test:e2e
+
+  # 5. Het enige onomkeerbare moment: vanaf hier wijst nginx naar de kandidaat.
+  cutover_started=1
+  switch_upstream "$new_port"
+  echo "Cut over to port $new_port; retiring port $old_port"
+
+  # 6. Nu mag de oude release weg. Pas ná de swap, zodat er nooit een moment is
+  #    waarop er geen enkele container draait.
+  if [ -n "$old_container" ] && docker inspect "$old_container" >/dev/null 2>&1; then
+    docker stop "$old_container"
+    docker rename "$old_container" "$backup_name"
+    backup_created=1
+  fi
+  verified_image="$(docker inspect --format '{{.Image}}' "$new_container")"
+else
+  # In-place pad, alleen voor hosts zonder blue/green-upstream.
+  cutover_started=1
+  # Both legacy Compose and CI containers can exist after earlier failed updates.
+  # Preserve each before releasing the shared host port; never kill an arbitrary PID.
+  if [ -n "$secondary_name" ]; then
+    docker stop "$secondary_name"
+    docker rename "$secondary_name" "$secondary_backup"
+    secondary_backup_created=1
+  fi
+  if [ -n "$previous_name" ]; then
+    docker stop "$previous_name"
+    docker rename "$previous_name" "$backup_name"
+    backup_created=1
+  fi
+  candidate_attempted=1
+  start_candidate 3002 epicnext-cms-app
+  healthy 3002
+  node scripts/verify-deployed-release.mjs http://127.0.0.1:3002/api/health "$sha"
+  PLAYWRIGHT_BASE_URL=http://127.0.0.1:3002 pnpm test:e2e
+  verified_image="$(docker inspect --format '{{.Image}}' epicnext-cms-app)"
 fi
-if [ -n "$previous_name" ]; then
-  docker stop "$previous_name"
-  docker rename "$previous_name" "$backup_name"
-  backup_created=1
-fi
-candidate_attempted=1
-(
-  set -a
-  # shellcheck disable=SC1091
-  . "$deploy_dir/.env"
-  set +a
-  ENV_ARGS=()
-  while IFS='=' read -r key _; do
-    case "$key" in ''|'#'*|*[!A-Za-z0-9_]* ) continue ;; esac
-    ENV_ARGS+=(-e "$key")
-  done < "$deploy_dir/.env"
-  docker run -d --name epicnext-cms-app --restart always --net=host \
-    "${ENV_ARGS[@]}" -e PORT=3002 -e HOSTNAME=0.0.0.0 \
-    -v "$deploy_dir/public/nitro-assets:/app/public/nitro-assets" \
-    -v "$deploy_dir/public/swf:/app/public/swf" \
-    -v "$deploy_dir/storage:/app/storage" \
-    -v /var/www/Gamedata:/var/www/Gamedata \
-    "$image"
-)
-healthy
-node scripts/verify-deployed-release.mjs http://127.0.0.1:3002/api/health "$sha"
-PLAYWRIGHT_BASE_URL=http://127.0.0.1:3002 pnpm test:e2e
-# Publish the latest alias only after HTTP and browser checks pass.
-verified_image="$(docker inspect --format '{{.Image}}' epicnext-cms-app)"
 docker tag "$verified_image" "epicnext-cms:verified-$sha"
 docker tag "$verified_image" epicnext-cms:latest
 cutover_started=0
 if [ "$backup_created" -eq 1 ]; then docker rm "$backup_name" || true; fi
 if [ "$secondary_backup_created" -eq 1 ]; then docker rm "$secondary_backup" || true; fi
 
+
 echo "Deployment verified: $sha"
+# Een deploy kan de game client, furnidata (gamedata), camera en public API data
+# verversen. Laat de Cloudflare edge-cache van die tags los (best-effort: alleen
+# wanneer er een echte token + zone-id geconfigureerd is; no-op anders).
+if [ -x "$deploy_dir/scripts/cf-purge.sh" ]; then
+  bash "$deploy_dir/scripts/cf-purge.sh" cms-public cms-gamedata cms-client cms-camera || true
+fi
 # Retain the current and previous releases; do not remove arbitrary named tags.
 while IFS= read -r tag; do
   if [[ "$tag" =~ ^epicnext-cms:(verified-)?[0-9a-f]{40}$ ]] && [ "$tag" != "$image" ] && [ "$tag" != "epicnext-cms:verified-$sha" ]; then

scripts/ci-preflight.sh

@@ -39,6 +39,6 @@ pnpm exec playwright install chromium
 export NEWS_E2E_IMAGE="$image"
 export NEWS_E2E_RELEASE="$sha"
 build_attempted=1
-DOCKER_BUILDKIT=1 docker build --network=host --progress=plain \
+DOCKER_BUILDKIT=1 docker build --progress=plain \
   --build-arg NEXT_DEPLOYMENT_ID="$sha" -t "$image" .
 NEWS_E2E_IMAGE="$image" NEWS_E2E_RELEASE="$sha" node --import tsx e2e/news-real/run.ts

scripts/compress-gamedata.mjs

@@ -1,130 +0,0 @@
-/**
- * Pre-compress large gamedata JSON files to .gz so nginx `gzip_static`
- * serves them via sendfile instead of re-compressing up to 48 MB on every
- * request (see /etc/nginx/nginx.conf: `gzip_static on`).
- *
- * Idempotent: a file is only re-compressed when its source mtime is newer
- * than the existing .gz (e.g. after a Studio catalog export rewrites it).
- *
- * Usage: node scripts/compress-gamedata.mjs
- * Env:   GAMEDATA_ROOT (default /var/www/Gamedata)
- *        GAMEDATA_GZIP_MIN_BYTES (default 1048576)
- */
-
-import { createReadStream, createWriteStream, promises as fs } from "node:fs";
-import { cpus } from "node:os";
-import { join, relative } from "node:path";
-import { pipeline } from "node:stream/promises";
-import { createGzip } from "node:zlib";
-
-const GAMEDATA_ROOT = process.env.GAMEDATA_ROOT ?? "/var/www/Gamedata";
-const MIN_BYTES = Number(process.env.GAMEDATA_GZIP_MIN_BYTES ?? 1024 * 1024);
-const GZIP_LEVEL = 9;
-const TARGET_DIRS = ["config", "bundled/config"];
-const CONCURRENCY = Math.max(1, Math.min(4, cpus().length));
-
-function isCompressible(name) {
-	return (
-		name.endsWith(".json") &&
-		!name.endsWith(".gz") &&
-		!name.endsWith(".min.json")
-	);
-}
-
-async function collectCandidates() {
-	const files = [];
-	for (const dir of TARGET_DIRS) {
-		const root = join(GAMEDATA_ROOT, dir);
-		let entries;
-		try {
-			entries = await fs.readdir(root, { withFileTypes: true });
-		} catch {
-			continue;
-		}
-		for (const entry of entries) {
-			if (!entry.isFile() || !isCompressible(entry.name)) continue;
-			const full = join(root, entry.name);
-			const stat = await fs.stat(full);
-			if (stat.size < MIN_BYTES) continue;
-			files.push({ src: full, size: stat.size, mtimeMs: stat.mtimeMs });
-		}
-	}
-	return files;
-}
-
-async function needsCompression({ src, mtimeMs }) {
-	const gz = `${src}.gz`;
-	try {
-		const stat = await fs.stat(gz);
-		return stat.mtimeMs < mtimeMs;
-	} catch {
-		return true;
-	}
-}
-
-async function compressOne({ src }) {
-	const gz = `${src}.gz`;
-	const tmp = `${gz}.tmp-${process.pid}`;
-	await pipeline(
-		createReadStream(src),
-		createGzip({ level: GZIP_LEVEL }),
-		createWriteStream(tmp),
-	);
-	await fs.rename(tmp, gz);
-	try {
-		await fs.chmod(gz, 0o644);
-	} catch {
-		// Best-effort; ownership is up to the caller.
-	}
-	return gz;
-}
-
-async function main() {
-	const candidates = await collectCandidates();
-	const work = [];
-	const skipped = [];
-	for (const candidate of candidates) {
-		if (await needsCompression(candidate)) {
-			work.push(candidate);
-		} else {
-			skipped.push(candidate);
-		}
-	}
-
-	const results = [];
-	let idx = 0;
-	async function worker() {
-		while (idx < work.length) {
-			const item = work[idx++];
-			try {
-				const gz = await compressOne(item);
-				const stat = await fs.stat(gz);
-				results.push(
-					`compressed ${relative(GAMEDATA_ROOT, gz)} (${item.size} -> ${stat.size} bytes, ${Math.round((1 - stat.size / item.size) * 1000) / 10}% smaller)`,
-				);
-			} catch (err) {
-				results.push(
-					`FAILED ${relative(GAMEDATA_ROOT, item.src)}: ${err instanceof Error ? err.message : String(err)}`,
-				);
-			}
-		}
-	}
-
-	const workers = Array.from(
-		{ length: Math.min(CONCURRENCY, work.length) },
-		() => worker(),
-	);
-	await Promise.all(workers);
-
-	console.log(
-		`gamedata: ${work.length} to compress, ${skipped.length} up to date`,
-	);
-	for (const line of results) console.log(`gamedata: ${line}`);
-}
-
-main().catch((err) => {
-	console.error(
-		`gamedata: FATAL ${err instanceof Error ? err.message : String(err)}`,
-	);
-	process.exit(1);
-});

scripts/crowdsec-setup.sh

@@ -1,154 +0,0 @@
-#!/usr/bin/env bash
-set -Eeuo pipefail
-DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-cd "$DIR"
-ENV_FILE="$DIR/.env"
-COMPOSE_FILE="deployment/crowdsec/compose.crowdsec.yml"
-PROJECT_NAME="epicnext-crowdsec"
-CONTAINER_NAME="epicnext-crowdsec"
-DEFAULT_PORT="18080"
-
-mode="${1:-enable}"
-case "$mode" in
-  enable|--enable) ;;
-  status|--status) ;;
-  disable|--disable) ;;
-  blocklists|blocklists-install-cron|blocklists-uninstall-cron) ;;
-  *) echo "Usage: bash cms security [enable|status|disable|blocklists|blocklists-install-cron|blocklists-uninstall-cron]" >&2; exit 1 ;;
-esac
-
-umask 077
-fail() { printf 'ERROR: %s\n' "$*" >&2; exit 1; }
-for command in docker flock; do command -v "$command" >/dev/null || fail "Required command: $command"; done
-docker info >/dev/null 2>&1 || fail "Docker is not reachable."
-docker compose version >/dev/null 2>&1 || fail "Docker Compose plugin required."
-exec 9>"$DIR/.deploy.lock"
-flock -w 30 9 || fail "Another installation or update is running."
-[[ -f "$ENV_FILE" ]] || fail "Create .env first (bash cms install)."
-
-case "$mode" in
-  blocklists) exec bash "$DIR/scripts/blocklists-sync.sh" sync "${2:-}" ;;
-  blocklists-install-cron) exec bash "$DIR/scripts/blocklists-sync.sh" install-cron ;;
-  blocklists-uninstall-cron) exec bash "$DIR/scripts/blocklists-sync.sh" uninstall-cron ;;
-esac
-
-env_get() {
-  local key="$1" line
-  while IFS= read -r line || [[ -n "$line" ]]; do
-    case "$line" in
-      "$key="*) line="${line#*=}"; line="${line%\"}"; line="${line#\"}"; printf '%s' "$line"; return 0 ;;
-    esac
-  done < "$ENV_FILE"
-  return 1
-}
-
-env_set() {
-  local key="$1" value="$2" tmp
-  tmp="$(mktemp "$DIR/.env.crowdsec.XXXXXX")"
-  if awk -v k="$key" -v v="$value" 'BEGIN{FS=OFS="=";done=0} { if ($1==k) { print k "=" v; done=1 } else print } END { if (!done) print k "=" v }' "$ENV_FILE" > "$tmp"; then
-    chmod 600 "$tmp"
-    mv -f -- "$tmp" "$ENV_FILE"
-  else
-    rm -f -- "$tmp"
-    fail "Could not update .env"
-  fi
-}
-
-compose_cmd() {
-  docker compose --project-name "$PROJECT_NAME" --env-file "$ENV_FILE" -f "$COMPOSE_FILE" --profile security "$@"
-}
-
-health_probe() {
-  local url="$1"
-  if command -v curl >/dev/null 2>&1; then
-    curl -fsS --max-time 3 "$url" >/dev/null 2>&1
-  else
-    compose_cmd exec -T crowdsec wget -q -O - "$url" >/dev/null 2>&1
-  fi
-}
-
-container_running() {
-  [[ "$(docker inspect -f '{{.State.Running}}' "$CONTAINER_NAME" 2>/dev/null || true)" = true ]]
-}
-
-if [[ "$mode" = disable || "$mode" = --disable ]]; then
-  set +e
-  compose_cmd stop crowdsec
-  rc=$?
-  set -e
-  [[ $rc -eq 0 ]] || printf 'CrowdSec engine was not running or could not be stopped.\n'
-  env_set CROWDSEC_LOCAL_ENABLED false
-  printf 'CrowdSec local stack disabled. The engine container is stopped; volumes and .env key were kept.\n'
-  exit 0
-fi
-
-if [[ "$mode" = status || "$mode" = --status ]]; then
-  enabled=no
-  [[ "$(env_get CROWDSEC_LOCAL_ENABLED 2>/dev/null || true)" = true ]] && enabled=yes
-  port="$(env_get CROWDSEC_LAPI_PORT 2>/dev/null || true)"
-  [[ -z "$port" ]] && port="$DEFAULT_PORT"
-  printf 'CROWDSEC_LOCAL_ENABLED=%s\n' "$enabled"
-  if container_running; then
-    printf 'Engine: running\n'
-    if health_probe "http://127.0.0.1:$port/health"; then
-      printf 'LAPI health: OK (127.0.0.1:%s)\n' "$port"
-    else
-      printf 'LAPI health: UNREACHABLE (127.0.0.1:%s)\n' "$port"
-    fi
-  else
-    printf 'Engine: not running\n'
-    printf 'Start with: bash cms security\n'
-  fi
-  exit 0
-fi
-
-port="$(env_get CROWDSEC_LAPI_PORT 2>/dev/null || true)"
-[[ -n "$port" ]] || port="$DEFAULT_PORT"
-[[ "$port" =~ ^[0-9]{1,5}$ ]] || fail "CROWDSEC_LAPI_PORT must be a port number."
-if (( port < 1024 || port > 65535 )); then
-  fail "CROWDSEC_LAPI_PORT must be within 1024-65535."
-fi
-key="$(env_get CROWDSEC_LAPI_API_KEY 2>/dev/null || true)"
-[[ -n "$key" ]] || key="$(od -An -N32 -tx1 /dev/urandom | tr -d ' \n')"
-url="$(env_get CROWDSEC_LAPI_URL 2>/dev/null || true)"
-[[ -n "$url" ]] || url="http://127.0.0.1:$port"
-log_dir="${CROWDSEC_NGINX_LOG_DIR:-$(env_get CROWDSEC_NGINX_LOG_DIR 2>/dev/null || true)}"
-[[ -n "$log_dir" ]] || log_dir="/var/log/nginx"
-
-if ! container_running && command -v ss >/dev/null 2>&1; then
-  if ss -ltn "( sport = :$port )" 2>/dev/null | grep -q LISTEN; then
-    fail "Port $port is already in use. Set CROWDSEC_LAPI_PORT (and CROWDSEC_LAPI_URL) in .env to a free port and re-run."
-  fi
-fi
-
-if [[ ! -r "$log_dir/access.log" ]]; then
-  printf 'Warning: %s/access.log is not readable. The engine will run but has no detections until an access log is available.\n' "$log_dir"
-fi
-
-env_set CROWDSEC_LOCAL_ENABLED true
-env_set CROWDSEC_LAPI_URL "$url"
-env_set CROWDSEC_LAPI_PORT "$port"
-env_set CROWDSEC_LAPI_API_KEY "$key"
-env_set CROWDSEC_NGINX_LOG_DIR "$log_dir"
-
-compose_cmd config --quiet || fail "CrowdSec Compose configuration is invalid; fix CROWDSEC_* settings in .env." 
-set +e
-compose_cmd up -d --wait crowdsec
-rc=$?
-set -e
-if [[ $rc -ne 0 ]]; then
-  compose_cmd up -d crowdsec
-fi
-
-attempt=0
-while ! health_probe "http://127.0.0.1:$port/health"; do
-  attempt=$((attempt + 1))
-  [[ $attempt -lt 30 ]] || fail "CrowdSec LAPI did not become healthy on port $port."
-  sleep 2
-done
-
-printf 'CrowdSec engine running in LAPI-only mode on 127.0.0.1:%s (container %s).\n' "$port" "$CONTAINER_NAME"
-compose_cmd exec -T crowdsec cscli bouncers list >/dev/null 2>&1 \
-  && printf 'Bouncer "cms" was registered against the local LAPI.\n' \
-  || printf 'Warning: could not list bouncers. Diagnose with: docker compose exec -T %s cscli bouncers list\n' "$CONTAINER_NAME"
-printf 'Restart the CMS container (or run your next deployment) so it loads the new bouncer env. For a clone: bash cms update --skip-pull\n'

scripts/docker-prune.sh

@@ -3,15 +3,21 @@
 #
 # Modes:
 #   (default) — post-deploy cleanup (safe, fast):
-#     - Build cache older than 72h, capped at 4 GB max used space.
+#     - Build cache capped at 4 GB max used space (CMS_BUILD_CACHE_MAX), evicting
+#       least-recently-used entries. This cap is the actual bound.
 #     - Unreferenced images older than 7 days (keeps rollback images around).
 #     - Stopped containers older than 24h.
+#     - Dangling images, which are always unreferenced.
+#     - Orphaned Firefox profiles in byparr's writable layer (BYPARR_CONTAINERS).
 #   --force — emergency mode ("never let the disk max out"): drops everything
 #     with no age windows:
 #     - ALL unreferenced build cache,
 #     - ALL unreferenced images (no age grace),
 #     - ALL stopped containers.
 #
+# The default mode escalates to --force on its own when / drops below 8 GB free,
+# so the bound holds even if this stops running on schedule.
+#
 # Volumes are NEVER pruned in either mode: mariadb-turbo-data is a database.
 # Idempotent; exits 0 when Docker is unavailable.
 set -Eeuo pipefail
@@ -34,15 +40,101 @@ command -v docker >/dev/null 2>&1 || {
 printf '\n[%s] === docker prune start%s ===\n' "$(now)" "$( (( FORCE )) && printf ' (FORCE)' )" >>"$LOG_FILE"
 docker system df >>"$LOG_FILE" 2>&1 || true
 
+# A hard ceiling on the root filesystem is what actually bounds the growth, so
+# the emergency path is reached on disk pressure rather than only on a timer.
+# The image/container passes stay age-gated: a rollback image and a stopped
+# container are cheap to keep for a week and expensive to lose.
+FREE_KB=$(df -Pk / | awk 'NR==2 {print $4}')
+# 8 GB free is comfortable for a database plus a release swap.
+if (( FREE_KB < 8 * 1024 * 1024 )); then
+  FORCE=1
+  printf '[%s] only %s KB free on /; switching to FORCE prune\n' \
+    "$(now)" "$FREE_KB" >>"$LOG_FILE"
+fi
+
 if (( FORCE )); then
   docker builder prune -af >>"$LOG_FILE" 2>&1 || true
   docker image prune -af >>"$LOG_FILE" 2>&1 || true
   docker container prune -f >>"$LOG_FILE" 2>&1 || true
 else
-  docker builder prune -af --filter "until=72h" --max-used-space=4g >>"$LOG_FILE" 2>&1 || true
+  # --max-used-space and --filter are mutually exclusive in buildx: passing
+  # both makes the cap a no-op and the cache grows without bound. The cap alone
+  # is the bound, and it evicts least-recently-used entries to get there.
+  docker builder prune -af --max-used-space="${CMS_BUILD_CACHE_MAX:-4g}" >>"$LOG_FILE" 2>&1 || true
   docker image prune -af --filter "until=168h" >>"$LOG_FILE" 2>&1 || true
   docker container prune -f --filter "until=24h" >>"$LOG_FILE" 2>&1 || true
 fi
 
+# Dangling images have no tag and no container, so nothing can reference them.
+# They are what repeated local builds leave behind.
+docker image prune -f >>"$LOG_FILE" 2>&1 || true
+
+# ── Interrupted git gc leftovers ─────────────────────────────────
+# A `git gc` that gets OOM-killed mid-repack leaves its tmp_pack behind, and
+# nothing reclaims it: git only clears those on the next successful gc. One such
+# file held 7.7 GB here while the whole object store was 83 MB. Only files older
+# than a day are considered, so a gc running right now is never touched.
+repo_dir="${CMS_REPO_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
+if [[ -d "$repo_dir/.git/objects/pack" ]]; then
+	while IFS= read -r -d '' tmp; do
+		size=$(du -h "$tmp" | cut -f1)
+		rm -f "$tmp"
+		printf '[%s] removed leftover tmp_pack %s (%s) from an interrupted git gc\n' \
+			"$(now)" "$tmp" "$size" >>"$LOG_FILE"
+	done < <(find "$repo_dir/.git/objects/pack" -maxdepth 1 -name 'tmp_*' -mmin +1440 -print0 2>/dev/null)
+fi
+
+# ── Orphaned browser profiles ─────────────────────────────────────
+# byparr launches a real Firefox per request, and each launch leaves a
+# ~10-140 MB profile behind in the container's writable layer. Nothing ever
+# removes them, so the layer grows without bound: 716 profiles / 6.8 GB after two
+# days on this host, ~1.7 GB/day.
+#
+# Deleting a profile out from under a running browser kills that job, so live
+# ones are identified the only way that is reliable rather than by age: a
+# browser keeps its profile open, which shows up as a /proc/<pid>/fd symlink
+# pointing into the directory. Anything not referenced that way, and untouched
+# for BYPARR_PROFILE_MIN_AGE_MIN minutes, is an orphan.
+#
+# Age alone is not a safe signal here: browsers stay warm for ~27 hours, so an
+# age window that is safe for the leak is far too wide for the disk.
+BYPARR_TMP_MIN_AGE_MIN="${BYPARR_TMP_MIN_AGE_MIN:-30}"
+for container in ${BYPARR_CONTAINERS:-byparr}; do
+	docker inspect -f '{{.State.Running}}' "$container" >/dev/null 2>&1 || continue
+	[[ "$(docker inspect -f '{{.State.Running}}' "$container" 2>/dev/null)" == "true" ]] || continue
+
+	removed=$(
+		docker exec -e BYPARR_TMP_MIN_AGE_MIN="$BYPARR_TMP_MIN_AGE_MIN" "$container" sh -c '
+			set -u
+			min_age="${BYPARR_TMP_MIN_AGE_MIN:-30}"
+			base="${1:-/tmp}"
+			live_file=$(mktemp)
+			# Live profiles are the ones a running process still holds open.
+			for p in $(ps -eo pid= 2>/dev/null); do
+				ls -l "/proc/$p/fd" 2>/dev/null
+			done | grep -o "$base/playwright_firefoxdev_profile-[A-Za-z0-9]*" | sort -u >"$live_file"
+
+			count=0
+			for dir in "$base"/playwright_firefoxdev_profile-*; do
+				[ -d "$dir" ] || continue
+				# Never touch something a process is still using.
+				grep -Fxq "$dir" "$live_file" && continue
+				# A profile a browser is still writing to is not an orphan
+				# yet, even if the directory itself looks old.
+				if find "$dir" -newermt "-${min_age} minutes" -print -quit 2>/dev/null | grep -q .; then
+					continue
+				fi
+				rm -rf "$dir" 2>/dev/null && count=$((count + 1))
+			done
+			rm -f "$live_file"
+			printf "%s" "$count"
+		' sh /tmp 2>/dev/null || printf '0'
+	)
+	if [[ "${removed:-0}" -gt 0 ]]; then
+		printf '[%s] removed %s orphaned browser profiles from %s\n' \
+			"$(now)" "$removed" "$container" >>"$LOG_FILE"
+	fi
+done
+
 printf '\n[%s] === docker prune complete%s ===\n' "$(now)" "$( (( FORCE )) && printf ' (FORCE)' )" >>"$LOG_FILE"
 docker system df >>"$LOG_FILE" 2>&1 || true

scripts/docker-start.import.test.mjs

@@ -1,7 +1,13 @@
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
 
-import { it } from "vitest";
+import { describe, expect, it } from "vitest";
+
+import {
+	detectMemoryLimitMb,
+	heapLimitMb,
+	runtimeNodeOptions,
+} from "./docker-start.mjs";
 
 it("imports runtime validation without starting the CMS", () => {
 	const result = spawnSync(
@@ -16,28 +22,88 @@ it("imports runtime validation without starting the CMS", () => {
 	assert.equal(result.status, 0, result.stderr);
 });
 
-it("rejects the local CrowdSec bouncer without a key", () => {
-	const result = spawnSync(
-		process.execPath,
-		[
-			"--input-type=module",
-			"-e",
-			"import {validateRuntime} from './scripts/docker-start.mjs';try{validateRuntime({HOTEL_NAME:'x',AUTH_SECRET:'01234567890123456789012345678901',DATABASE_URL:'mysql://u:p@h/db',APP_URL:'http://h',CROWDSEC_LOCAL_ENABLED:'true'});process.exit(1)}catch(error){if(!String(error.message).includes('CROWDSEC_LAPI_API_KEY'))throw error}",
-		],
-		{ encoding: "utf8" },
-	);
-	assert.equal(result.status, 0, result.stderr);
+describe("heap limit", () => {
+	it("leaves headroom for the memory V8 does not account for", () => {
+		// 4 GB cgroup limit -> a 2867 MB heap, well under the ceiling.
+		expect(heapLimitMb(4 * 1024 ** 3)).toBe(2867);
+		expect(heapLimitMb(6 * 1024 ** 3)).toBe(4300);
+	});
+
+	it("clamps to a floor and a ceiling", () => {
+		// Too small to run a Next.js server at all: floor wins.
+		expect(heapLimitMb(256 * 1024 ** 2)).toBe(512);
+		// A huge or absent limit must not turn into a 100 GB heap.
+		expect(heapLimitMb(64 * 1024 ** 3)).toBe(8192);
+		expect(heapLimitMb(Number.NaN)).toBe(8192);
+		expect(heapLimitMb(0)).toBe(8192);
+	});
 });
 
-it("accepts a complete local CrowdSec configuration", () => {
-	const result = spawnSync(
-		process.execPath,
-		[
-			"--input-type=module",
-			"-e",
-			"import {validateRuntime} from './scripts/docker-start.mjs';validateRuntime({HOTEL_NAME:'x',AUTH_SECRET:'01234567890123456789012345678901',DATABASE_URL:'mysql://u:p@h/db',APP_URL:'http://h',CROWDSEC_LOCAL_ENABLED:'true',CROWDSEC_LAPI_API_KEY:'fixture-key',CROWDSEC_LAPI_URL:'http://127.0.0.1:18080'})",
-		],
-		{ encoding: "utf8" },
-	);
-	assert.equal(result.status, 0, result.stderr);
+describe("cgroup detection", () => {
+	const asReader = (contents) => (path) => {
+		if (!(path in contents)) throw new Error(`ENOENT: ${path}`);
+		return contents[path];
+	};
+
+	it("reads the cgroup v2 limit", () => {
+		expect(
+			detectMemoryLimitMb(
+				asReader({ "/sys/fs/cgroup/memory.max": "4294967296" }),
+			),
+		).toBe(2867);
+	});
+
+	it("falls back to cgroup v1 when v2 is absent", () => {
+		expect(
+			detectMemoryLimitMb(
+				asReader({
+					"/sys/fs/cgroup/memory.max": "",
+					"/sys/fs/cgroup/memory/memory.limit_in_bytes": "6442450944",
+				}),
+			),
+		).toBe(4300);
+	});
+
+	it("treats an unlimited cgroup as no limit at all", () => {
+		// cgroup v1 reports "max"; a bare sentinel means the same thing.
+		expect(
+			detectMemoryLimitMb(asReader({ "/sys/fs/cgroup/memory.max": "max" })),
+		).toBe(8192);
+		expect(
+			detectMemoryLimitMb(
+				asReader({
+					"/sys/fs/cgroup/memory/memory.limit_in_bytes": "9223372036854771712",
+				}),
+			),
+		).toBe(8192);
+	});
+
+	it("falls back when neither cgroup file is readable", () => {
+		expect(
+			detectMemoryLimitMb(() => {
+				throw new Error("ENOENT");
+			}),
+		).toBe(8192);
+	});
+});
+
+describe("NODE_OPTIONS", () => {
+	it("adds the cap when none is set", () => {
+		expect(runtimeNodeOptions("", 2867)).toBe("--max-old-space-size=2867");
+		expect(runtimeNodeOptions(undefined, 2867)).toBe(
+			"--max-old-space-size=2867",
+		);
+	});
+
+	it("keeps unrelated options already present", () => {
+		expect(runtimeNodeOptions("--no-warnings", 2867)).toBe(
+			"--no-warnings --max-old-space-size=2867",
+		);
+	});
+
+	it("never overrides an explicit operator choice", () => {
+		expect(runtimeNodeOptions("--max-old-space-size=8192", 2867)).toBe(
+			"--max-old-space-size=8192",
+		);
+	});
 });

scripts/docker-start.mjs

@@ -1,7 +1,70 @@
 // Fail before listening if an installation has no valid runtime configuration.
 import { spawn } from "node:child_process";
+import { readFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
+/** Fraction of the container memory limit V8 is allowed to use for its heap.
+ * The rest has to cover native allocations the JS heap cannot account for:
+ * the mysql2 pool buffers, sharp's image pipeline, and zlib during a burst of
+ * RSC rendering. */
+const HEAP_FRACTION = 0.7;
+const MIN_HEAP_MB = 512;
+/** Backstop only. The fraction is the real policy: on a 6 GB container it asks
+ * for 4300 MB, and a backstop at or below that would silently turn the fraction
+ * into a fixed number and make the two limits disagree. This exists purely so a
+ * nonsensical cgroup reading cannot ask for an unbounded heap. */
+const MAX_HEAP_MB = 8192;
+
+export function heapLimitMb(cgroupLimitBytes) {
+	if (!Number.isFinite(cgroupLimitBytes) || cgroupLimitBytes <= 0)
+		return MAX_HEAP_MB;
+	const mb = Math.floor((cgroupLimitBytes * HEAP_FRACTION) / (1024 * 1024));
+	return Math.min(MAX_HEAP_MB, Math.max(MIN_HEAP_MB, mb));
+}
+
+/**
+ * Read this container's memory ceiling from cgroup v2, falling back to v1.
+ * Without this the V8 heap defaults to a quarter of *host* memory, so a 4 GB
+ * container on a 24 GB host lets the heap grow past the limit and the kernel
+ * OOM-kills the process mid-request — which is what produced the
+ * `next-build (v16)` kills in the host logs. A container that GCs before it
+ * reaches the ceiling degrades to a slower page instead of a killed process.
+ */
+export function detectMemoryLimitMb(readFile = readFileSync) {
+	const candidates = [
+		"/sys/fs/cgroup/memory.max",
+		"/sys/fs/cgroup/memory/memory.limit_in_bytes",
+	];
+	for (const path of candidates) {
+		let raw;
+		try {
+			raw = readFile(path, "utf8").trim();
+		} catch {
+			continue;
+		}
+		// cgroup v1 reports "max" for an unlimited cgroup; v2 uses a bare
+		// sentinel of a very large number on some kernels.
+		if (raw === "max" || raw === "") continue;
+		const bytes = Number(raw);
+		if (!Number.isFinite(bytes) || bytes <= 0) continue;
+		// A host-sized "limit" means no cgroup ceiling was applied.
+		if (bytes >= Number.MAX_SAFE_INTEGER) continue;
+		return heapLimitMb(bytes);
+	}
+	return heapLimitMb(Number.NaN);
+}
+
+export function runtimeNodeOptions(
+	existing = "",
+	heapMb = detectMemoryLimitMb(),
+) {
+	const flag = `--max-old-space-size=${heapMb}`;
+	if (!existing.trim()) return flag;
+	// Respect an explicit operator override; only add the cap when absent.
+	if (existing.includes("--max-old-space-size")) return existing;
+	return `${existing} ${flag}`;
+}
+
 export function validateRuntime(settings) {
 	const invalid = [];
 	if (!settings.HOTEL_NAME?.trim() || settings.HOTEL_NAME === "Build fixture")
@@ -23,22 +86,6 @@ export function validateRuntime(settings) {
 			invalid.push(key);
 		}
 	}
-	const localEnabled = ["true", "1"].includes(
-		String(settings.CROWDSEC_LOCAL_ENABLED ?? "")
-			.trim()
-			.toLowerCase(),
-	);
-	if (localEnabled) {
-		if (!settings.CROWDSEC_LAPI_API_KEY?.trim())
-			invalid.push("CROWDSEC_LAPI_API_KEY");
-		if (settings.CROWDSEC_LAPI_URL) {
-			try {
-				new URL(settings.CROWDSEC_LAPI_URL);
-			} catch {
-				invalid.push("CROWDSEC_LAPI_URL");
-			}
-		}
-	}
 	if (invalid.length)
 		throw new Error(`Invalid runtime configuration: ${invalid.join(", ")}`);
 }
@@ -49,7 +96,13 @@ if (
 ) {
 	try {
 		validateRuntime(process.env);
-		const child = spawn(process.execPath, ["server.js"], { stdio: "inherit" });
+		const heapMb = detectMemoryLimitMb();
+		const nodeOptions = runtimeNodeOptions(process.env.NODE_OPTIONS, heapMb);
+		console.log(`Starting CMS with a ${heapMb} MB V8 heap cap`);
+		const child = spawn(process.execPath, ["server.js"], {
+			stdio: "inherit",
+			env: { ...process.env, NODE_OPTIONS: nodeOptions },
+		});
 		for (const signal of ["SIGTERM", "SIGINT"])
 			process.on(signal, () => child.kill(signal));
 		child.on("error", () => {

scripts/docker-update.sh

@@ -58,10 +58,27 @@ trap 'exit 130' INT
 trap 'exit 143' TERM
 trap 'log "Update failed; inspect $LOG_FILE. No volumes or local files were deleted."' ERR
 
-# An existing CI deployment is a different owner of the same host port.
-if [ "$(docker inspect --format '{{.State.Running}}' epicnext-cms-app 2>/dev/null || true)" = true ]; then
-  die "This host is managed by CI (epicnext-cms-app). Update through CI, not a second Compose deployment."
+# This host belongs to CI: the blue/green deploy owns both host ports (3002 and
+# 3003) and one of the two slot containers is always the live release. Compose
+# may only run where CI does not.
+#
+# Checking epicnext-cms-app alone was not enough. After a cutover to the green
+# slot the blue container is stopped, renamed and deleted, so the guard stopped
+# firing while the host stayed CI-managed. `docker compose up` then recreated a
+# replica named epicnext-cms on port 3002 — the blue slot, exactly where the next
+# candidate has to start — and every later release failed on a busy port until
+# someone removed that container by hand (see logs/docker-update.cron.log).
+# Therefore: both slot containers count, and so does the nginx upstream, which is
+# the only thing that still marks the host as blue/green when a slot is idle.
+ci_upstream_file="${CMS_UPSTREAM_FILE:-/etc/nginx/snippets/cms_upstream_servers.conf}"
+if [ -r "$ci_upstream_file" ] && grep -qsE '127\.0\.0\.1:(3002|3003)' "$ci_upstream_file"; then
+  die "This host is managed by CI ($ci_upstream_file points at a blue/green slot). Update through CI, not a second Compose deployment."
 fi
+for slot_container in epicnext-cms-app epicnext-cms-green; do
+  if [ "$(docker inspect --format '{{.State.Running}}' "$slot_container" 2>/dev/null || true)" = true ]; then
+    die "This host is managed by CI ($slot_container). Update through CI, not a second Compose deployment."
+  fi
+done
 [[ -z "$(git status --porcelain --untracked-files=normal)" ]] || die "Working tree is not clean. Commit or stash local work first."
 if [[ "$UPDATE_SKIP_PULL" = 0 ]]; then
   git rev-parse --abbrev-ref --symbolic-full-name '@{upstream}' >/dev/null || die "Configure this branch's Git upstream before updating."
@@ -106,7 +123,7 @@ if [[ -n "${CMS_IMAGE_REPOSITORY:-}" ]]; then
   docker tag "$app_reference" "epicnext-cms:$CMS_RELEASE"
   docker tag "$remote_migration_image" "$migration_image"
 else
-  docker build --network=host --target migrations --build-arg NEXT_DEPLOYMENT_ID="$CMS_RELEASE" -t "$migration_image" . >>"$LOG_FILE" 2>&1
+  docker build --target migrations --build-arg NEXT_DEPLOYMENT_ID="$CMS_RELEASE" -t "$migration_image" . >>"$LOG_FILE" 2>&1
   docker compose build --build-arg NEXT_DEPLOYMENT_ID="$CMS_RELEASE" cms >>"$LOG_FILE" 2>&1
 fi
 expected_image="$(docker image inspect --format '{{.Id}}' "epicnext-cms:$CMS_RELEASE")"

scripts/furni-diagnose-now.ts

@@ -1,9 +1,10 @@
 import "./load-env";
 import { createHash } from "node:crypto";
-import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { readdirSync, readFileSync, statSync } from "node:fs";
 import path from "node:path";
 import { sql } from "drizzle-orm";
 import { CatalogItems, db, ItemsBase } from "@/lib/db";
+import { bundleExistsInDir } from "@/lib/furni/bundle-file";
 import { readFurniData } from "@/lib/services/furni-data";
 
 const ICON_DIR = path.join(
@@ -191,11 +192,10 @@ async function main(): Promise<void> {
 		);
 
 	let nitroMissing = 0;
-	const nitroSet = new Set(existsSync(NITRO_DIR) ? readdirSync(NITRO_DIR) : []);
 	for (const cls of catalogClasses) {
-		if (!nitroSet.has(`${cls}.nitro`)) nitroMissing++;
+		if (!bundleExistsInDir(NITRO_DIR, cls)) nitroMissing++;
 	}
-	console.log(`[5] catalog items without .nitro bundle: ${nitroMissing}`);
+	console.log(`[5] catalog items without a bundle on disk: ${nitroMissing}`);
 
 	await db.$client.end();
 	process.exit(0);

scripts/generate-stack-height-sql.ts

@@ -0,0 +1,386 @@
+import "./load-env";
+import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { sql } from "drizzle-orm";
+import { db } from "@/lib/db";
+import {
+	autoDetectInteraction,
+	nitroAnimationStatesCount,
+} from "@/lib/furni/auto-interaction";
+import { parseNitroBundle } from "@/lib/services/swf/nitro-builder";
+
+/**
+ * Generate a plain SQL file that repairs every furniture row in `items_base`
+ * from the visual logic inside each `.hab` / `.nitro` bundle:
+ *
+ *   width / length / stack_height  ←  logic.model.dimensions x/y/z
+ *   allow_stack                    ←  z > 0
+ *   allow_sit / allow_lay / allow_walk  ←  furnidata flags (cansiton/canlayon/canstandon)
+ *   interaction_modes_count        ←  real nitro animation states / mechanic
+ *   interaction_type               ←  logicType + classname mechanic (only fills 'default')
+ *
+ * The dimensions are NOT in furnidata — they live in the bundle JSON at
+ * `logic.model.dimensions` (or top-level `dimensions` for official bundles).
+ * The interaction columns mirror `verifyAndFixInteractionModesCount`
+ * (src/lib/services/furni-import.ts:1341): real furnidata flags + .nitro states,
+ * and `interaction_type` is only touched when it is still `default`.
+ *
+ * Usage:
+ *   pnpm exec tsx scripts/generate-stack-height-sql.ts [options]
+ *
+ * Options:
+ *   --dir=<path>        bundle directory (default: /var/www/Gamedata/bundled/furniture)
+ *   --furnidata=<path>  local FurnitureData.json (default: /var/www/Gamedata/config/FurnitureData.json)
+ *   --out=<path>        SQL output file     (default: stack-heights.sql)
+ *   --types=<list>      items_base types    (default: s,i  → floor + wall furniture)
+ *   --all               emit every matched row instead of only changed rows
+ *   --no-interaction    dimensions/allow_stack only, skip interaction columns
+ *
+ * Nothing in the database is modified here; you run the generated file yourself.
+ */
+
+const args = new Map<string, string | true>();
+for (const raw of process.argv.slice(2)) {
+	const eq = raw.indexOf("=");
+	if (eq === -1) args.set(raw.replace(/^--/, ""), true);
+	else args.set(raw.slice(2, eq), raw.slice(eq + 1));
+}
+
+const DIR = String(args.get("dir") ?? "/var/www/Gamedata/bundled/furniture");
+const FURNIDATA = String(
+	args.get("furnidata") ?? "/var/www/Gamedata/config/FurnitureData.json",
+);
+const OUT = String(args.get("out") ?? "stack-heights.sql");
+const TYPES = String(args.get("types") ?? "s,i")
+	.split(",")
+	.map((t) => t.trim())
+	.filter(Boolean);
+const EMIT_ALL = args.has("all");
+const WITH_INTERACTION = !args.has("no-interaction");
+
+const EXTENSIONS = [".hab", ".nitro"] as const;
+
+interface Dims {
+	x: number;
+	y: number;
+	z: number;
+}
+
+interface Flags {
+	cansiton: boolean;
+	canlayon: boolean;
+	canstandon: boolean;
+}
+
+interface BundleInfo {
+	dims: Dims | null;
+	animationStates: number | undefined;
+	logicType: string | undefined;
+}
+
+interface Row {
+	item_name: string;
+	public_name: string;
+	width: number;
+	length: number;
+	stack_height: number;
+	allow_stack: number | string;
+	allow_sit: number | string;
+	allow_lay: number | string;
+	allow_walk: number | string;
+	interaction_type: string;
+	interaction_modes_count: number;
+}
+
+/** Escape a value for a single-quoted MySQL string literal. */
+function q(value: string): string {
+	return `'${value.replace(/\\/g, "\\\\").replace(/'/g, "''")}'`;
+}
+
+/** `enum('0','1')` values must be quoted — an unquoted 0 is read as index 0 (''). */
+function qbit(value: boolean): string {
+	return value ? "'1'" : "'0'";
+}
+
+function isTruthyBit(value: number | string): boolean {
+	return Number(value) === 1;
+}
+
+/** Pull dimensions out of a parsed bundle JSON, tolerating both layouts. */
+function extractDims(json: unknown): Dims | null {
+	const root = json as Record<string, unknown> | null;
+	if (!root) return null;
+	const logic = root.logic as Record<string, unknown> | undefined;
+	const model = logic?.model as Record<string, unknown> | undefined;
+	const candidate =
+		(model?.dimensions as Dims | undefined) ??
+		(logic?.dimensions as Dims | undefined) ??
+		(root.dimensions as Dims | undefined);
+	if (!candidate) return null;
+	const x = Number(candidate.x);
+	const y = Number(candidate.y);
+	const z = Number(candidate.z);
+	if (!Number.isFinite(x) || !Number.isFinite(y) || !Number.isFinite(z)) {
+		return null;
+	}
+	return { x, y, z };
+}
+
+/** Parse a bundle once and cache everything we need from it. */
+function readBundleInfo(path: string): BundleInfo {
+	try {
+		const json = parseNitroBundle(readFileSync(path)).json as Record<
+			string,
+			unknown
+		>;
+		return {
+			dims: extractDims(json),
+			animationStates: nitroAnimationStatesCount(json),
+			logicType:
+				typeof json.logicType === "string" ? json.logicType : undefined,
+		};
+	} catch {
+		return { dims: null, animationStates: undefined, logicType: undefined };
+	}
+}
+
+/**
+ * Read the local FurnitureData.json into a classname → flags map. Duplicate
+ * classnames are merged so a true flag in any entry wins (same rule as the
+ * app's `lookupRealFurniFlags`).
+ */
+function loadFurniFlags(path: string): Map<string, Flags> {
+	const map = new Map<string, Flags>();
+	if (!existsSync(path)) return map;
+	try {
+		const json = JSON.parse(readFileSync(path, "utf-8")) as Record<
+			string,
+			{ furnitype?: Array<Record<string, unknown>> }
+		>;
+		for (const section of ["roomitemtypes", "wallitemtypes"] as const) {
+			for (const item of json[section]?.furnitype ?? []) {
+				const cn = item.classname;
+				if (typeof cn !== "string" || !cn) continue;
+				const candidate: Flags = {
+					cansiton: !!item.cansiton,
+					canlayon: !!item.canlayon,
+					canstandon: !!item.canstandon,
+				};
+				const existing = map.get(cn);
+				if (!existing) {
+					map.set(cn, candidate);
+					continue;
+				}
+				existing.cansiton = existing.cansiton || candidate.cansiton;
+				existing.canlayon = existing.canlayon || candidate.canlayon;
+				existing.canstandon = existing.canstandon || candidate.canstandon;
+			}
+		}
+	} catch {
+		// unreadable furnidata → interaction columns are skipped
+	}
+	return map;
+}
+
+async function main(): Promise<void> {
+	const t0 = Date.now();
+	const dir = resolve(DIR);
+	const entries = new Set(readdirSync(dir));
+	const infoCache = new Map<string, BundleInfo>();
+	const flagsMap = WITH_INTERACTION
+		? loadFurniFlags(resolve(FURNIDATA))
+		: new Map<string, Flags>();
+
+	const [rows] = (await db.execute(
+		sql`SELECT item_name, public_name, width, length, stack_height, allow_stack,
+		           allow_sit, allow_lay, allow_walk, interaction_type, interaction_modes_count
+		    FROM items_base
+		    WHERE type IN (${sql.join(
+					TYPES.map((t) => sql`${t}`),
+					sql`, `,
+				)})`,
+	)) as unknown as [Row[], unknown];
+
+	console.log(
+		`[stack-sql] ${rows.length} furniture rows | ${entries.size} bundles | ${flagsMap.size} furnidata flags`,
+	);
+
+	const updates: string[] = [];
+	let matched = 0;
+	let changed = 0;
+	let resolvedBase = 0;
+	const counts = {
+		dims: 0,
+		allowFlags: 0,
+		modes: 0,
+		interactionType: 0,
+	};
+	const missing: string[] = [];
+	const unparsed: string[] = [];
+
+	for (const row of rows) {
+		const name = row.item_name;
+		const base = name.includes("*") ? name.slice(0, name.indexOf("*")) : name;
+		const variants = [name, name.trim(), base, base.trim()];
+
+		let chosen: string | null = null;
+		for (const variant of variants) {
+			for (const ext of EXTENSIONS) {
+				const candidate = `${variant}${ext}`;
+				if (entries.has(candidate)) {
+					chosen = candidate;
+					break;
+				}
+			}
+			if (chosen) break;
+		}
+		if (!chosen) {
+			missing.push(name);
+			continue;
+		}
+		if (!chosen.startsWith(`${name}.`)) resolvedBase++;
+
+		let info = infoCache.get(chosen);
+		if (!info) {
+			info = readBundleInfo(resolve(dir, chosen));
+			infoCache.set(chosen, info);
+		}
+		if (!info.dims) {
+			unparsed.push(`${name} (${chosen})`);
+			continue;
+		}
+		matched++;
+
+		const width = Math.trunc(info.dims.x);
+		const length = Math.trunc(info.dims.y);
+		const stackHeight = Number(info.dims.z.toFixed(2));
+		const allowStack = info.dims.z > 0;
+
+		const setParts: string[] = [];
+		const dimsChanged =
+			row.width !== width ||
+			row.length !== length ||
+			Number(row.stack_height) !== stackHeight ||
+			isTruthyBit(row.allow_stack) !== allowStack;
+		if (dimsChanged) counts.dims++;
+		setParts.push(
+			`width=${width}`,
+			`length=${length}`,
+			`stack_height=${stackHeight}`,
+			`allow_stack=${qbit(allowStack)}`,
+		);
+
+		// Interaction columns — only when the classname exists in furnidata
+		// (mirrors the app sweep: authoritative flags, never keyword guesses).
+		const flags =
+			flagsMap.get(name) ??
+			flagsMap.get(base) ??
+			flagsMap.get(name.trim()) ??
+			flagsMap.get(base.trim());
+		if (WITH_INTERACTION && flags) {
+			const auto = autoDetectInteraction(name, row.public_name || undefined, {
+				cansiton: flags.cansiton,
+				canlayon: flags.canlayon,
+				canstandon: flags.canstandon,
+				hasActionData: true,
+				animationStates: info.animationStates,
+				logicType: info.logicType,
+			});
+
+			if (
+				Number(row.allow_sit) !== 2 &&
+				isTruthyBit(row.allow_sit) !== auto.canSit
+			) {
+				setParts.push(`allow_sit=${qbit(auto.canSit)}`);
+				counts.allowFlags++;
+			}
+			if (
+				Number(row.allow_lay) !== 2 &&
+				isTruthyBit(row.allow_lay) !== auto.canLay
+			) {
+				setParts.push(`allow_lay=${qbit(auto.canLay)}`);
+				counts.allowFlags++;
+			}
+			if (
+				Number(row.allow_walk) !== 2 &&
+				isTruthyBit(row.allow_walk) !== auto.canStand
+			) {
+				setParts.push(`allow_walk=${qbit(auto.canStand)}`);
+				counts.allowFlags++;
+			}
+			if (
+				Number(row.interaction_modes_count ?? 0) !== auto.interactionModesCount
+			) {
+				setParts.push(`interaction_modes_count=${auto.interactionModesCount}`);
+				counts.modes++;
+			}
+			if (
+				(row.interaction_type === "default" || !row.interaction_type) &&
+				auto.interactionType !== "default"
+			) {
+				setParts.push(`interaction_type=${q(auto.interactionType)}`);
+				counts.interactionType++;
+			}
+		}
+
+		const isChanged =
+			dimsChanged ||
+			setParts.some(
+				(p) =>
+					!p.startsWith("width=") &&
+					!p.startsWith("length=") &&
+					!p.startsWith("stack_height=") &&
+					!p.startsWith("allow_stack="),
+			);
+		if (isChanged) changed++;
+		if (!EMIT_ALL && !isChanged) continue;
+
+		updates.push(
+			`UPDATE items_base SET ${setParts.join(", ")} WHERE item_name=${q(name)} AND type IN (${TYPES.map(q).join(", ")});`,
+		);
+	}
+
+	const header = [
+		"-- Auto-generated by scripts/generate-stack-height-sql.ts",
+		`-- Source bundles: ${dir}`,
+		`-- Furnidata:      ${WITH_INTERACTION ? resolve(FURNIDATA) : "(disabled)"}`,
+		`-- Generated: ${new Date().toISOString()}`,
+		`-- Furniture rows: ${rows.length} | matched: ${matched} | changed: ${changed} | missing bundle: ${missing.length} | unparsable: ${unparsed.length}`,
+		`-- Changes: dimensions ${counts.dims} | allow_sit/lay/walk ${counts.allowFlags} | modes_count ${counts.modes} | interaction_type ${counts.interactionType}`,
+		`-- Mode: ${EMIT_ALL ? "all matched rows" : "changed rows only"}`,
+		"",
+		"START TRANSACTION;",
+		"",
+	].join("\n");
+	const footer = "\n\nCOMMIT;\n";
+
+	writeFileSync(
+		resolve(OUT),
+		`${header}${updates.join("\n")}${footer}`,
+		"utf-8",
+	);
+
+	console.log(`[stack-sql] matched ${matched}, changed ${changed}`);
+	console.log(
+		`[stack-sql] changes -> dims ${counts.dims}, allow flags ${counts.allowFlags}, modes ${counts.modes}, interaction_type ${counts.interactionType}`,
+	);
+	if (resolvedBase > 0)
+		console.log(`[stack-sql] resolved via base classname: ${resolvedBase}`);
+	console.log(`[stack-sql] updates written: ${updates.length}`);
+	if (missing.length) {
+		console.log(
+			`[stack-sql] no bundle (${missing.length}): ${missing.slice(0, 20).join(", ")}${missing.length > 20 ? ", …" : ""}`,
+		);
+	}
+	if (unparsed.length) {
+		console.log(
+			`[stack-sql] unparsable (${unparsed.length}): ${unparsed.slice(0, 20).join(", ")}${unparsed.length > 20 ? ", …" : ""}`,
+		);
+	}
+	console.log(`[stack-sql] wrote ${resolve(OUT)} in ${Date.now() - t0}ms`);
+}
+
+main().catch((err) => {
+	console.error(err);
+	process.exit(1);
+});

scripts/jobs-worker.ts

@@ -1,9 +1,17 @@
-import { drainOperationEffects } from "../src/features/operations/worker";
-import { drainFurnitureImports } from "../src/lib/services/furni-job-worker";
+// Must stay the first import. ESM evaluates a module's imports in source
+// order, and `../src/features/operations/worker` reaches `@/env`, which parses
+// process.env at import time. With this import further down the tree, load-env
+// ran *after* the schema validation had already thrown on a missing
+// DATABASE_URL, so the worker could only ever start from an environment that
+// already exported the config — which is why `pnpm jobs:worker` died
+// immediately and nothing supervised it.
 import "./load-env";
+import * as nodeFs from "node:fs";
+import * as nodePath from "node:path";
 import { Cron } from "croner";
 import { lt, sql } from "drizzle-orm";
 import { env } from "../src/env";
+import { drainOperationEffects } from "../src/features/operations/worker";
 import { db, PasswordReset, WebsiteLoginLogs } from "../src/lib/db";
 import { logger } from "../src/lib/logger";
 import { redis } from "../src/lib/redis";
@@ -18,6 +26,7 @@ import {
 	diskLevel,
 	parseDfOutput,
 } from "../src/lib/services/disk-usage";
+import { drainFurnitureImports } from "../src/lib/services/furni-job-worker";
 import { publishDueArticles } from "../src/lib/services/news-scheduler";
 import { scheduledAutoCleanFakeNitros } from "../src/lib/services/nitro-cleanup";
 import { rcon } from "../src/lib/services/rcon";
@@ -161,13 +170,69 @@ async function checkDiskUsage(): Promise<void> {
 	}
 }
 
+/**
+ * Resolve the JAR to back up. `EMULATOR_JAR_PATH` may point at the file itself
+ * or at a directory of release JARs, because the emulator's own unit file
+ * launches `ls -t Polaris-*-jar-with-dependencies.jar` — a path pinned to one
+ * release filename goes stale on the next emulator upgrade, and a stale path
+ * fails as a bare ENOENT from copyFile that gives no hint what is wrong. A
+ * directory (or a path with a `*`) resolves to the most recently modified JAR,
+ * matching how the emulator actually picks its build.
+ */
+export function resolveEmulatorJar(
+	configuredPath: string,
+	fs: typeof import("node:fs") = nodeFs,
+	{ resolve }: typeof import("node:path") = nodePath,
+): string | null {
+	const { existsSync, readdirSync, statSync } = fs;
+	if (configuredPath.includes("*")) {
+		const dir = configuredPath.slice(0, configuredPath.lastIndexOf("/") + 1);
+		const pattern = configuredPath.slice(dir.length);
+		if (!existsSync(dir)) return null;
+		return (
+			readdirSync(dir)
+				.filter((name: string) => name.startsWith(pattern.split("*")[0] ?? ""))
+				.map((name: string) => resolve(dir, name))
+				.filter((path: string) => existsSync(path))
+				.sort(
+					(a: string, b: string) => statSync(b).mtimeMs - statSync(a).mtimeMs,
+				)[0] ?? null
+		);
+	}
+	if (existsSync(configuredPath) && statSync(configuredPath).isFile())
+		return configuredPath;
+	// A directory: take the newest JAR in it.
+	if (existsSync(configuredPath) && statSync(configuredPath).isDirectory()) {
+		return (
+			readdirSync(configuredPath)
+				.filter((name: string) => name.endsWith(".jar"))
+				.map((name: string) => resolve(configuredPath, name))
+				.sort(
+					(a: string, b: string) => statSync(b).mtimeMs - statSync(a).mtimeMs,
+				)[0] ?? null
+		);
+	}
+	return null;
+}
+
 async function backupEmulatorJar(): Promise<void> {
 	if (!env.EMULATOR_JAR_PATH || !env.EMULATOR_BACKUP_DIR) return;
 
-	const { copyFileSync, mkdirSync, readdirSync, unlinkSync, existsSync } =
-		await import("node:fs");
+	const fs = await import("node:fs");
+	const { copyFileSync, mkdirSync, readdirSync, unlinkSync, existsSync } = fs;
 	const { resolve } = await import("node:path");
 
+	const jarPath = resolveEmulatorJar(env.EMULATOR_JAR_PATH, fs, nodePath);
+	if (!jarPath) {
+		// Configured but unusable: say so once, loudly, instead of every night
+		// logging an opaque copyFile ENOENT that reads like a permissions bug.
+		logger.error(
+			"Emulator JAR backup skipped: EMULATOR_JAR_PATH does not resolve to a JAR",
+			{ module: "jobs", configured: env.EMULATOR_JAR_PATH },
+		);
+		return;
+	}
+
 	const timestamp = new Date().toISOString().slice(0, 19).replace(/[T:]/g, "-");
 	const backupFile = resolve(
 		env.EMULATOR_BACKUP_DIR,
@@ -179,10 +244,11 @@ async function backupEmulatorJar(): Promise<void> {
 	}
 
 	try {
-		copyFileSync(env.EMULATOR_JAR_PATH, backupFile);
+		copyFileSync(jarPath, backupFile);
 		logger.info("Backed up emulator JAR", {
 			module: "jobs",
 			backupFile,
+			source: jarPath,
 		});
 
 		const keep = env.EMULATOR_BACKUP_KEEP ?? 7;
@@ -464,6 +530,24 @@ async function main() {
 	logger.info("Scheduled: nitro auto-clean (daily 02:00)", {
 		module: "jobs",
 	});
+
+	new Cron("*/30 * * * *", () => {
+		// Purge the gamedata edge tag periodically as a safety net in case a
+		// single import failed to emit a purge (e.g. Cloudflare disabled at the
+		// moment of write). Without it, a long TTL on /gamedata/ would keep the
+		// client stuck on old FurnitureData.json until the browser or CDN cache
+		// expired. No-op when Cloudflare is not configured.
+		import("../src/lib/edge-cache")
+			.then(({ EDGE_CACHE_TAGS, purgeEdgeCache }) =>
+				purgeEdgeCache([EDGE_CACHE_TAGS.gamedata], "jobs-safety-net"),
+			)
+			.catch((e) =>
+				captureWorkerError(e, "Gamedata edge purge (safety net) failed"),
+			);
+	});
+	logger.info("Scheduled: gamedata edge purge safety net (every 30 min)", {
+		module: "jobs",
+	});
 	await Promise.all([
 		backupEmulatorJar(),
 		cleanupOldLogs(),

scripts/migrate-nitro-to-hab.ts

@@ -0,0 +1,303 @@
+#!/usr/bin/env tsx
+/**
+ * Rename on-disk furniture bundles from `.nitro` to `.hab`.
+ *
+ * Imports have written `<classname>.hab` since the bundle-extension switch, but
+ * everything already on disk kept its old name. That matters at runtime: the
+ * client asks for `.hab`, so a catalogue whose assets are still `.nitro` shows
+ * furniture that renders as nothing. This script closes that gap.
+ *
+ * It is deliberately conservative:
+ *   - refuses to run without `--dry-run` or `--yes`;
+ *   - never overwrites an existing `.hab` — a conflict is reported, not resolved;
+ *   - never deletes anything, so a half-finished run is recoverable by hand;
+ *   - idempotent: a second run over migrated dirs is a no-op.
+ *
+ * Run it in a maintenance window. The rename is per-file, so a client request
+ * for a given `.nitro` 404s from the moment that file is renamed until the
+ * client asks for `.hab`.
+ *
+ * Usage:
+ *   pnpm tsx scripts/migrate-nitro-to-hab.ts --dry-run
+ *   pnpm tsx scripts/migrate-nitro-to-hab.ts --yes
+ *   pnpm tsx scripts/migrate-nitro-to-hab.ts --yes --dir /var/www/extra/bundles
+ *   pnpm tsx scripts/migrate-nitro-to-hab.ts --yes --skip-generic
+ */
+
+import "./load-env";
+import { existsSync, promises as fs } from "node:fs";
+import path from "node:path";
+import { db } from "@/lib/db";
+import {
+	getFurniAssetWriteTargets,
+	getGamedataRoot,
+} from "@/lib/services/furni-asset-dirs";
+import { getPublicAssetRoot } from "@/lib/services/public-asset-root";
+import { siteSettings } from "@/lib/services/site-settings";
+import { getRuntimePath } from "@/lib/utils/runtime-path";
+
+const LEGACY_EXT = ".nitro";
+const TARGET_EXT = ".hab";
+
+interface Args {
+	dryRun: boolean;
+	yes: boolean;
+	skipGeneric: boolean;
+	dirs: string[];
+}
+
+function parseArgs(argv: string[]): Args {
+	const dirs: string[] = [];
+	let dryRun = false;
+	let yes = false;
+	let skipGeneric = false;
+	for (let i = 0; i < argv.length; i++) {
+		const arg = argv[i];
+		if (arg === "--dry-run") dryRun = true;
+		else if (arg === "--yes" || arg === "-y") yes = true;
+		else if (arg === "--skip-generic") skipGeneric = true;
+		else if (arg === "--dir") {
+			const value = argv[++i];
+			if (!value) throw Error("--dir needs a path");
+			dirs.push(path.resolve(value));
+		} else throw Error(`Unknown argument: ${arg}`);
+	}
+	return { dryRun, yes, skipGeneric, dirs };
+}
+
+/**
+ * Where the app keeps bundles. Mirrors the resolution in figure-import.ts /
+ * effect-import.ts / pet-import.ts so the script follows the same site settings
+ * the running instance uses. Settings are best-effort: a database that is down
+ * must not stop an operator from migrating files, so failures fall back to the
+ * on-disk defaults rather than aborting.
+ */
+async function resolveDirs(skipGeneric: boolean): Promise<string[]> {
+	const found: string[] = [];
+	const push = (dir: string | null | undefined) => {
+		if (dir?.trim()) found.push(path.resolve(dir.trim()));
+	};
+
+	// Furniture: primary + every configured mirror (gamedata, nitro-files).
+	try {
+		const targets = await getFurniAssetWriteTargets();
+		push(targets.nitroDir);
+		for (const mirror of targets.mirrorDirs) push(mirror.nitroDir);
+	} catch (error) {
+		console.warn(
+			`  ! could not read furniture asset settings (${(error as Error).message}); using defaults`,
+		);
+		push(
+			getRuntimePath(process.cwd(), "public/nitro-assets/bundled/furniture"),
+		);
+		push("/var/www/Gamedata/bundled/furniture");
+	}
+
+	let gamedataRoot = "";
+	try {
+		gamedataRoot = await getGamedataRoot();
+	} catch {
+		/* defaults below cover it */
+	}
+
+	for (const type of ["figure", "effect"]) {
+		let configured = "";
+		try {
+			configured = (
+				(await siteSettings.get(`${type}_nitro_dir`, "")) ?? ""
+			).trim();
+		} catch {
+			/* fall through to defaults */
+		}
+		if (configured) push(configured);
+		else if (gamedataRoot)
+			push(getRuntimePath(gamedataRoot, `bundled/${type}`));
+		else
+			push(
+				getRuntimePath(
+					getPublicAssetRoot(),
+					`public/nitro-assets/bundled/${type}`,
+				),
+			);
+	}
+
+	// Pets: the CMS dir is `pet`, this deployment's gamedata dir is `pets`.
+	// Both spellings are listed so neither is silently skipped.
+	push(getRuntimePath(getPublicAssetRoot(), "public/nitro-assets/bundled/pet"));
+	if (gamedataRoot) {
+		push(getRuntimePath(gamedataRoot, "bundled/pet"));
+		push(getRuntimePath(gamedataRoot, "bundled/pets"));
+	}
+
+	// `generic` holds the stock client UI bundles (selection_arrow, room,
+	// tile_cursor, place_holder…) that this CMS never imported. They are included
+	// by default because the renderer's `generic.asset.url` template resolves to
+	// `.hab` too — leaving them behind breaks the room view, not just furniture.
+	if (!skipGeneric && gamedataRoot) {
+		push(getRuntimePath(gamedataRoot, "bundled/generic"));
+	}
+
+	return [...new Set(found)];
+}
+
+interface DirResult {
+	dir: string;
+	renamed: number;
+	alreadyHab: number;
+	conflicts: Array<{ from: string; to: string }>;
+	errors: Array<{ file: string; message: string }>;
+}
+
+async function migrateDir(dir: string, dryRun: boolean): Promise<DirResult> {
+	const result: DirResult = {
+		dir,
+		renamed: 0,
+		alreadyHab: 0,
+		conflicts: [],
+		errors: [],
+	};
+
+	let entries: string[];
+	try {
+		entries = await fs.readdir(dir);
+	} catch (error) {
+		result.errors.push({ file: dir, message: (error as Error).message });
+		return result;
+	}
+
+	for (const entry of entries) {
+		if (!entry.toLowerCase().endsWith(LEGACY_EXT)) continue;
+		const from = path.join(dir, entry);
+		const to = path.join(
+			dir,
+			`${entry.slice(0, -LEGACY_EXT.length)}${TARGET_EXT}`,
+		);
+
+		// Never clobber. A pre-existing `.hab` is a live bundle the client is
+		// already serving; leaving the `.nitro` alone is the only safe answer.
+		if (existsSync(to)) {
+			result.conflicts.push({
+				from: path.basename(from),
+				to: path.basename(to),
+			});
+			continue;
+		}
+
+		if (dryRun) {
+			result.renamed++;
+			continue;
+		}
+		try {
+			await fs.rename(from, to);
+			result.renamed++;
+		} catch (error) {
+			result.errors.push({ file: entry, message: (error as Error).message });
+		}
+	}
+
+	// Report the target state too, so a run confirms the end condition rather
+	// than just the work it did.
+	for (const entry of await fs.readdir(dir)) {
+		if (entry.toLowerCase().endsWith(TARGET_EXT)) result.alreadyHab++;
+	}
+
+	return result;
+}
+
+async function main() {
+	const args = parseArgs(process.argv.slice(2));
+
+	if (!args.dryRun && !args.yes) {
+		console.error(
+			"Nothing to do: pass --dry-run to preview, or --yes to rename for real.",
+		);
+		process.exitCode = 2;
+	}
+
+	const dirs = [
+		...new Set([...args.dirs, ...(await resolveDirs(args.skipGeneric))]),
+	];
+	const existing = dirs.filter((dir) => existsSync(dir));
+
+	console.log(
+		args.dryRun
+			? "DRY RUN — no files will be touched."
+			: "Renaming .nitro bundles to .hab.",
+	);
+	if (!args.dryRun) {
+		console.log(
+			"Run this in a maintenance window: the client 404s on each file between its rename and its switch to .hab.",
+		);
+	}
+	console.log(`\nDirectories (${existing.length} of ${dirs.length} exist):`);
+	for (const dir of existing) console.log(`  ${dir}`);
+	const missing = dirs.filter((dir) => !existsSync(dir));
+	if (missing.length) {
+		console.log(`\nNot present, skipped:`);
+		for (const dir of missing) console.log(`  ${dir}`);
+	}
+	if (!existing.length) {
+		console.log("\nNo bundle directories found — nothing to migrate.");
+		return;
+	}
+
+	console.log("");
+	const results: DirResult[] = [];
+	for (const dir of existing) {
+		results.push(await migrateDir(dir, args.dryRun));
+	}
+
+	let totalRenamed = 0;
+	let totalHab = 0;
+	let totalConflicts = 0;
+	let totalErrors = 0;
+	for (const result of results) {
+		totalRenamed += result.renamed;
+		totalHab += result.alreadyHab;
+		totalConflicts += result.conflicts.length;
+		totalErrors += result.errors.length;
+		console.log(
+			`${result.dir}\n` +
+				`    ${args.dryRun ? "would rename" : "renamed"}: ${result.renamed}\n` +
+				`    .hab present:   ${result.alreadyHab}`,
+		);
+		for (const conflict of result.conflicts) {
+			console.log(
+				`    CONFLICT: ${conflict.from} — ${conflict.to} already exists`,
+			);
+		}
+		for (const error of result.errors) {
+			console.log(`    ERROR: ${error.file} — ${error.message}`);
+		}
+	}
+
+	console.log(
+		`\n${args.dryRun ? "Would rename" : "Renamed"} ${totalRenamed} file(s). ` +
+			`${totalHab} .hab bundle(s) present afterwards.`,
+	);
+	if (totalConflicts) {
+		console.log(
+			`\n${totalConflicts} conflict(s): a .hab with that name already exists. ` +
+				"The .nitro was left in place. Resolve these by hand — the client can only load one of the two.",
+		);
+	}
+	if (totalErrors)
+		console.log(`\n${totalErrors} error(s); re-run once they are fixed.`);
+
+	// Non-zero on a partial migration so a wrapper cannot report success.
+	if (totalConflicts || totalErrors) process.exitCode = 1;
+}
+
+// The settings lookups open a mysql2 pool, which keeps the event loop alive —
+// the script prints its whole report and then sits there burning a timeout
+// instead of exiting. Closing the pool is not enough on its own here, so the
+// exit is explicit, matching scripts/furni-diagnose-now.ts.
+main()
+	.catch((error) => {
+		console.error(error);
+		process.exitCode = 1;
+	})
+	.then(async () => {
+		await db.$client.end().catch(() => {});
+		process.exit(process.exitCode ?? 0);
+	});

scripts/nginx-sync.sh

@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+# Sync the nginx config from this repository to /etc/nginx and reload it.
+#
+# Background: on 2026-09-26 /etc/nginx and /var/log/nginx disappeared from the
+# host while nginx kept serving its in-memory config; any restart would have
+# taken the CMS down. This script makes the repo the source of truth so that
+# cannot happen again. It is idempotent and only reloads nginx when the config
+# actually changed.
+#
+# Usage:
+#   sudo scripts/nginx-sync.sh            # install + test + reload if changed
+#   sudo scripts/nginx-sync.sh --force    # always reload after a passing test
+#   scripts/nginx-sync.sh --check         # just diff repo vs live, no writes
+#
+# Files installed (see also deployment/proxy/):
+#   nginx.conf                                -> /etc/nginx/nginx.conf
+#   nginx-mime.types                          -> /etc/nginx/mime.types
+#   nginx-cms.conf                            -> /etc/nginx/sites-available/cms.conf
+#   cloudflare-ips.conf                       -> /etc/nginx/conf.d/cloudflare-ips.conf
+#   cms_upstream_servers.conf                 -> /etc/nginx/snippets/cms_upstream_servers.conf
+#   (seed alleen als het bestand ontbreekt; zodra het bestaat is het runtime
+#    eigendom van scripts/ci-deploy.sh en wordt het hier nooit overschreven)
+#   symlink sites-enabled/cms.conf            -> ../sites-available/cms.conf
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROXY_DIR="$SCRIPT_DIR/../deployment/proxy"
+NGINX_DIR=/etc/nginx
+BACKUP_DIR="/var/backups/nginx-$(date +%Y%m%d-%H%M%S)"
+MODE="sync"
+
+for arg in "$@"; do
+  case "$arg" in
+    --force) MODE="force" ;;
+    --check) MODE="check" ;;
+  esac
+done
+
+install_file() {
+  local src="$1" dst="$2"
+  if [[ ! -f "$src" ]]; then
+    echo "error: $src not found in repo" >&2
+    exit 1
+  fi
+  if [[ -f "$dst" ]] && cmp -s "$src" "$dst"; then
+    echo "= $dst up to date"
+    return 1
+  fi
+  if [[ "$MODE" == "check" ]]; then
+    echo "- $dst differs from repo"
+    return 0
+  fi
+  mkdir -p "$(dirname "$dst")"
+  if [[ -f "$dst" ]]; then
+    mkdir -p "$BACKUP_DIR"
+    cp -a "$dst" "$BACKUP_DIR/"
+  fi
+  cp -a "$src" "$dst"
+  echo "+ installed $dst"
+  return 0
+}
+
+if [[ "$MODE" != "check" && "$(id -u)" -ne 0 ]]; then
+  echo "error: run as root (sudo scripts/nginx-sync.sh)" >&2
+  exit 1
+fi
+
+changed=0
+if install_file "$PROXY_DIR/nginx.conf" "$NGINX_DIR/nginx.conf"; then changed=1; fi
+if install_file "$PROXY_DIR/nginx-mime.types" "$NGINX_DIR/mime.types"; then changed=1; fi
+if install_file "$PROXY_DIR/nginx-cms.conf" "$NGINX_DIR/sites-available/cms.conf"; then changed=1; fi
+if install_file "$PROXY_DIR/cloudflare-ips.conf" "$NGINX_DIR/conf.d/cloudflare-ips.conf"; then changed=1; fi
+# De upstream-snippet is runtime-eigendom van ci-deploy.sh (blue/green): alleen
+# aanmaken op een verse host, nooit overschrijven wat een deploy heeft gezet.
+if [[ -f "$NGINX_DIR/snippets/cms_upstream_servers.conf" ]]; then
+  echo "= $NGINX_DIR/snippets/cms_upstream_servers.conf managed by ci-deploy.sh (untouched)"
+else
+  if install_file "$PROXY_DIR/cms_upstream_servers.conf" "$NGINX_DIR/snippets/cms_upstream_servers.conf"; then changed=1; fi
+fi
+
+if [[ ! -f "$NGINX_DIR/sites-enabled/cms.conf" ]]; then
+  if [[ "$MODE" == "check" ]]; then
+    echo "- sites-enabled/cms.conf missing"
+    changed=1
+  else
+    ln -sf ../sites-available/cms.conf "$NGINX_DIR/sites-enabled/cms.conf"
+    echo "+ linked sites-enabled/cms.conf"
+    changed=1
+  fi
+fi
+
+if [[ "$MODE" == "check" ]]; then
+  [[ "$changed" -eq 0 ]]
+  exit
+fi
+
+if [[ "$MODE" == "force" ]]; then
+  changed=1
+fi
+
+if [[ ! -d /var/log/nginx ]]; then
+  install -d -o root -g adm -m 750 /var/log/nginx
+fi
+# nginx-cms.conf sets `root /var/www/html` so that disk-backed locations
+# (favicon.ico) resolve somewhere the www-data worker can actually traverse.
+# The previous implicit root was /etc/nginx/html, which sits behind /etc/nginx
+# (0750 root:root): the worker got EACCES on every stat, and nginx logs a
+# failed stat at crit, so each crawler probe wrote a crit line.
+if [[ ! -d /var/www/html ]]; then
+  install -d -o root -g root -m 755 /var/www/html
+  echo "+ created /var/www/html (document root)"
+fi
+for f in /var/log/nginx/access.log /var/log/nginx/error.log; do
+  [[ -f "$f" ]] || touch "$f"
+done
+
+echo "--- nginx -t ---"
+nginx -t
+
+if [[ "$changed" -eq 1 ]]; then
+  echo "--- reloading nginx ---"
+  nginx -s reload
+else
+  echo "no changes; nginx reload skipped"
+fi
+
+echo "--- health check ---"
+curl -sf "http://127.0.0.1:3002/api/health" > /dev/null && echo "OK: CMS reachable"
+curl -skf -o /dev/null -H "Host: epicnabbo.nl" "https://127.0.0.1:9443/health" && echo "OK: nginx :9443 /health"

scripts/performance-report.mjs

@@ -79,6 +79,27 @@ function filesFrom(values) {
 	return values.map(normalizeAsset);
 }
 
+/**
+ * Webpack interleaves numeric chunk ids with file names in `chunks` arrays, so
+ * a real file has to be separated from its id. An id is rejected by
+ * normalizeAsset for the right reason (it has no `static/` prefix and no `.js`
+ * suffix), which makes it a usable filter — but only for ids. A malformed
+ * *path* must still fail loudly rather than be silently dropped, or a broken
+ * manifest would quietly under-report a route's real weight.
+ */
+function assetFilesFromChunkList(values) {
+	if (!Array.isArray(values))
+		throw new Error("Unsupported JavaScript chunk list.");
+	const files = [];
+	for (const value of values) {
+		if (typeof value !== "string")
+			throw new Error("Non-string JavaScript asset.");
+		if (/^\d+$/.test(value)) continue;
+		files.push(normalizeAsset(value));
+	}
+	return files;
+}
+
 export function measureRoute({
 	budget,
 	appPath,
@@ -86,18 +107,44 @@ export function measureRoute({
 	clientManifest,
 	readAsset,
 }) {
+	// Turbopack emits an explicit per-segment `entryJSFiles` list. Webpack does
+	// not — it only records chunks per client module — so after the build moved
+	// to webpack (3d828a61) every route reported "unavailable" and the report
+	// silently stopped measuring anything. Fall back to the same source Next's
+	// own `static-routes-info` uses for webpack builds.
 	const entries = clientManifest?.entryJSFiles;
-	if (!entries || typeof entries !== "object" || Array.isArray(entries))
+	const webpackModules = clientManifest?.clientModules;
+	let filesBySource;
+	let webpackLayout = false;
+	if (entries && typeof entries === "object" && !Array.isArray(entries)) {
+		const sourceEntries = Object.keys(entries);
+		if (
+			!sourceEntries.some((key) =>
+				key.replaceAll("\\", "/").endsWith(`/app${appPath}`),
+			)
+		)
+			throw new Error("Route page entry is absent from entryJSFiles.");
+		filesBySource = Object.entries(entries);
+	} else if (webpackModules && typeof webpackModules === "object") {
+		webpackLayout = true;
+		// Each `chunks` array is `[chunkId, fileName, chunkId, fileName, ...]`.
+		filesBySource = [];
+		for (const node of Object.values(webpackModules)) {
+			if (!Array.isArray(node?.chunks) || node.chunks.length === 0) continue;
+			// One shared origin label instead of the module path: the per-chunk
+			// `sources` list is written into report.json, and webpack records
+			// absolute node_modules paths for every client module on the route.
+			filesBySource.push(["client-module", node.chunks]);
+		}
+		if (filesBySource.length === 0)
+			throw new Error(
+				"Neither entryJSFiles nor clientModules chunk data is available; this manifest layout is not supported.",
+			);
+	} else {
 		throw new Error(
 			"entryJSFiles is unavailable; this manifest layout is not supported.",
 		);
-	const sourceEntries = Object.keys(entries);
-	if (
-		!sourceEntries.some((key) =>
-			key.replaceAll("\\", "/").endsWith(`/app${appPath}`),
-		)
-	)
-		throw new Error("Route page entry is absent from entryJSFiles.");
+	}
 	const bootstrap = filesFrom(
 		buildManifest.rootMainFilesTree?.[appPath] ?? buildManifest.rootMainFiles,
 	);
@@ -110,8 +157,9 @@ export function measureRoute({
 		origins.set(file, sources);
 	};
 	for (const file of bootstrap) add(file, "bootstrap");
-	for (const [entry, values] of Object.entries(entries))
-		for (const file of filesFrom(values)) add(file, entry);
+	const readChunkList = webpackLayout ? assetFilesFromChunkList : filesFrom;
+	for (const [entry, values] of filesBySource)
+		for (const file of readChunkList(values)) add(file, entry);
 	const size = (file, sources) => {
 		const bytes = readAsset(file);
 		return {
@@ -248,12 +296,13 @@ export function collectReport(nextDir, config, metadata = {}) {
 			"Optional PERFORMANCE_COMMIT_SHA supplied by the build caller; not inferred from current checkout.",
 		nodeVersion: process.version,
 		zlibVersion: process.versions.zlib,
-		manifestFormat: "Next App Router client-reference entryJSFiles",
+		manifestFormat:
+			"Turbopack: client-reference entryJSFiles. Webpack: deduplicated clientModules[*].chunks.",
 		definition:
-			"Initial entry envelope: deduplicated rootMainFiles bootstrap plus all entryJSFiles in this route's client-reference manifest, including boundary/loading entries. This is emitted file size, not measured browser traffic or a load-time benchmark.",
+			"Initial entry envelope: deduplicated rootMainFiles bootstrap plus every client chunk this route's client-reference manifest lists, including boundary/loading entries. Turbopack exposes these as entryJSFiles; webpack exposes them only through clientModules[*].chunks, so the same envelope is derived from whichever the build emitted. This is emitted file size, not measured browser traffic or a load-time benchmark.",
 		gzip: "Sum of each unique JavaScript file independently compressed with Node gzip level 9. Excludes HTTP headers and shared-cache reuse.",
 		excluded:
-			"CSS, source maps, images, RSC/HTML payloads, external scripts, async-only chunks absent from entryJSFiles; legacy nomodule polyfills are reported separately.",
+			"CSS, source maps, images, RSC/HTML payloads, external scripts, async-only chunks absent from the manifest's chunk lists; legacy nomodule polyfills are reported separately.",
 		routes,
 	};
 }

scripts/performance-report.test.mjs

@@ -216,6 +216,135 @@ describe("route JS measurement", () => {
 		);
 		expect(collectReport(dir, config).routes[0].status).toBe("unavailable");
 	});
+	// The regression: after the build moved to webpack (3d828a61) the manifest
+	// has no entryJSFiles, only clientModules[*].chunks. Every route then
+	// reported "unavailable" and the report measured nothing at all while still
+	// exiting zero, so the budgets silently stopped being enforced.
+	describe("webpack manifests without entryJSFiles", () => {
+		const webpackManifest = {
+			clientModules: {
+				"[project]/src/components/header.tsx": {
+					chunks: [
+						"4269",
+						"static/chunks/4269-shared.js?dpl=abc",
+						"6726",
+						"static/chunks/header-entry.js?dpl=abc",
+					],
+				},
+				"[project]/src/app/(site)/news/page.tsx": {
+					chunks: [
+						"4269",
+						"static/chunks/4269-shared.js?dpl=abc",
+						"7777",
+						"/_next/static/chunks/page.js?dpl=abc",
+					],
+				},
+				// Async-only modules are recorded with an empty chunk list.
+				"[project]/src/components/lazy.tsx": { chunks: [] },
+			},
+		};
+		const webpackFiles = {
+			// buildManifest.rootMainFiles lists runtime.js and shared.js, so both
+			// bootstrap assets must exist or the read fails.
+			"static/chunks/runtime.js": Buffer.from("const runtime = true;"),
+			"static/chunks/shared.js": Buffer.from("bootstrap".repeat(10)),
+			"static/chunks/4269-shared.js": Buffer.from("shared".repeat(50)),
+			"static/chunks/header-entry.js": Buffer.from("header"),
+			"static/chunks/page.js": Buffer.from("page"),
+			"static/chunks/polyfill.js": Buffer.from("legacy"),
+		};
+		const measure = () =>
+			measureRoute({
+				budget,
+				appPath,
+				buildManifest,
+				clientManifest: webpackManifest,
+				readAsset: (file) => webpackFiles[file],
+			});
+
+		it("derives the envelope from clientModules and ignores chunk ids", () => {
+			const row = measure();
+			expect(row.status).toBe("measured");
+			// 2 bootstrap + shared + header-entry + page; the numeric chunk ids
+			// are not assets and must not throw or be counted.
+			expect(row.initial.chunkCount).toBe(5);
+			expect(row.initial.chunks.map((f) => f.path).sort()).toEqual([
+				"static/chunks/4269-shared.js",
+				"static/chunks/header-entry.js",
+				"static/chunks/page.js",
+				"static/chunks/runtime.js",
+				"static/chunks/shared.js",
+			]);
+			// Same bytes as the Turbopack fixture would produce for these files.
+			expect(row.initial.rawBytes).toBe(
+				Object.values(webpackFiles)
+					.filter((b) => !b.includes("legacy"))
+					.reduce((n, b) => n + b.length, 0),
+			);
+		});
+
+		it("counts a chunk reached by several client modules only once", () => {
+			const shared = measure().initial.chunks.find(
+				(f) => f.path === "static/chunks/4269-shared.js",
+			);
+			expect(shared).toBeDefined();
+			expect(measure().initial.chunkCount).toBe(5);
+		});
+
+		it("does not leak absolute module paths into the report", () => {
+			const sources = new Set(
+				measure().initial.chunks.flatMap((chunk) => chunk.sources),
+			);
+			// Only the two known origin labels; no node_modules path may appear.
+			expect([...sources].sort()).toEqual(["bootstrap", "client-module"]);
+		});
+
+		it("still fails rather than under-reporting a malformed chunk path", () => {
+			expect(() =>
+				measureRoute({
+					budget,
+					appPath,
+					buildManifest,
+					clientManifest: {
+						clientModules: {
+							x: { chunks: ["static/chunks/../../etc/passwd"] },
+						},
+					},
+					readAsset: (file) => webpackFiles[file],
+				}),
+			).toThrow("Unsupported JavaScript asset");
+		});
+
+		it("reports unavailable when webpack recorded no chunks at all", () => {
+			expect(() =>
+				measureRoute({
+					budget,
+					appPath,
+					buildManifest,
+					clientManifest: { clientModules: { x: { chunks: [] } } },
+					readAsset: (file) => webpackFiles[file],
+				}),
+			).toThrow("Neither entryJSFiles nor clientModules");
+		});
+
+		it("prefers entryJSFiles when a manifest carries both", () => {
+			// A future Next version could emit both; the explicit list wins
+			// because it is per-segment and therefore the tighter envelope.
+			const row = measureRoute({
+				budget,
+				appPath,
+				buildManifest,
+				clientManifest: {
+					...webpackManifest,
+					entryJSFiles: {
+						"[project]/src/app/(site)/news/page": ["static/chunks/page.js"],
+					},
+				},
+				readAsset: (file) => webpackFiles[file],
+			});
+			expect(row.initial.chunkCount).toBe(3);
+		});
+	});
 	it("does not deduplicate shared files across independent cold route totals", () => {
 		const row = measureRoute({
 			budget,

scripts/proxy-config.test.mjs

@@ -3,7 +3,6 @@ import {
 	copyFileSync,
 	mkdirSync,
 	mkdtempSync,
-	readFileSync,
 	rmSync,
 	writeFileSync,
 } from "node:fs";
@@ -85,93 +84,3 @@ it.skipIf(!hasCompose)(
 	},
 	30_000,
 );
-
-it("documents the local CrowdSec switches in .env.example", () => {
-	const examples = readFileSync(path.join(root, ".env.example"), "utf8");
-	for (const key of [
-		"CROWDSEC_LOCAL_ENABLED",
-		"CROWDSEC_LAPI_URL",
-		"CROWDSEC_LAPI_PORT",
-		"CROWDSEC_LAPI_API_KEY",
-		"CROWDSEC_NGINX_LOG_DIR",
-	]) {
-		expect(examples).toContain(key);
-	}
-});
-
-it.skipIf(!hasCompose)(
-	"renders the standalone CrowdSec stack with a loopback-only LAPI",
-	() => {
-		const directory = mkdtempSync(path.join(tmpdir(), "cms-crowdsec-"));
-		try {
-			mkdirSync(path.join(directory, "deployment/crowdsec/acquis.d"), {
-				recursive: true,
-			});
-			copyFileSync(
-				path.join(root, "deployment/crowdsec/compose.crowdsec.yml"),
-				path.join(directory, "deployment/crowdsec/compose.crowdsec.yml"),
-			);
-			copyFileSync(
-				path.join(root, "deployment/crowdsec/acquis.d/nginx.yaml"),
-				path.join(directory, "deployment/crowdsec/acquis.d/nginx.yaml"),
-			);
-			writeFileSync(
-				path.join(directory, ".env"),
-				[
-					"CROWDSEC_LAPI_API_KEY=fixture-key",
-					"CROWDSEC_LAPI_PORT=18080",
-					"CROWDSEC_LAPI_URL=http://127.0.0.1:18080",
-					"CROWDSEC_NGINX_LOG_DIR=/var/log/nginx",
-				].join("\n"),
-			);
-			const environment = { ...process.env };
-			for (const key of Object.keys(environment))
-				if (
-					key.startsWith("COMPOSE_") ||
-					key.startsWith("CROWDSEC_") ||
-					key.startsWith("TZ")
-				)
-					delete environment[key];
-			const result = spawnSync(
-				"docker",
-				[
-					"compose",
-					"--project-name",
-					"crowdsec-fixture",
-					"--env-file",
-					".env",
-					"-f",
-					"deployment/crowdsec/compose.crowdsec.yml",
-					"--profile",
-					"security",
-					"config",
-					"--format",
-					"json",
-				],
-				{ cwd: directory, env: environment, encoding: "utf8", timeout: 15_000 },
-			);
-			expect(result.status, result.stderr).toBe(0);
-			const config = JSON.parse(result.stdout);
-			const service = config.services.crowdsec;
-			expect(service).toBeDefined();
-			expect(service.image).toContain("crowdsecurity/crowdsec:");
-			expect(service.environment.BOUNCER_KEY_cms).toBe("fixture-key");
-			expect(service.environment.DISABLE_ONLINE_API).toBe("true");
-			expect(
-				service.ports.some(
-					(published) =>
-						published.host_ip === "127.0.0.1" &&
-						published.published === "18080" &&
-						published.target === 8080,
-				),
-			).toBe(true);
-			const targets = service.volumes.map((volume) => volume.target);
-			expect(targets).toContain("/var/log/nginx");
-			expect(targets).toContain("/etc/crowdsec/acquis.d");
-			expect(service.healthcheck.test.join(" ")).toContain("wget");
-		} finally {
-			rmSync(directory, { recursive: true, force: true });
-		}
-	},
-	30_000,
-);

scripts/setup-cron.sh

@@ -1,10 +1,35 @@
 #!/usr/bin/env bash
 # Setup cron jobs for maintenance
+#
+# Appends to the existing crontab. `crontab -` replaces the whole file, so a
+# script that pipes one job at a time silently drops every other scheduled job.
+# Entries are matched by their command, so re-running this is idempotent.
+set -Eeuo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
+# Adds one schedule line to the crontab unless its command is already present.
+add_job() {
+	local schedule="$1" command
+	command="${schedule##* }"
+	local current
+	current="$(crontab -l 2>/dev/null || true)"
+	if grep -Fq "$command" <<<"$current"; then
+		echo "Already scheduled: $command"
+		return
+	fi
+	if [[ -z "$current" ]]; then
+		printf '%s\n' "$schedule" | crontab -
+	else
+		printf '%s\n%s\n' "$current" "$schedule" | crontab -
+	fi
+	echo "Scheduled: $schedule"
+}
+
 # Run backup every day at 03:00
-echo "0 3 * * * $SCRIPT_DIR/backup.sh" | crontab -
-# Run prune every Sunday at 04:00
-echo "0 4 * * 0 $SCRIPT_DIR/docker-prune.sh" | crontab -
+add_job "0 3 * * * $SCRIPT_DIR/backup.sh"
+# Run prune every day at 04:00. Daily rather than weekly: byparr leaks roughly
+# 1.7 GB/day of orphaned browser profiles into its writable layer, so a weekly
+# run would let ~12 GB accumulate before anything reclaimed it.
+add_job "0 4 * * * $SCRIPT_DIR/docker-prune.sh"
 
 echo "Cron jobs configured."

scripts/with-memory-cap.sh

@@ -0,0 +1,178 @@
+#!/usr/bin/env bash
+# Voer een zwaar commando uit onder een harde geheugenplafond.
+#
+# Waarom dit bestaat:
+#   De host draait met `vm.overcommit_memory=0` en ZONDER swap. Vraagt een
+#   proces meer geheugen dan er vrij is, dan geeft de kernel niets weg en
+#   roept hij meteen de OOM-killer aan. Die kiest zijn slachtoffer over de
+#   héle machine, niet alleen in het schuldige proces — dus een build kan de
+#   database, nginx of de live release meenemen.
+#
+#   `next build` op Turbopack groeit op dit 329-route app voorbij 12GB RSS
+#   en is ook met 4GB swap nog steeds dood. Zie commit 3d828a61.
+#
+# Wat dit doet:
+#   Het commando komt in zijn eigen cgroup met `MemoryMax`. Als het door die
+#   grens heen groeit krijgt alleen die cgroup een OOM-signaal: het commando
+#   zelf sterft, de rest van de machine leeft. Dat is precies het gedrag dat
+#   je wilt — de build faalt, de site blijft staan.
+#
+#   Met `--max-old-space-size` lukt dat niet. Die limiet zit op de V8-heap en
+#   Turbopack-geheugen is native Rust-geheugen; met een 2GB cap piekte de RSS
+#   alsnog op 8GB. Zie het commentaar in de Dockerfile.
+#
+# Backends:
+#
+#   systemd (cgroup MemoryMax)
+#     Meet RSS over de héle procesboom. Dit is de echte garantie en wordt
+#     overal gebruikt waar systemd beschikbaar is (de host waar deze
+#     CMS draait). De RSS-plafonds in package.json zijn hierop gekozen:
+#     `next build` piekte op 6,5GB, dus 10GB laat ruimte over terwijl er
+#     6GB basislast naast blijft passen binnen de 23,5GB van deze machine.
+#
+#   ulimit -v (per proces, virtuele adresruimte)
+#     Alleen als expliciet gevraagd. Meet virtuele adresruimte, NIET RSS, en
+#     kan de boom helemaal niet begrenzen: elke worker krijgt z'n eigen
+#     limiet. Op moderne V8 is het bovendien een vergiftigde gift: `-v 10g`
+#     laat V8 de heaplimiet terugbrengen naar 2,25GB (webpack sterft met
+#     std::bad_alloc), en `-v 20g` laat de v8-wasm-memory-toewijzing falen
+#     tijdens `next build`. Zet CMS_MEMORY_CAP_VIRTUAL ruim boven de fysieke
+#     RAM als je het echt wilt gebruiken.
+#
+#   Geen van beide -> weigeren. Stil onbegrensd doorlopen zou precies de
+#   valse geruststelling zijn waar 3d828a61 voor waarschuwt. Omgevingen
+#   zonder systemd (de Docker-build, de GitLab-runner) kiezen daarom
+#   expliciet voor CMS_MEMORY_CAP_BACKEND=none — met een waarschuwing,
+#   en met als rechtvaardiging dat die builds al begrensd zijn door
+#   `next build --webpack` + `--max-old-space-size` en in hun eigen
+#   geïsoleerde container draaien, niet op de host.
+#
+# Markering:
+#   Elke backend zet `CMS_MEMORY_CAPPED=1` voordat het commando start.
+#   `next.config.ts` weigert een productie-build zonder die markering, zodat
+#   een handmatig `npx next build` (of een IDE/agent die de build zelf
+#   start) niet meer onbeperkt geheugen kan vragen en de hele host mee
+#   neemt. `CMS_MEMORY_CAP_BACKEND=none` telt mee: die omgevingen draaien
+#   al in een eigen, geïsoleerde container.
+#
+# Gebruik: bash scripts/with-memory-cap.sh 10g <command...>
+# Backend kiezen: CMS_MEMORY_CAP_BACKEND=systemd|ulimit|none|auto
+# ulimit-waarde kiezen: CMS_MEMORY_CAP_VIRTUAL=40g
+set -Eeuo pipefail
+
+usage() {
+	echo "gebruik: $0 <plafond, bv. 10g> <command...>" >&2
+	exit 64
+}
+
+[ "$#" -ge 2 ] || usage
+cap="$1"
+shift
+
+# Zet 10g / 512m / 2G / 1234567 om in bytes. Alleen bytes gaan naar
+# systemd: MemoryMax accepteert `10G` maar weigert `10g`, en die
+# hoofdletterval is te makkelijk om per ongeluk te treffen.
+to_bytes() {
+	local value="$1" number suffix
+	if [[ "$value" =~ ^([0-9]+)([kKmMgGtT]?)$ ]]; then
+		number="${BASH_REMATCH[1]}"
+		suffix="${BASH_REMATCH[2]}"
+	else
+		echo "onbekend plafond-formaat: $value" >&2
+		return 1
+	fi
+	case "$suffix" in
+	k | K) echo $((number * 1024)) ;;
+	m | M) echo $((number * 1024 * 1024)) ;;
+	g | G) echo $((number * 1024 * 1024 * 1024)) ;;
+	t | T) echo $((number * 1024 * 1024 * 1024 * 1024)) ;;
+	*) echo "$number" ;;
+	esac
+}
+
+bytes="$(to_bytes "$cap")" || exit 64
+kilobytes=$((bytes / 1024))
+
+# De virtuele waarde voor ulimit -v. Bewust los van `cap`: zie de toelichting
+# hierboven, 10g -v breekt de webpack-build.
+virtual_bytes="$(to_bytes "${CMS_MEMORY_CAP_VIRTUAL:-40g}")" || exit 64
+virtual_kb=$((virtual_bytes / 1024))
+
+backend="${CMS_MEMORY_CAP_BACKEND:-auto}"
+systemd_cmd=()
+
+# Vanaf hier is dit script de enige plek waar een zwaar commando nog mag
+# starten. De markering maakt dat afdwingbaar in next.config.ts.
+export CMS_MEMORY_CAPPED=1
+
+# Echt proberen, niet alleen uitzoeken of het bestand bestaat: `systemd-run`
+# zonder rechten faalt met "Access denied", en dat moet dan een nette
+# terugval naar ulimit worden in plaats van een kapotte build.
+probe_systemd() {
+	command -v systemd-run >/dev/null 2>&1 || return 1
+	[ -d /run/systemd/system ] || return 1
+	if systemd-run --scope --quiet true 2>/dev/null; then
+		systemd_cmd=(systemd-run --scope --quiet)
+		return 0
+	fi
+	if systemd-run --user --scope --quiet true 2>/dev/null; then
+		systemd_cmd=(systemd-run --user --scope --quiet)
+		return 0
+	fi
+	return 1
+}
+
+run_systemd() {
+	echo "[mem-cap] systemd cgroup MemoryMax=$((bytes / 1024 / 1024 / 1024))GB: $*" >&2
+	exec "${systemd_cmd[@]}" -p "MemoryMax=$bytes" "$@"
+}
+
+run_ulimit() {
+	echo "[mem-cap] ulimit -v ${virtual_kb}KB per proces (geen systemd; RSS-plafond ${cap} niet meetbaar zonder cgroup): $*" >&2
+	if [ "$virtual_bytes" -lt $((16 * 1024 * 1024 * 1024)) ]; then
+		echo "[mem-cap] let op: -v onder 16g verlaagt V8's heaplimiet en breekt de build; verhoog CMS_MEMORY_CAP_VIRTUAL" >&2
+	fi
+	ulimit -v "$virtual_kb" || {
+		echo "[mem-cap] ulimit -v $virtual_kb werd geweigerd" >&2
+		return 1
+	}
+	exec "$@"
+}
+
+run_refuse() {
+	echo "[mem-cap] geen systemd hier; weiger onbegrensd te draaien." >&2
+	echo "[mem-cap] zet CMS_MEMORY_CAP_BACKEND=none om dit bewust te accepteren, of =ulimit voor een per-proces vangnet." >&2
+	return 1
+}
+
+run_opted_out() {
+	echo "[mem-cap] WAARSCHUWING: plafond bewust uitgeschakeld, dit commando kan de machine laten OOM-killed worden: $*" >&2
+	exec "$@"
+}
+
+case "$backend" in
+systemd)
+	probe_systemd || {
+		echo "[mem-cap] CMS_MEMORY_CAP_BACKEND=systemd maar systemd-run reageert niet" >&2
+		exit 70
+	}
+	run_systemd "$@"
+	;;
+ulimit)
+	run_ulimit "$@"
+	;;
+none | off)
+	run_opted_out "$@"
+	;;
+auto)
+	if probe_systemd; then
+		run_systemd "$@"
+	else
+		run_refuse "$@"
+	fi
+	;;
+*)
+	echo "[mem-cap] onbekende backend: $backend" >&2
+	exit 64
+	;;
+esac

src/actions/admin-antiddos.ts

@@ -15,14 +15,6 @@ import {
 	setLastCloudflareVerify,
 	verifyCloudflareConnection,
 } from "@/lib/cloudflare-api";
-import {
-	setLastCrowdsecVerify,
-	verifyCrowdsecConnection,
-} from "@/lib/crowdsec-api";
-import {
-	setLastCrowdsecReport,
-	verifyCrowdsecReporting,
-} from "@/lib/crowdsec-report";
 import { db, WebsiteSetting } from "@/lib/db";
 import { logger } from "@/lib/logger";
 import { PERMS } from "@/lib/permissions";
@@ -41,17 +33,6 @@ function positiveInt(raw: FormDataEntryValue | null, fallback: number): number {
 	return Math.floor(n);
 }
 
-function clampInt(
-	raw: FormDataEntryValue | null,
-	fallback: number,
-	min: number,
-	max: number,
-): number {
-	const n = Number(str(raw));
-	if (!Number.isFinite(n)) return fallback;
-	return Math.min(max, Math.max(min, Math.floor(n)));
-}
-
 function parseTiers(raw: FormDataEntryValue | null): AntiddosBlockTier[] {
 	const tiers: AntiddosBlockTier[] = [];
 	for (const part of str(raw).split(",")) {
@@ -118,17 +99,6 @@ function configFromForm(formData: FormData): AntiddosConfig {
 			defaults.globalHaltMs,
 		),
 		cloudflareAutoBlock: str(formData.get("cfa_auto_block")) === "1",
-		crowdsecAutoBlock: str(formData.get("cs_auto_block")) === "1",
-		crowdsecBlockScore: clampInt(
-			formData.get("cs_block_score"),
-			defaults.crowdsecBlockScore,
-			0,
-			5,
-		),
-		crowdsecBlockTtlSeconds: positiveInt(
-			formData.get("cs_block_ttl_sec"),
-			defaults.crowdsecBlockTtlSeconds,
-		),
 	};
 }
 
@@ -153,9 +123,6 @@ async function persistSettings(config: AntiddosConfig): Promise<void> {
 		],
 		["antiddos_global_halt_ms", String(config.globalHaltMs)],
 		["antiddos_cfa_auto_block", config.cloudflareAutoBlock ? "1" : "0"],
-		["antiddos_cs_auto_block", config.crowdsecAutoBlock ? "1" : "0"],
-		["antiddos_cs_block_score", String(config.crowdsecBlockScore)],
-		["antiddos_cs_block_ttl", String(config.crowdsecBlockTtlSeconds)],
 	];
 	await Promise.all(
 		entries.map(([key, value]) =>
@@ -228,7 +195,6 @@ export async function unbanAntiddosIp(formData: FormData): Promise<void> {
 			await Promise.all([
 				redis.del(`antiddos:block:${ip}`),
 				redis.del(`antiddos:block:meta:${ip}`),
-				redis.del(`crowdsec:report:${ip}`),
 				redis.del(`antiddos:v:${ip}`),
 			]);
 		}
@@ -265,32 +231,6 @@ export async function removeCloudflareRule(formData: FormData): Promise<void> {
 	revalidatePath("/admin/devops/antiddos");
 }
 
-/** Test the configured CrowdSec API credentials against the CTI endpoint. */
-export async function verifyCrowdsecConfiguration(): Promise<void> {
-	const staff = await requirePermission(PERMS.SETTINGS_VIEW);
-	const status = await verifyCrowdsecConnection();
-	await setLastCrowdsecVerify(status);
-	logger.info("CrowdSec API configuration verified", {
-		staff: staff.username,
-		ok: status.ok,
-		message: status.message,
-	});
-	revalidatePath("/admin/devops/antiddos");
-}
-
-/** Test the CrowdSec signal-push (CAPI watcher) channel. */
-export async function verifyCrowdsecReportingConfiguration(): Promise<void> {
-	const staff = await requirePermission(PERMS.SETTINGS_VIEW);
-	const status = await verifyCrowdsecReporting();
-	await setLastCrowdsecReport(status);
-	logger.info("CrowdSec reporting configuration verified", {
-		staff: staff.username,
-		ok: status.ok,
-		message: status.message,
-	});
-	revalidatePath("/admin/devops/antiddos");
-}
-
 /** Test the configured Cloudflare API credentials against the zone. */
 export async function verifyCloudflareConfiguration(): Promise<void> {
 	const staff = await requirePermission(PERMS.SETTINGS_VIEW);

src/actions/admin-badges.ts

@@ -10,38 +10,77 @@ import { rcon } from "@/lib/services/rcon";
 export async function giveBadge(formData: FormData): Promise<void> {
 	await requirePermission(PERMS.CATALOG_EDIT);
 
-	const userId = Number(formData.get("userId"));
-	const code = String(formData.get("code") ?? "")
-		.normalize("NFC")
-		.trim()
-		.slice(0, 32);
-	if (!(userId > 0) || code.length === 0) return;
+	// Support comma-separated userIds and/or codes for bulk operations
+	const userIdInput = String(formData.get("userId") ?? "").trim();
+	const codeInput = String(formData.get("code") ?? "").trim();
+	const userIds = userIdInput
+		? userIdInput
+				.split(",")
+				.map((s) => s.trim())
+				.filter(Boolean)
+		: [];
+	const codes = codeInput
+		? codeInput
+				.split(",")
+				.map((s) => s.trim())
+				.filter(Boolean)
+		: [];
 
-	// Fire the emulator command so the badge appears live for online users.
-	await rcon.giveBadge(userId, code);
-
-	// Persist the badge directly so it survives a relog / offline grant.
-	// users_badges has no unique (user_id, badge_code) constraint, so guard
-	// against duplicates and compute the next free slot ourselves.
-	try {
-		const [existing] = await db
-			.select({ id: UsersBadges.id })
-			.from(UsersBadges)
-			.where(
-				and(eq(UsersBadges.userId, userId), eq(UsersBadges.badgeCode, code)),
-			)
-			.limit(1);
-		if (!existing) {
-			const [agg] = await db
-				.select({ maxSlot: max(UsersBadges.slotId) })
-				.from(UsersBadges)
-				.where(eq(UsersBadges.userId, userId));
-			const slotId = (agg?.maxSlot ?? 0) + 1;
-			await db.insert(UsersBadges).values({ userId, slotId, badgeCode: code });
-		}
-	} catch {
-		// Best-effort: the RCON grant already succeeded for online users.
+	if (userIds.length === 0 || codes.length === 0) {
+		return;
 	}
 
-	revalidatePath("/admin/badges");
+	// Process each user/code combination
+	let granted = false;
+	for (const userId of userIds) {
+		for (const code of codes) {
+			if (!(Number(userId) > 0) || code.length === 0) continue;
+
+			// Truncate badge code to 32 characters.
+			const truncatedCode = code.slice(0, 32);
+
+			// Fire the emulator command so the badge appears live for online users.
+			try {
+				await rcon.giveBadge(Number(userId), truncatedCode);
+			} catch {
+				// ignore rcon errors per pair
+			}
+
+			// Persist the badge directly so it survives a relog / offline grant.
+			// users_badges has no unique (user_id, badge_code) constraint, so guard
+			// against duplicates and compute the next free slot ourselves.
+			try {
+				const [existing] = await db
+					.select({ id: UsersBadges.id })
+					.from(UsersBadges)
+					.where(
+						and(
+							eq(UsersBadges.userId, Number(userId)),
+							eq(UsersBadges.badgeCode, truncatedCode),
+						),
+					)
+					.limit(1);
+				if (!existing) {
+					const [agg] = await db
+						.select({ maxSlot: max(UsersBadges.slotId) })
+						.from(UsersBadges)
+						.where(eq(UsersBadges.userId, Number(userId)));
+					const slotId = (agg?.maxSlot ?? 0) + 1;
+					await db.insert(UsersBadges).values({
+						userId: Number(userId),
+						slotId,
+						badgeCode: truncatedCode,
+					});
+				}
+			} catch {
+				// Best-effort: the RCON grant already succeeded for online users.
+			}
+
+			granted = true;
+		}
+	}
+
+	if (granted) {
+		revalidatePath("/admin/badges");
+	}
 }

src/actions/admin-guilds.ts

@@ -13,6 +13,7 @@ import {
 	Items,
 	Rooms,
 } from "@/lib/db";
+import { EDGE_CACHE_TAGS, purgeEdgeCache } from "@/lib/edge-cache";
 import { PERMS } from "@/lib/permissions";
 import { logStaffActivity } from "@/lib/services/staff-activity";
 
@@ -89,6 +90,7 @@ export async function disbandGuild(formData: FormData): Promise<void> {
 		targetId: id,
 	});
 	revalidatePath("/admin/guilds");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "guild disbanded");
 }
 
 export async function updateGuild(formData: FormData): Promise<void> {
@@ -151,4 +153,5 @@ export async function updateGuild(formData: FormData): Promise<void> {
 
 	revalidatePath("/admin/guilds");
 	revalidatePath(`/admin/guilds/${id}`);
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "guild updated");
 }

src/actions/admin-media.ts

@@ -4,11 +4,32 @@ import { mkdir, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
+import { validateSiteImageUpload } from "@/lib/images/site-image-upload";
 import { MEDIA_ROOT, resolveMediaPath } from "@/lib/media-storage";
 import { PERMS } from "@/lib/permissions";
 
-const MAX_SIZE = 5 * 1024 * 1024; // 5MB
-const ALLOWED = ["image/png", "image/jpeg", "image/gif", "image/webp"];
+/**
+ * Store an uploaded media file under MEDIA_ROOT.
+ *
+ * The extension always comes from the *detected* format (magic bytes + a full
+ * sharp decode), never from `file.name` or the browser-supplied MIME type:
+ * trusting either lets arbitrary bytes land on disk with an attacker-chosen name
+ * that the media route would then serve.
+ */
+async function storeUploadedMedia(
+	file: File,
+): Promise<{ ok: true; name: string } | { ok: false; error: string }> {
+	const validated = await validateSiteImageUpload(file);
+	if (!validated.success) return { ok: false, error: validated.error };
+	const baseDir = MEDIA_ROOT;
+	await mkdir(baseDir, { recursive: true });
+	const name = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}.${validated.extension}`;
+	const filePath = resolveMediaPath(name);
+	if (!filePath.startsWith(baseDir + path.sep))
+		return { ok: false, error: "Invalid path" };
+	await writeFile(filePath, validated.bytes);
+	return { ok: true, name };
+}
 
 export async function uploadMedia(
 	formData: FormData,
@@ -16,25 +37,9 @@ export async function uploadMedia(
 	await requirePermission(PERMS.PAGES_EDIT);
 	const file = formData.get("file") as File | null;
 	if (!file || file.size === 0) return { ok: false, error: "No file provided" };
-	if (file.size > MAX_SIZE)
-		return { ok: false, error: "File too large (max 5MB)" };
-	if (!ALLOWED.includes(file.type))
-		return {
-			ok: false,
-			error: "Invalid file type. Allowed: PNG, JPEG, GIF, WebP",
-		};
 
-	const baseDir = MEDIA_ROOT;
-	// eslint-disable-next-line security/detect-non-literal-fs-filename
-	await mkdir(baseDir, { recursive: true });
-
-	const ext = file.name.split(".").pop() ?? "png";
-	const name = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}.${ext}`;
-	const bytes = await file.arrayBuffer();
-	const filePath = resolveMediaPath(name);
-	if (!filePath.startsWith(baseDir + path.sep)) throw new Error("Invalid path");
-	// eslint-disable-next-line security/detect-non-literal-fs-filename
-	await writeFile(filePath, Buffer.from(bytes));
+	const stored = await storeUploadedMedia(file);
+	if (!stored.ok) return { ok: false, error: stored.error };
 
 	revalidatePath("/api/media");
 	revalidatePath("/admin/media");
@@ -45,6 +50,8 @@ export async function deleteMedia(name: string): Promise<void> {
 	await requirePermission(PERMS.PAGES_EDIT);
 	const { unlink } = await import("node:fs/promises");
 	const baseDir = MEDIA_ROOT;
+	// A name that is not a bare file name never reaches the unlink.
+	if (name.includes("/") || name.includes("\\") || name.includes("..")) return;
 	const filePath = resolveMediaPath(name);
 	if (!filePath.startsWith(baseDir + path.sep)) return;
 	try {
@@ -62,22 +69,11 @@ export async function uploadMediaAndReturn(
 	await requirePermission(PERMS.PAGES_EDIT);
 	const file = formData.get("file") as File | null;
 	if (!file || file.size === 0) return "";
-	if (file.size > MAX_SIZE) return "";
-	if (!ALLOWED.includes(file.type)) return "";
 
-	const baseDir = MEDIA_ROOT;
-	// eslint-disable-next-line security/detect-non-literal-fs-filename
-	await mkdir(baseDir, { recursive: true });
-
-	const ext = file.name.split(".").pop() ?? "png";
-	const name = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}.${ext}`;
-	const bytes = await file.arrayBuffer();
-	const filePath = resolveMediaPath(name);
-	if (!filePath.startsWith(baseDir + path.sep)) return "";
-	// eslint-disable-next-line security/detect-non-literal-fs-filename
-	await writeFile(filePath, Buffer.from(bytes));
+	const stored = await storeUploadedMedia(file);
+	if (!stored.ok) return "";
 
 	revalidatePath("/api/media");
 	revalidatePath("/admin/media");
-	return `/api/media/${name}`;
+	return `/api/media/${stored.name}`;
 }

src/actions/admin-photos.ts

@@ -5,6 +5,7 @@ import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
 import { tryRemoveLocalPhotoFile } from "@/lib/admin/photo-files";
 import { CameraWeb, db } from "@/lib/db";
+import { EDGE_CACHE_TAGS, purgeEdgeCache } from "@/lib/edge-cache";
 import { PERMS } from "@/lib/permissions";
 import { logStaffActivity } from "@/lib/services/staff-activity";
 
@@ -33,4 +34,5 @@ export async function deletePhoto(formData: FormData): Promise<void> {
 
 	revalidatePath("/admin/photos");
 	revalidatePath("/photos");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "photo deleted");
 }

src/actions/admin-rare-values.ts

@@ -4,6 +4,7 @@ import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
 import { db, WebsiteRareValueCategories, WebsiteRareValues } from "@/lib/db";
+import { EDGE_CACHE_TAGS, purgeEdgeCache } from "@/lib/edge-cache";
 import { formPositiveBigInt } from "@/lib/form-data";
 import { PERMS } from "@/lib/permissions";
 
@@ -34,6 +35,7 @@ export async function createCategory(formData: FormData): Promise<void> {
 		// Unique name collision or DB error — ignore, page will re-render unchanged.
 	}
 	revalidatePath("/admin/rare-values");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");
 }
 
 export async function deleteCategory(formData: FormData): Promise<void> {
@@ -53,6 +55,7 @@ export async function deleteCategory(formData: FormData): Promise<void> {
 		// Not found or DB error — ignore.
 	}
 	revalidatePath("/admin/rare-values");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");
 }
 
 export async function createValue(formData: FormData): Promise<void> {
@@ -101,6 +104,7 @@ export async function createValue(formData: FormData): Promise<void> {
 		// DB error — ignore.
 	}
 	revalidatePath("/admin/rare-values");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");
 }
 
 export async function deleteValue(formData: FormData): Promise<void> {
@@ -114,6 +118,7 @@ export async function deleteValue(formData: FormData): Promise<void> {
 		// Not found or DB error — ignore.
 	}
 	revalidatePath("/admin/rare-values");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");
 }
 
 export async function updateCategory(formData: FormData): Promise<void> {
@@ -145,6 +150,7 @@ export async function updateCategory(formData: FormData): Promise<void> {
 		// Unique name collision or DB error — ignore.
 	}
 	revalidatePath("/admin/rare-values");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");
 }
 
 export async function updateValue(formData: FormData): Promise<void> {
@@ -199,4 +205,5 @@ export async function updateValue(formData: FormData): Promise<void> {
 		// DB error — ignore.
 	}
 	revalidatePath("/admin/rare-values");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");
 }

src/actions/admin-settings.ts

@@ -14,10 +14,19 @@ import {
 import { PERMS } from "@/lib/permissions";
 import { clearOfficialHabboFurnidataCache } from "@/lib/services/habbo-furnidata-cache";
 import { clearBadgeCache } from "@/lib/services/habboassets";
+import {
+	isSecretSettingKey,
+	SECRET_PLACEHOLDER,
+} from "@/lib/services/setting-secrets";
 import { siteSettings } from "@/lib/services/site-settings";
 
 const managedKeySet = new Set(MANAGED_SETTING_KEYS);
 
+// Raw keys only the CMS core is allowed to own. Writing an arbitrary key from
+// the generic "advanced key/value" form previously meant a staff member could
+// overwrite `turnstile_secret`, `force_staff_2fa` or `min_staff_rank`.
+const RAW_SETTING_KEY_RE = /^[a-z0-9][a-z0-9_.-]{0,127}$/;
+
 function normalizeSettingValue(key: string, value: string): string {
 	if (key === HABBO_GAMEDATA_HOTEL_SETTING_KEY) {
 		return normalizeHabboGamedataHotel(value);
@@ -71,11 +80,12 @@ export async function updateSetting(formData: FormData): Promise<void> {
 	const key = String(formData.get("key") ?? "")
 		.normalize("NFC")
 		.trim();
-	const value = normalizeSettingValue(
-		key,
-		String(formData.get("value") ?? "").normalize("NFC"),
-	);
-	if (!key) return;
+	const raw = String(formData.get("value") ?? "").normalize("NFC");
+	if (!key || !RAW_SETTING_KEY_RE.test(key)) return;
+	// Blank on a secret means "keep what is stored", so the UI can render a
+	// placeholder without the risk of wiping the credential.
+	if (isSecretSettingKey(key) && raw === SECRET_PLACEHOLDER) return;
+	const value = isSecretSettingKey(key) ? raw : normalizeSettingValue(key, raw);
 	await db
 		.insert(WebsiteSetting)
 		.values({ key, value })
@@ -90,7 +100,7 @@ export async function createSetting(formData: FormData): Promise<void> {
 	const key = String(formData.get("key") ?? "")
 		.normalize("NFC")
 		.trim()
-		.slice(0, 255);
+		.slice(0, 128);
 	const value = normalizeSettingValue(
 		key,
 		String(formData.get("value") ?? "").normalize("NFC"),
@@ -99,7 +109,17 @@ export async function createSetting(formData: FormData): Promise<void> {
 		.normalize("NFC")
 		.trim()
 		.slice(0, 255);
-	if (!key) return;
+	// Managed keys go through `saveManagedSettings`; anything else must be a
+	// clearly namespaced custom key, and lockout/security settings are never
+	// writable through the free-form form.
+	if (!key || !RAW_SETTING_KEY_RE.test(key)) return;
+	if (
+		key === "force_staff_2fa" ||
+		key === "min_staff_rank" ||
+		key === "maintenance_enabled"
+	) {
+		return;
+	}
 	await db
 		.insert(WebsiteSetting)
 		.values({ key, value, comment: comment || null })

src/actions/admin-shop.ts

@@ -5,6 +5,7 @@ import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
 import { requirePermission } from "@/lib/admin/guard";
 import { db, WebsiteShopArticles } from "@/lib/db";
+import { EDGE_CACHE_TAGS, purgeEdgeCache } from "@/lib/edge-cache";
 import { formPositiveBigInt } from "@/lib/form-data";
 import { PERMS } from "@/lib/permissions";
 import { logServerError } from "@/lib/server-log";
@@ -149,6 +150,7 @@ export async function updateShopArticle(formData: FormData): Promise<void> {
 	}
 
 	revalidatePath(`/admin/shop/${id}`);
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "shop article updated");
 	redirect("/admin/shop");
 }
 
@@ -175,5 +177,6 @@ export async function deleteShopArticle(formData: FormData): Promise<void> {
 		return;
 	}
 
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "shop article deleted");
 	redirect("/admin/shop");
 }

src/actions/admin-teams.ts

@@ -4,6 +4,7 @@ import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
 import { db, WebsiteTeams } from "@/lib/db";
+import { EDGE_CACHE_TAGS, purgeEdgeCache } from "@/lib/edge-cache";
 import { PERMS } from "@/lib/permissions";
 
 export async function createTeam(formData: FormData): Promise<void> {
@@ -38,6 +39,7 @@ export async function createTeam(formData: FormData): Promise<void> {
 	});
 
 	revalidatePath("/admin/teams");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "team edited");
 }
 
 export async function deleteTeam(formData: FormData): Promise<void> {
@@ -47,4 +49,5 @@ export async function deleteTeam(formData: FormData): Promise<void> {
 	await db.delete(WebsiteTeams).where(eq(WebsiteTeams.id, id));
 
 	revalidatePath("/admin/teams");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "team edited");
 }

src/actions/auth-precheck.test.ts

@@ -15,6 +15,9 @@ const core = vi.hoisted(() => ({
 			.trim(),
 		password: String(password ?? "").normalize("NFC"),
 	}),
+	isLoginLocked: vi.fn(async () => false),
+	recordLoginFailure: vi.fn(async () => false),
+	clearLoginLockout: vi.fn(async () => undefined),
 }));
 
 vi.mock("@/env", () => ({ env: {} }));
@@ -27,8 +30,14 @@ vi.mock("@/lib/services/captcha", () => ({
 vi.mock("@/lib/services/site-settings", () => ({
 	siteSettings: { getBool: vi.fn() },
 }));
+vi.mock("@/lib/auth/login-lockout", () => ({
+	isLoginLocked: core.isLoginLocked,
+	recordLoginFailure: core.recordLoginFailure,
+	clearLoginLockout: core.clearLoginLockout,
+}));
 
 const user = (overrides = {}) => ({
+	id: 42,
 	password: "hash",
 	twoFactorConfirmedAt: null,
 	mail: null,
@@ -45,6 +54,9 @@ beforeEach(() => {
 	core.verifyLoginPassword.mockResolvedValue({ valid: true });
 	core.isEmailUnverified.mockResolvedValue(false);
 	core.runDummyHashCheck.mockResolvedValue(undefined);
+	core.isLoginLocked.mockResolvedValue(false);
+	core.recordLoginFailure.mockResolvedValue(false);
+	core.clearLoginLockout.mockResolvedValue(undefined);
 });
 
 describe("precheckLogin", () => {
@@ -85,4 +97,57 @@ describe("precheckLogin", () => {
 		core.isEmailUnverified.mockResolvedValue(true);
 		expect(await precheckLogin("user", "pass")).toBe("unverified");
 	});
+
+	it("returns locked for an account that is already locked out", async () => {
+		core.getLoginUser.mockResolvedValue(user());
+		core.isLoginLocked.mockResolvedValue(true);
+		expect(await precheckLogin("user", "pass")).toBe("locked");
+		// The password is never verified while locked, so a correct password
+		// cannot walk a locked account back in.
+		expect(core.verifyLoginPassword).not.toHaveBeenCalled();
+		expect(core.clearLoginLockout).not.toHaveBeenCalled();
+	});
+
+	it("checks the lockout before verifying the password", async () => {
+		core.getLoginUser.mockResolvedValue(user());
+		const order: string[] = [];
+		core.getLoginUser.mockImplementation(async () => {
+			order.push("lookup");
+			return user();
+		});
+		core.isLoginLocked.mockImplementation(async () => {
+			order.push("lock");
+			return false;
+		});
+		core.verifyLoginPassword.mockImplementation(async () => {
+			order.push("verify");
+			return { valid: true };
+		});
+		expect(await precheckLogin("user", "pass")).toBe("ok");
+		expect(order).toEqual(["lookup", "lock", "verify"]);
+	});
+
+	it("records a failure and skips the clear when the password is wrong", async () => {
+		core.getLoginUser.mockResolvedValue(user());
+		core.verifyLoginPassword.mockResolvedValue({ valid: false });
+		core.recordLoginFailure.mockResolvedValue(false);
+		expect(await precheckLogin("user", "pass")).toBe("invalid");
+		expect(core.recordLoginFailure).toHaveBeenCalledWith(42);
+		expect(core.clearLoginLockout).not.toHaveBeenCalled();
+	});
+
+	it("clears the lockout after a successful authentication", async () => {
+		core.getLoginUser.mockResolvedValue(user());
+		expect(await precheckLogin("user", "pass")).toBe("ok");
+		expect(core.clearLoginLockout).toHaveBeenCalledWith(42);
+		expect(core.recordLoginFailure).not.toHaveBeenCalled();
+	});
+
+	it("does not lock or clear a bucket for an unknown account", async () => {
+		core.getLoginUser.mockResolvedValue(null);
+		expect(await precheckLogin("nonexistent", "pass")).toBe("invalid");
+		expect(core.isLoginLocked).not.toHaveBeenCalled();
+		expect(core.recordLoginFailure).not.toHaveBeenCalled();
+		expect(core.clearLoginLockout).not.toHaveBeenCalled();
+	});
 });

src/actions/auth-precheck.ts

@@ -7,6 +7,11 @@ import {
 	runDummyHashCheck,
 	verifyLoginPassword,
 } from "@/lib/auth/login-core";
+import {
+	clearLoginLockout,
+	isLoginLocked,
+	recordLoginFailure,
+} from "@/lib/auth/login-lockout";
 import { clientIp, rateLimit } from "@/lib/rate-limit";
 import { captchaConfig, verifyCaptcha } from "@/lib/services/captcha";
 
@@ -15,7 +20,8 @@ export type PrecheckResult =
 	| "invalid"
 	| "twofactor"
 	| "unverified"
-	| "captcha";
+	| "captcha"
+	| "locked";
 
 /**
  * Validates username+password WITHOUT creating a session, and reports whether a
@@ -38,6 +44,9 @@ export async function precheckLogin(
 		if (!(await verifyCaptcha(captchaToken ?? null, ip))) return "captcha";
 	}
 
+	// A lockout must be checked BEFORE the password is verified: the success
+	// path clears the counter, which would otherwise let an already-locked
+	// account straight back in with the correct credentials.
 	const user = await getLoginUser(u);
 	if (!user) {
 		// Prevent timing-based enumeration: always run a dummy hash check.
@@ -45,8 +54,15 @@ export async function precheckLogin(
 		return "invalid";
 	}
 
+	if (await isLoginLocked(user.id)) return "locked";
+
 	const res = await verifyLoginPassword(user, p);
-	if (!res.valid) return "invalid";
+	if (!res.valid) {
+		await recordLoginFailure(user.id);
+		return "invalid";
+	}
+
+	await clearLoginLockout(user.id);
 
 	if (await isEmailUnverified(user)) {
 		return "unverified";

src/actions/bulk-users.test.ts

@@ -41,7 +41,11 @@ const {
 });
 
 vi.mock("@/lib/admin/guard", () => ({ requirePermission: vi.fn() }));
-vi.mock("@/lib/permissions", () => ({ PERMS: { USERS_EDIT: "users.edit" } }));
+vi.mock("@/lib/permissions", () => ({
+	PERMS: { USERS_EDIT: "users.edit" },
+	// Staff (rank 7) may act on anyone below the hotel's top rank.
+	getHighestRank: vi.fn(() => Promise.resolve(10)),
+}));
 vi.mock("@/lib/db", () => ({
 	db: {
 		delete: vi.fn(() => ({ where: deleteWhere })),
@@ -109,7 +113,10 @@ beforeEach(() => {
 	onDuplicateKeyUpdate.mockResolvedValue([{ affectedRows: 1 }]);
 	updateWhere.mockResolvedValue([{ affectedRows: 1 }]);
 	selectLimit.mockResolvedValue([]);
-	selectWhereResolved.mockResolvedValue([]);
+	// Rank rows for the per-id rank guard: every target sits below staff rank 7.
+	selectWhereResolved.mockResolvedValue([{ rank: 1 }]);
+	// Max slot of existing badges (consumed by the badge loop, not the guard).
+	selectWhereResolved.mockResolvedValueOnce([{ rank: 1 }]);
 });
 
 describe("bulkUnban", () => {

src/actions/bulk-users.ts

@@ -1,6 +1,7 @@
 "use server";
 
 import { and, eq, inArray, max, sql } from "drizzle-orm";
+import { isDynamicSuperAdmin } from "@/lib/admin/authorization-policy";
 import { requirePermission } from "@/lib/admin/guard";
 import {
 	Ban,
@@ -11,18 +12,69 @@ import {
 	UsersCurrency,
 	UsersSettings,
 } from "@/lib/db";
-import { PERMS } from "@/lib/permissions";
+import { getHighestRank, PERMS } from "@/lib/permissions";
 import type { ActionResult } from "@/lib/safe-action-shared";
 import { rcon } from "@/lib/services/rcon";
 import { logStaffActivity } from "@/lib/services/staff-activity";
 
+/**
+ * Bulk actions are plain server actions whose arguments come from the client,
+ * so every one of them validates the payload and the target ranks first. The
+ * helpers below are the whole "is this allowed" contract.
+ */
+const MAX_BULK_USERS = 200;
+
+function parseUserIds(raw: unknown): number[] {
+	if (!Array.isArray(raw)) return [];
+	const ids = raw
+		.map((v) => (typeof v === "number" ? v : Number(v)))
+		.filter((v) => Number.isInteger(v) && v > 0);
+	return [...new Set(ids)].slice(0, MAX_BULK_USERS);
+}
+
+function toPositiveInt(raw: unknown): number | null {
+	const n = typeof raw === "number" ? raw : Number(raw);
+	return Number.isInteger(n) && n > 0 ? n : null;
+}
+
+function parseAmount(raw: unknown, max = 1_000_000): number | null {
+	const n = typeof raw === "number" ? raw : Number(raw);
+	return Number.isInteger(n) && n > 0 && n <= max ? n : null;
+}
+
+function parseDuration(raw: unknown): number {
+	const n = typeof raw === "number" ? raw : Number(raw);
+	return Number.isInteger(n) && n > 0 ? Math.min(n, 60 * 60 * 24 * 365) : 0;
+}
+
+async function guardBulkTargets(
+	staff: { id: number; rank: number },
+	userIds: number[],
+): Promise<void> {
+	const highestRank = await getHighestRank();
+	const superAdmin = isDynamicSuperAdmin(staff.rank, highestRank);
+	if (superAdmin || userIds.length === 0) return;
+	const rows = await db
+		.select({ rank: User.rank })
+		.from(User)
+		.where(inArray(User.id, userIds));
+	const blocked = rows.filter((r) => r.rank >= staff.rank);
+	if (blocked.length > 0) {
+		throw new Error(
+			"Cannot act on a user at or above your rank — those ids were skipped",
+		);
+	}
+}
+
 export async function bulkUnban({
 	userIds,
 }: {
 	userIds: number[];
 }): Promise<ActionResult<{ unbanned: number; total: number }>> {
 	const staff = await requirePermission(PERMS.USERS_EDIT);
-	const result = await db.delete(Ban).where(inArray(Ban.userId, userIds));
+	const ids = parseUserIds(userIds);
+	await guardBulkTargets(staff, ids);
+	const result = await db.delete(Ban).where(inArray(Ban.userId, ids));
 	const unbanned = Number(result[0]?.affectedRows ?? 0);
 	await logStaffActivity({
 		staffId: staff.id,
@@ -30,10 +82,7 @@ export async function bulkUnban({
 		description: `Unbanned ${unbanned} user(s)`,
 		targetType: "user",
 	});
-	return {
-		ok: true as const,
-		data: { unbanned, total: userIds.length },
-	};
+	return { ok: true as const, data: { unbanned, total: ids.length } };
 }
 
 export async function bulkBan({
@@ -46,10 +95,14 @@ export async function bulkBan({
 	duration: number;
 }): Promise<ActionResult<{ banned: number }>> {
 	const staff = await requirePermission(PERMS.USERS_EDIT);
+	const ids = parseUserIds(userIds);
+	const seconds = parseDuration(duration);
+	const reasonText = typeof reason === "string" ? reason.slice(0, 255) : "";
+	await guardBulkTargets(staff, ids);
 	const now = Math.floor(Date.now() / 1000);
 	let banned = 0;
 
-	for (const userId of userIds) {
+	for (const userId of ids) {
 		try {
 			await db.insert(Ban).values({
 				userId,
@@ -57,8 +110,8 @@ export async function bulkBan({
 				machineId: "",
 				userStaffId: staff.id,
 				timestamp: now,
-				banExpire: duration > 0 ? now + duration : 0,
-				banReason: reason,
+				banExpire: seconds > 0 ? now + seconds : 0,
+				banReason: reasonText,
 				type: "account",
 			});
 			banned++;
@@ -92,33 +145,37 @@ export async function bulkGiveCurrency({
 	}>
 > {
 	const staff = await requirePermission(PERMS.USERS_EDIT);
+	const ids = parseUserIds(userIds);
+	const value = parseAmount(amount);
+	if (!value) throw new Error("Invalid amount");
+	await guardBulkTargets(staff, ids);
 	let given = 0;
 	const failedIds: Array<{ userId: number; reason: string }> = [];
 
-	for (const userId of userIds) {
+	for (const userId of ids) {
 		try {
 			if (type === "credits") {
 				await db
 					.update(User)
-					.set({ credits: sql`${User.credits} + ${amount}` })
+					.set({ credits: sql`${User.credits} + ${value}` })
 					.where(eq(User.id, userId));
-				await rcon.giveCredits(userId, amount);
+				await rcon.giveCredits(userId, value);
 			} else if (type === "pixels") {
 				await db
 					.insert(UsersCurrency)
-					.values({ userId, type: 0, amount })
+					.values({ userId, type: 0, amount: value })
 					.onDuplicateKeyUpdate({
-						set: { amount: sql`${UsersCurrency.amount} + ${amount}` },
+						set: { amount: sql`${UsersCurrency.amount} + ${value}` },
 					});
-				await rcon.giveDuckets(userId, amount);
+				await rcon.giveDuckets(userId, value);
 			} else if (type === "points") {
 				await db
 					.insert(UsersCurrency)
-					.values({ userId, type: 101, amount })
+					.values({ userId, type: 101, amount: value })
 					.onDuplicateKeyUpdate({
-						set: { amount: sql`${UsersCurrency.amount} + ${amount}` },
+						set: { amount: sql`${UsersCurrency.amount} + ${value}` },
 					});
-				await rcon.givePointsGotw(userId, amount);
+				await rcon.givePointsGotw(userId, value);
 			}
 			given++;
 		} catch {
@@ -129,7 +186,7 @@ export async function bulkGiveCurrency({
 	await logStaffActivity({
 		staffId: staff.id,
 		action: "bulk_give_currency",
-		description: `Gave ${amount} ${type} to ${given} user(s)`,
+		description: `Gave ${value} ${type} to ${given} user(s)`,
 		targetType: "user",
 	});
 	return {
@@ -152,19 +209,21 @@ export async function bulkGiveBadge({
 	}>
 > {
 	const staff = await requirePermission(PERMS.USERS_EDIT);
+	const ids = parseUserIds(userIds);
+	const code =
+		typeof badgeCode === "string" ? badgeCode.trim().slice(0, 64) : "";
+	if (!code) throw new Error("Invalid badge code");
+	await guardBulkTargets(staff, ids);
 	let given = 0;
 	const failedIds: Array<{ userId: number; reason: string }> = [];
 
-	for (const userId of userIds) {
+	for (const userId of ids) {
 		try {
 			const [existing] = await db
 				.select({ id: UsersBadges.id })
 				.from(UsersBadges)
 				.where(
-					and(
-						eq(UsersBadges.userId, userId),
-						eq(UsersBadges.badgeCode, badgeCode),
-					),
+					and(eq(UsersBadges.userId, userId), eq(UsersBadges.badgeCode, code)),
 				)
 				.limit(1);
 			if (!existing) {
@@ -173,8 +232,10 @@ export async function bulkGiveBadge({
 					.from(UsersBadges)
 					.where(eq(UsersBadges.userId, userId));
 				const slotId = (agg?.maxSlot ?? 0) + 1;
-				await db.insert(UsersBadges).values({ userId, slotId, badgeCode });
-				await rcon.giveBadge(userId, badgeCode);
+				await db
+					.insert(UsersBadges)
+					.values({ userId, slotId, badgeCode: code });
+				await rcon.giveBadge(userId, code);
 			}
 			given++;
 		} catch {
@@ -211,12 +272,17 @@ export async function bulkAdjustCurrency({
 	}>
 > {
 	const staff = await requirePermission(PERMS.USERS_EDIT);
+	const ids = parseUserIds(userIds);
 	if (!Number.isFinite(amount) || amount === 0) {
 		return { ok: false as const, error: "Amount must be a non-zero number" };
 	}
+	if (Math.abs(Math.trunc(amount)) > 1_000_000) {
+		return { ok: false as const, error: "Amount is too large" };
+	}
+	await guardBulkTargets(staff, ids);
 
 	if (amount > 0) {
-		const given = await bulkGiveCurrency({ userIds, amount, type });
+		const given = await bulkGiveCurrency({ userIds: ids, amount, type });
 		if (!given.ok) return given;
 		if (!given.data) {
 			return { ok: false as const, error: "Currency adjustment failed" };
@@ -235,7 +301,7 @@ export async function bulkAdjustCurrency({
 	let adjusted = 0;
 	const failedIds: Array<{ userId: number; reason: string }> = [];
 
-	for (const userId of userIds) {
+	for (const userId of ids) {
 		try {
 			if (type === "credits") {
 				const [user] = await db
@@ -299,8 +365,11 @@ export async function setTradeLock({
 	untilUnix: number;
 }): Promise<ActionResult<{ userId: number; untilUnix: number }>> {
 	const staff = await requirePermission(PERMS.USERS_EDIT);
-	const until = Math.max(0, Math.trunc(untilUnix));
+	const id = toPositiveInt(userId);
+	if (!id) return { ok: false as const, error: "Invalid user" };
+	const until = Math.max(0, Math.min(Math.trunc(untilUnix), 2_000_000_000));
 	const locked = until > 0;
+	await guardBulkTargets(staff, [id]);
 
 	const [user] = await db
 		.select({
@@ -309,7 +378,7 @@ export async function setTradeLock({
 			online: User.online,
 		})
 		.from(User)
-		.where(eq(User.id, userId))
+		.where(eq(User.id, id))
 		.limit(1);
 	if (!user) {
 		return { ok: false as const, error: "User not found" };
@@ -331,7 +400,7 @@ export async function setTradeLock({
 				.where(eq(Sanctions.id, existing.id));
 		} else {
 			await tx.insert(Sanctions).values({
-				habboId: userId,
+				habboId: id,
 				tradeLockedUntil: until,
 				reason: locked ? "Trade lock (CMS)" : "",
 			});
@@ -369,5 +438,5 @@ export async function setTradeLock({
 		targetId: userId,
 	});
 
-	return { ok: true as const, data: { userId, untilUnix: until } };
+	return { ok: true as const, data: { userId: id, untilUnix: until } };
 }

src/actions/catalog-bc.test.ts

@@ -1,5 +1,4 @@
 // @ts-nocheck
-import { eq } from "drizzle-orm";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const state = vi.hoisted(() => ({
@@ -50,6 +49,13 @@ vi.mock("@/features/catalog/server/page-commands", () => ({
 	togglePageCommand: mockTogglePageCommand,
 }));
 
+const mockDeleteCatalogItemsCommand = vi.hoisted(() =>
+	vi.fn(async () => ({ deleted: 1, restoreId: 55 })),
+);
+vi.mock("@/features/catalog/server/item-deletes", () => ({
+	deleteCatalogItemsCommand: mockDeleteCatalogItemsCommand,
+}));
+
 const mockSendCatalogUpdate = vi.hoisted(() => vi.fn());
 vi.mock("@/features/catalog/server/sync-status", () => ({
 	sendCatalogUpdate: mockSendCatalogUpdate,
@@ -86,7 +92,6 @@ vi.mock("@/lib/db", async () => {
 	};
 });
 
-import { CatalogItemsBc } from "@/lib/db";
 import {
 	createBcItem,
 	createBcPage,
@@ -179,16 +184,25 @@ describe("updateBcPage", () => {
 });
 
 describe("deleteBcItem", () => {
-	it("deletes the bc item and logs activity", async () => {
+	it("deletes through the restorable path and logs activity", async () => {
 		const result = await deleteBcItem({ id: 7 });
-		expect(result).toEqual({ ok: true });
-		expect(state.deletes).toHaveLength(1);
-		expect(state.deletes[0].table).toBe(CatalogItemsBc);
-		expect(state.deletes[0].where).toEqual(eq(CatalogItemsBc.id, 7));
+		expect(result).toEqual({
+			ok: true,
+			data: { deleted: 1, restoreId: 55 },
+		});
+		// Not a raw DELETE: BC rows are kept so the delete can be undone, the same
+		// as the normal catalog.
+		expect(mockDeleteCatalogItemsCommand).toHaveBeenCalledWith(
+			[7],
+			expect.anything(),
+			undefined,
+			"bc",
+		);
+		expect(state.deletes).toHaveLength(0);
 		expect(mockLogStaffActivity).toHaveBeenCalledWith(
 			expect.objectContaining({
 				action: "bc_item_delete",
-				description: "Deleted BC catalog item #7",
+				description: "Deleted BC catalog offer #7",
 			}),
 		);
 		expect(mockSendCatalogUpdate).toHaveBeenCalled();
@@ -197,9 +211,14 @@ describe("deleteBcItem", () => {
 		);
 	});
 
-	it("propagates delete failures", async () => {
-		state.deleteError = new Error("db down");
-		await expect(deleteBcItem({ id: 7 })).rejects.toThrow("db down");
+	it("reports a failed delete instead of pretending it worked", async () => {
+		mockDeleteCatalogItemsCommand.mockRejectedValueOnce(Error("db down"));
+		mockCatalogFailure.mockReturnValueOnce({ message: "Delete failed" });
+
+		const result = await deleteBcItem({ id: 7 });
+
+		expect(result).toEqual({ ok: false, error: "Delete failed" });
+		expect(mockSendCatalogUpdate).not.toHaveBeenCalled();
 	});
 });
 

src/actions/catalog-bc.ts

@@ -1,8 +1,8 @@
 "use server";
 
-import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { catalogFailure } from "@/features/catalog/server/errors";
+import { deleteCatalogItemsCommand } from "@/features/catalog/server/item-deletes";
 import {
 	createBcOfferCommand,
 	updateBcOfferCommand,
@@ -16,7 +16,6 @@ import {
 } from "@/features/catalog/server/page-commands";
 import { sendCatalogUpdate } from "@/features/catalog/server/sync-status";
 import { requirePermission } from "@/lib/admin/guard";
-import { CatalogItemsBc, db } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
 import { withCatalogExport } from "@/lib/services/catalog-git-queue";
 import { logStaffActivity } from "@/lib/services/staff-activity";
@@ -92,21 +91,37 @@ export async function updateBcPage({
 	});
 }
 
-export async function deleteBcItem({ id }: { id: number }) {
+/**
+ * BC offers are deleted through the same keep-and-restore path as normal ones.
+ * It used to be a bare `DELETE` here, so a BC deletion was the one catalog
+ * mutation with no way back.
+ */
+export async function deleteBcItem({
+	id,
+	requestKey,
+}: {
+	id: number;
+	requestKey?: string;
+}) {
 	const staff = await requirePermission(PERMS.CATALOG_EDIT);
-	return await withCatalogExport(async () => {
-		await db.delete(CatalogItemsBc).where(eq(CatalogItemsBc.id, id));
-		await sendCatalogUpdate();
-		await logStaffActivity({
-			staffId: staff.id,
-			action: "bc_item_delete",
-			description: `Deleted BC catalog item #${id}`,
-			targetType: "catalog_item_bc",
-			targetId: id,
+	try {
+		return await withCatalogExport(async () => {
+			const data: { deleted: number; restoreId: number } =
+				await deleteCatalogItemsCommand([id], staff.id, requestKey, "bc");
+			await sendCatalogUpdate();
+			await logStaffActivity({
+				staffId: staff.id,
+				action: "bc_item_delete",
+				description: `Deleted BC catalog offer #${id}`,
+				targetType: "catalog_item_bc",
+				targetId: id,
+			});
+			revalidatePath("/admin/catalog/builder-club");
+			return { ok: true as const, data };
 		});
-		revalidatePath("/admin/catalog/builder-club");
-		return { ok: true as const };
-	});
+	} catch (error) {
+		return { ok: false as const, error: catalogFailure(error).message };
+	}
 }
 
 export async function updateBcItem({

src/actions/catalog-bulk.ts

@@ -1,8 +1,10 @@
 "use server";
 import { revalidatePath } from "next/cache";
 import type { BulkOfferInput } from "@/features/catalog/domain/bulk-offers";
+import { CatalogInputError } from "@/features/catalog/domain/hierarchy";
 import {
 	applyBulkOffersCommand,
+	type BulkCatalogKind,
 	listBulkOfferDestinationsCommand,
 	previewBulkOffersCommand,
 	undoBulkOffersCommand,
@@ -13,10 +15,56 @@ import { requirePermission } from "@/lib/admin/guard";
 import { logger } from "@/lib/logger";
 import { PERMS } from "@/lib/permissions";
 import { withCatalogExport } from "@/lib/services/catalog-git-queue";
-export async function previewBulkOffers(input: BulkOfferInput) {
+import { logStaffActivity } from "@/lib/services/staff-activity";
+
+/** The catalog is a server boundary, not a client choice. */
+function bulkKind(catalog: unknown): BulkCatalogKind {
+	if (catalog === "bc") return "bc";
+	if (catalog === "normal" || catalog === undefined) return "normal";
+	throw new CatalogInputError("Invalid catalog");
+}
+
+function catalogLabel(kind: BulkCatalogKind): string {
+	return kind === "bc" ? "Builder Club" : "catalog";
+}
+
+const FIELD_LABELS: Record<keyof BulkOfferInput["changes"], string> = {
+	costCredits: "credits",
+	costPoints: "points",
+	pointsType: "points type",
+	pageId: "category",
+};
+
+/**
+ * The audit log has no undo of its own, so it must record *what* changed, not
+ * just that something did. An entry that only says "bulk updated 200 offers"
+ * cannot answer the question the log exists for.
+ */
+function describeChanges(changes: BulkOfferInput["changes"]): string {
+	return Object.entries(changes)
+		.map(([key, change]) => {
+			if (change && typeof change === "object" && "mode" in change)
+				return `${FIELD_LABELS[key as keyof BulkOfferInput["changes"]]} ${
+					change.mode === "percent"
+						? `by ${change.value}%`
+						: `${change.mode} ${change.value}`
+				}`;
+			if (key === "pageId") return `category moved to #${String(change)}`;
+			return `${FIELD_LABELS[key as keyof BulkOfferInput["changes"]]} = ${String(change)}`;
+		})
+		.join(", ");
+}
+
+export async function previewBulkOffers(
+	input: BulkOfferInput,
+	catalog: unknown = "normal",
+) {
 	await requirePermission(PERMS.CATALOG_VIEW);
 	try {
-		return { ok: true as const, data: await previewBulkOffersCommand(input) };
+		return {
+			ok: true as const,
+			data: await previewBulkOffersCommand(input, bulkKind(catalog)),
+		};
 	} catch (error) {
 		return {
 			ok: false as const,
@@ -31,8 +79,10 @@ export async function applyBulkOffers(
 	input: BulkOfferInput,
 	fingerprint: string,
 	requestKey?: string,
+	catalog: unknown = "normal",
 ) {
 	const staff = await requirePermission(PERMS.CATALOG_EDIT);
+	const kind = bulkKind(catalog);
 	try {
 		return await withCatalogExport(async () => {
 			const data = await applyBulkOffersCommand(
@@ -40,8 +90,16 @@ export async function applyBulkOffers(
 				fingerprint,
 				staff.id,
 				requestKey,
+				kind,
 			);
 			if (data.changedCount > 0) {
+				await logStaffActivity({
+					staffId: staff.id,
+					action: "catalog_bulk_offers",
+					description: `Bulk updated ${data.changedCount} ${catalogLabel(kind)} offer(s) across ${new Set(input.ids).size} selected: ${describeChanges(input.changes)}`,
+					targetType: "catalog_page",
+					targetId: input.changes.pageId,
+				});
 				refreshCatalog();
 			}
 			return { ok: true as const, data };
@@ -57,12 +115,12 @@ export async function applyBulkOffers(
 	}
 }
 
-export async function getBulkOfferDestinations() {
+export async function getBulkOfferDestinations(catalog: unknown = "normal") {
 	await requirePermission(PERMS.CATALOG_VIEW);
 	try {
 		return {
 			ok: true as const,
-			data: await listBulkOfferDestinationsCommand(),
+			data: await listBulkOfferDestinationsCommand(bulkKind(catalog)),
 		};
 	} catch (error) {
 		return {
@@ -87,6 +145,12 @@ export async function undoBulkOffers(
 				staff.id,
 				requestKey,
 			);
+			await logStaffActivity({
+				staffId: staff.id,
+				action: "catalog_bulk_undo",
+				description: `Restored ${data.changedCount} catalog offer(s) from history #${historyIds.join(", ")}`,
+				targetType: "catalog_offer",
+			});
 			refreshCatalog();
 			return { ok: true as const, data };
 		});

src/actions/catalog-items.ts

@@ -3,9 +3,17 @@
 import { eq, inArray, like, or, sql } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { offerPatchSchema } from "@/features/catalog/domain/offer-input";
+import { catalogFailure } from "@/features/catalog/server/errors";
+import {
+	deleteCatalogItemsCommand,
+	listRestorableDeletionsCommand,
+	restoreDeletedCatalogItemsCommand,
+} from "@/features/catalog/server/item-deletes";
 import {
 	createOfferCommand,
+	moveBcOffersCommand,
 	moveOffersCommand,
+	reorderBcOffersCommand,
 	reorderOffersCommand,
 	updateOfferCommand,
 } from "@/features/catalog/server/offer-commands";
@@ -60,24 +68,40 @@ export async function insertCatalogItemRow(data: {
 	);
 }
 
-export async function createCatalogItem(data: {
-	pageId: number;
-	itemIds: string;
-	catalogName: string;
-	costCredits: number;
-	costPoints: number;
-	pointsType: number;
-	amount: number;
-	orderNumber: number;
-	offerId: number;
-	limitedSells: number;
-	limitedStack: number;
-	extradata: string;
-	songId: number;
-	haveOffer: "0" | "1";
-	clubOnly: "0" | "1";
-}) {
+export async function createCatalogItem(
+	data: {
+		pageId: number;
+		itemIds: string;
+		catalogName: string;
+		costCredits: number;
+		costPoints: number;
+		pointsType: number;
+		amount: number;
+		orderNumber: number;
+		offerId: number;
+		limitedSells: number;
+		limitedStack: number;
+		extradata: string;
+		songId: number;
+		haveOffer: "0" | "1";
+		clubOnly: "0" | "1";
+	},
+	// The table is shared between both catalogs, and a BC offer has no price or
+	// currency columns at all. The catalog decides which command runs rather than
+	// letting the table send normal-only fields at a BC row.
+	catalog: "normal" | "bc" = "normal",
+) {
 	const staff = await requirePermission(PERMS.CATALOG_EDIT);
+	if (catalog === "bc") {
+		const { createBcItem } = await import("@/actions/catalog-bc");
+		return createBcItem({
+			pageId: data.pageId,
+			itemIds: data.itemIds,
+			catalogName: data.catalogName,
+			orderNumber: data.orderNumber,
+			extradata: data.extradata,
+		});
+	}
 	return await withCatalogExport(async () => {
 		let catalogName = data.catalogName.trim();
 		if (!catalogName) {
@@ -196,51 +220,137 @@ export async function bulkCreateCatalogItems({
 	});
 }
 
-export async function deleteCatalogItems({ ids }: { ids: number[] }) {
+/**
+ * Deleting offers is the one catalog mutation with no natural inverse, so the
+ * full rows are kept at delete time and `restoreId` is handed back. The UI shows
+ * that as an undo affordance; without it a mis-click is unrecoverable.
+ */
+export async function deleteCatalogItems({
+	ids,
+	requestKey,
+	catalog = "normal",
+}: {
+	ids: number[];
+	requestKey?: string;
+	catalog?: "normal" | "bc";
+}) {
 	const staff = await requirePermission(PERMS.CATALOG_EDIT);
-	return await withCatalogExport(async () => {
-		await db.delete(CatalogItems).where(inArray(CatalogItems.id, ids));
-		await sendCatalogUpdate();
-		await logStaffActivity({
-			staffId: staff.id,
-			action: "catalog_items_delete",
-			description: `Deleted catalog items: ${ids.join(", ")}`,
-			targetType: "catalog_item",
+	try {
+		return await withCatalogExport(async () => {
+			const data: {
+				deleted: number;
+				restoreId: number;
+			} = await deleteCatalogItemsCommand(
+				ids,
+				staff.id,
+				requestKey,
+				catalog === "bc" ? "bc" : "normal",
+			);
+			await sendCatalogUpdate();
+			await logStaffActivity({
+				staffId: staff.id,
+				action: "catalog_items_delete",
+				description: `Deleted ${data.deleted} ${catalog === "bc" ? "BC " : ""}catalog offer(s): ${ids.join(", ")}`,
+				targetType: catalog === "bc" ? "catalog_item_bc" : "catalog_item",
+			});
+			revalidatePath("/admin/catalog");
+			if (catalog === "bc") revalidatePath("/admin/catalog/builder-club");
+			return { ok: true as const, data };
 		});
-		revalidatePath("/admin/catalog");
-		return { ok: true as const, data: {} };
-	});
+	} catch (error) {
+		const failure = catalogFailure(error);
+		return { ok: false as const, error: failure.message };
+	}
+}
+
+/**
+ * Recent deletions that are still restorable. The undo toast covers the common
+ * case; this is the fallback for a delete noticed after that toast is gone.
+ */
+export async function listRestorableCatalogItemDeletions() {
+	await requirePermission(PERMS.CATALOG_EDIT);
+	try {
+		return {
+			ok: true as const,
+			data: await listRestorableDeletionsCommand(),
+		};
+	} catch (error) {
+		const failure = catalogFailure(error);
+		return { ok: false as const, error: failure.message };
+	}
+}
+
+export async function restoreDeletedCatalogItems({
+	restoreId,
+	requestKey,
+}: {
+	restoreId: number;
+	requestKey?: string;
+}) {
+	const staff = await requirePermission(PERMS.CATALOG_EDIT);
+	try {
+		return await withCatalogExport(async () => {
+			const data: { restored: number } =
+				await restoreDeletedCatalogItemsCommand(
+					restoreId,
+					staff.id,
+					requestKey,
+				);
+			await sendCatalogUpdate();
+			await logStaffActivity({
+				staffId: staff.id,
+				action: "catalog_items_restore",
+				description: `Restored ${data.restored} deleted catalog offer(s)`,
+				targetType: "catalog_item",
+			});
+			revalidatePath("/admin/catalog");
+			return { ok: true as const, data };
+		});
+	} catch (error) {
+		const failure = catalogFailure(error);
+		return { ok: false as const, error: failure.message };
+	}
 }
 
 export async function moveCatalogItems({
 	ids,
 	targetPageId,
+	catalog = "normal",
 }: {
 	ids: number[];
 	targetPageId: number;
+	catalog?: "normal" | "bc";
 }) {
 	await requirePermission(PERMS.CATALOG_EDIT);
 	return await withCatalogExport(async () => {
 		if (ids.length === 0) {
 			return { ok: true as const, data: {} };
 		}
-		await moveOffersCommand(ids, targetPageId);
+		// Moving BC offers has to lock a BC category and write the BC table; the
+		// normal command would move a row in the wrong catalog.
+		if (catalog === "bc") await moveBcOffersCommand(ids, targetPageId);
+		else await moveOffersCommand(ids, targetPageId);
 		await sendCatalogUpdate();
 		revalidatePath("/admin/catalog");
+		if (catalog === "bc") revalidatePath("/admin/catalog/builder-club");
 		return { ok: true as const, data: {} };
 	});
 }
 
 export async function reorderCatalogItems({
 	orders,
+	catalog = "normal",
 }: {
 	orders: Array<{ id: number; orderNumber: number }>;
+	catalog?: "normal" | "bc";
 }) {
 	await requirePermission(PERMS.CATALOG_EDIT);
 	return await withCatalogExport(async () => {
-		await reorderOffersCommand(orders);
+		if (catalog === "bc") await reorderBcOffersCommand(orders);
+		else await reorderOffersCommand(orders);
 		await sendCatalogUpdate();
 		revalidatePath("/admin/catalog");
+		if (catalog === "bc") revalidatePath("/admin/catalog/builder-club");
 		return { ok: true as const, data: {} };
 	});
 }
@@ -249,12 +359,21 @@ export async function updateCatalogItem({
 	id,
 	catalogFields,
 	baseItem,
+	catalog = "normal",
 }: {
 	id: number;
 	catalogFields: Record<string, unknown>;
 	baseItem?: { id: number; fields: Record<string, unknown> };
+	catalog?: "normal" | "bc";
 }) {
 	const staff = await requirePermission(PERMS.CATALOG_EDIT);
+	// BC rows have no price, points or currency column. The table is shared, so
+	// the catalog is resolved here rather than trusting the caller to strip
+	// fields the BC command would reject anyway.
+	if (catalog === "bc") {
+		const { updateBcItem } = await import("@/actions/catalog-bc");
+		return updateBcItem({ id, ...catalogFields });
+	}
 	return await withCatalogExport(async () => {
 		try {
 			await updateOfferCommand({ id, catalogFields, baseItem }, staff.id);
@@ -294,9 +413,6 @@ export async function translateCatalogItems(input: {
 			};
 		}
 		const { items } = parsed.data;
-		const { invalidateFurniDataCache } = await import(
-			"@/lib/services/catalog-items-loader"
-		);
 		const { patchFurniEntryNames } = await import("@/lib/services/furni-data");
 		const { patchLocalizedFurniDataEntries } = await import(
 			"@/lib/services/furni-data-i18n"
@@ -391,9 +507,9 @@ export async function translateCatalogItems(input: {
 			furniPatches.length > 0
 				? await patchFurniEntryNames(furniPatches)
 				: { updated: 0, inserted: 0 };
-		if (furniResult.updated > 0 || furniResult.inserted > 0) {
-			invalidateFurniDataCache();
-		}
+		// `furniResult` needs no follow-up: `patchFurniEntryNames` writes through
+		// `writeFurniData`, which resets the shared in-process cache and purges
+		// the gamedata edge tag itself.
 
 		if (localizedEntries.length > 0) {
 			try {

src/actions/catalog.ts

@@ -351,6 +351,30 @@ export async function createAutoCategory(input: {
 const MAX_ORGANIZE_GROUPS = 50;
 const MAX_ORGANIZE_ITEMS = 500;
 
+/**
+ * One page the run wrote to, described well enough for the client to fold the
+ * result into its live catalog tree. `isNew` is false when the group reused an
+ * existing destination, in which case the page already exists and every field
+ * that describes a *new* page (`parentId`, `pageLayout`, the icon) is only the
+ * requested value, not a verified read-back of the stored row.
+ */
+export interface OrganizedPageChange {
+	pageId: number;
+	caption: string;
+	parentId: number;
+	pageLayout: string;
+	iconImage: number;
+	iconColor: number;
+	orderNum: number;
+	visible: string;
+	enabled: string;
+	isNew: boolean;
+	moved: number;
+	added: number;
+	/** Import pages the offers were taken from, so counts can be rebalanced. */
+	movedFrom: Array<{ fromPageId: number; count: number }>;
+}
+
 export interface OrganizeImportGroup {
 	caption: string;
 	pageLayout: string;
@@ -378,12 +402,7 @@ export async function organizeImportFurni(input: {
 	groups: OrganizeImportGroup[];
 }): Promise<
 	ActionResult<{
-		created: Array<{
-			pageId: number;
-			caption: string;
-			moved: number;
-			added: number;
-		}>;
+		created: OrganizedPageChange[];
 	}>
 > {
 	const staff = await requirePermission(PERMS.CATALOG_EDIT);
@@ -412,12 +431,7 @@ export async function organizeImportFurni(input: {
 		);
 		const importPageIds = new Set(await getImportedCategoryPageIds());
 
-		const created: Array<{
-			pageId: number;
-			caption: string;
-			moved: number;
-			added: number;
-		}> = [];
+		const created: OrganizedPageChange[] = [];
 		let totalMoved = 0;
 		let totalAdded = 0;
 
@@ -432,15 +446,18 @@ export async function organizeImportFurni(input: {
 					error: "Invalid destination page id",
 				};
 			}
+			const isNew = destinationPageId == null;
+			const pageLayout = group.pageLayout || "default_3x3";
+			const iconImage = group.iconImage ?? 0;
 			const pageId =
 				destinationPageId ??
 				Number(
 					await createPageCommand("normal", {
 						caption: group.caption,
 						parentId: input.parentId,
-						pageLayout: group.pageLayout || "default_3x3",
+						pageLayout,
 						captionSave: group.caption.slice(0, 25),
-						iconImage: group.iconImage ?? 0,
+						iconImage,
 						iconColor: 0,
 						minRank: 1,
 						orderNum: 0,
@@ -492,6 +509,7 @@ export async function organizeImportFurni(input: {
 				),
 			];
 			const validMoveIds = new Set<number>();
+			const hostPageByItemId = new Map<number, number>();
 			if (moverIds.length > 0) {
 				const hostRows = await queryRows<{ id: number; page_id: number }>(sql`
 					SELECT id, page_id FROM catalog_items WHERE id IN (${sql.join(
@@ -500,14 +518,17 @@ export async function organizeImportFurni(input: {
 					)})
 				`);
 				for (const row of hostRows) {
-					if (importPageIds.has(Number(row.page_id))) {
+					const pageId = Number(row.page_id);
+					if (importPageIds.has(pageId)) {
 						validMoveIds.add(Number(row.id));
+						hostPageByItemId.set(Number(row.id), pageId);
 					}
 				}
 			}
 
 			let moved = 0;
 			let added = 0;
+			const movedFromCounts = new Map<number, number>();
 
 			const moveCaseOrder: string[] = [];
 			const moveCaseName: string[] = [];
@@ -534,6 +555,13 @@ export async function organizeImportFurni(input: {
 						)}'`,
 					);
 					moveIds.push(Number(row.catalogItemId));
+					const hostPageId = hostPageByItemId.get(Number(row.catalogItemId));
+					if (hostPageId != null) {
+						movedFromCounts.set(
+							hostPageId,
+							(movedFromCounts.get(hostPageId) ?? 0) + 1,
+						);
+					}
 					moved++;
 				} else {
 					await insertCatalogItemRow({
@@ -586,7 +614,24 @@ export async function organizeImportFurni(input: {
 				targetType: "catalog_page",
 				targetId: pageId,
 			});
-			created.push({ pageId, caption, moved, added });
+			created.push({
+				pageId,
+				caption,
+				parentId: input.parentId,
+				pageLayout,
+				iconImage,
+				iconColor: 0,
+				orderNum: 0,
+				visible: "1",
+				enabled: "1",
+				isNew,
+				moved,
+				added,
+				movedFrom: [...movedFromCounts].map(([fromPageId, count]) => ({
+					fromPageId,
+					count,
+				})),
+			});
 			totalMoved += moved;
 			totalAdded += added;
 		}

src/actions/commandocentrum.test.ts

@@ -52,6 +52,13 @@ const mockSetMotto = vi.hoisted(() => vi.fn());
 const mockSetRank = vi.hoisted(() => vi.fn());
 const mockExecuteCommand = vi.hoisted(() => vi.fn());
 const mockSendGift = vi.hoisted(() => vi.fn());
+// The audit service is exercised separately; here it only has to be harmless.
+// Mocked explicitly because the fake db has no `insert`, which used to leak an
+// unhandled rejection out of the fire-and-forget audit call.
+vi.mock("@/lib/services/audit", () => ({
+	logAudit: vi.fn(async () => undefined),
+}));
+
 vi.mock("@/lib/services/rcon", () => ({
 	rcon: {
 		send: mockSend,
@@ -455,3 +462,25 @@ describe("access control", () => {
 		});
 	});
 });
+
+describe("auditing", () => {
+	it("logs an entry for a currency grant", async () => {
+		const { logAudit } = await import("@/lib/services/audit");
+		await giveCredits({ userId: 1, credits: 100 });
+		expect(logAudit).toHaveBeenCalledWith(
+			expect.objectContaining({ action: expect.any(String) }),
+		);
+	});
+
+	it("completes the command even when auditing rejects", async () => {
+		const { logAudit } = await import("@/lib/services/audit");
+		vi.mocked(logAudit).mockRejectedValueOnce(new Error("audit table missing"));
+		await expect(giveCredits({ userId: 1, credits: 100 })).resolves.toEqual({
+			ok: true,
+			data: {},
+		});
+		// Let the fire-and-forget promise settle; an unhandled rejection here is
+		// exactly the failure this guards against.
+		await new Promise((r) => setTimeout(r, 0));
+	});
+});

src/actions/commandocentrum.ts

@@ -7,12 +7,35 @@ import { db, queryRows, User } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
 import { adminAction } from "@/lib/safe-action";
 import { ActionError, actionOk } from "@/lib/safe-action-shared";
+import { logAudit } from "@/lib/services/audit";
 import { rcon } from "@/lib/services/rcon";
 
 const PATH = "/admin/commandocentrum";
 
 const RCON_FAIL = "RCON command failed. Is the emulator running?";
 
+/** Currency amounts are capped: unbounded values break the hotel economy. */
+const MAX_CURRENCY = 1_000_000;
+
+/** Every mutation here gets an audit entry; rank changes and RCON most of all. */
+function auditAction(
+	userId: number,
+	action: string,
+	targetId: number,
+	after: Record<string, unknown>,
+): void {
+	// logAudit is async, so a surrounding try/catch cannot see its rejection —
+	// it would surface as an unhandled rejection and, in production, take the
+	// request down over a failing audit insert. Swallow it on the promise
+	// instead, which is what "auditing must never fail the command it
+	// describes" actually requires.
+	void Promise.resolve()
+		.then(() => logAudit({ userId, action, target: "User", targetId, after }))
+		.catch(() => {
+			/* auditing must never fail the command it describes */
+		});
+}
+
 async function requireRconOk(ok: boolean): Promise<void> {
 	if (!ok) throw new ActionError(RCON_FAIL);
 }
@@ -120,9 +143,16 @@ const giveCreditsSchema = z.object({
 export const giveCredits = adminAction(
 	{ permission: PERMS.RCON_EXECUTE, schema: giveCreditsSchema },
 	async (ctx) => {
+		if (ctx.data.credits > MAX_CURRENCY) {
+			throw new ActionError(`Amount is too large (max ${MAX_CURRENCY})`);
+		}
 		await requireRconOk(
 			await rcon.giveCredits(ctx.data.userId, ctx.data.credits),
 		);
+		auditAction(Number(ctx.session.user.id), "give_credits", ctx.data.userId, {
+			userId: ctx.data.userId,
+			amount: ctx.data.credits,
+		});
 		revalidatePath(PATH);
 		return actionOk();
 	},
@@ -137,9 +167,16 @@ const giveAmountSchema = z.object({
 export const giveDuckets = adminAction(
 	{ permission: PERMS.RCON_EXECUTE, schema: giveAmountSchema },
 	async (ctx) => {
+		if (ctx.data.amount > MAX_CURRENCY) {
+			throw new ActionError(`Amount is too large (max ${MAX_CURRENCY})`);
+		}
 		await requireRconOk(
 			await rcon.giveDuckets(ctx.data.userId, ctx.data.amount),
 		);
+		auditAction(Number(ctx.session.user.id), "give_duckets", ctx.data.userId, {
+			userId: ctx.data.userId,
+			amount: ctx.data.amount,
+		});
 		revalidatePath(PATH);
 		return actionOk();
 	},
@@ -149,9 +186,16 @@ export const giveDuckets = adminAction(
 export const giveDiamonds = adminAction(
 	{ permission: PERMS.RCON_EXECUTE, schema: giveAmountSchema },
 	async (ctx) => {
+		if (ctx.data.amount > MAX_CURRENCY) {
+			throw new ActionError(`Amount is too large (max ${MAX_CURRENCY})`);
+		}
 		await requireRconOk(
 			await rcon.giveDiamonds(ctx.data.userId, ctx.data.amount),
 		);
+		auditAction(Number(ctx.session.user.id), "give_diamonds", ctx.data.userId, {
+			userId: ctx.data.userId,
+			amount: ctx.data.amount,
+		});
 		revalidatePath(PATH);
 		return actionOk();
 	},

src/actions/import-furni.ts

@@ -1,6 +1,7 @@
 "use server";
 
 import { z } from "zod";
+import { invalidateCatalogTotals } from "@/features/catalog/server/catalog-totals";
 import { db, WebsiteSetting } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
 import { adminAction } from "@/lib/safe-action";
@@ -13,12 +14,14 @@ const deleteSchema = z.object({ classname: z.string().trim().min(1) });
 
 export const deleteImportedFurni = adminAction(
 	{ permission: PERMS.ASSETS_IMPORT, schema: deleteSchema },
-	async (ctx) =>
-		actionOk(
-			(await withCatalogExport(() =>
-				deleteImportedItem(ctx.data.classname),
-			)) as unknown as Record<string, unknown>,
-		),
+	async (ctx) => {
+		const result = (await withCatalogExport(() =>
+			deleteImportedItem(ctx.data.classname),
+		)) as unknown as Record<string, unknown>;
+		// Deleting an imported item can remove its offer and category page.
+		invalidateCatalogTotals();
+		return actionOk(result);
+	},
 );
 
 const translateToggleSchema = z.object({ enabled: z.boolean() });

src/actions/messenger.test.ts

@@ -10,8 +10,13 @@ const state = vi.hoisted(() => ({
 	deletes: [] as unknown[],
 	affectedDelete: 1,
 	emptyDeleteResult: false,
+	isAllowed: vi.fn(async () => ({ ok: true })),
 }));
 
+// The real moderation module loads the word filter through the (mocked) db,
+// which would silently change the rows the offline-message assertions read.
+vi.mock("@/lib/services/moderation", () => ({ isAllowed: state.isAllowed }));
+
 vi.mock("@/lib/db", async () => {
 	const schema = await import("@/db/schema");
 	const { createFakeDb } = await import("@/test/fake-db");
@@ -315,6 +320,18 @@ describe("sendOfflineMessage", () => {
 		expect(redirected()).toBe("/messages?send_error=invalid");
 	});
 
+	it("rejects content blocked by the word filter before storing it", async () => {
+		state.friendships = [{ id: 1 }];
+		state.isAllowed.mockResolvedValue({ ok: false, reason: "bad" });
+		await redirects(() =>
+			sendOfflineMessage(fakeForm({ friendId: "2", message: "rude words" })),
+		);
+		expect(state.isAllowed).toHaveBeenCalledWith("rude words");
+		expect(state.inserts).toHaveLength(0);
+		expect(redirected()).toBe("/messages?send_error=invalid");
+		state.isAllowed.mockResolvedValue({ ok: true });
+	});
+
 	it("stores an offline message for a friend", async () => {
 		state.friendships = [{ id: 1 }];
 		await redirects(() =>

src/actions/messenger.ts

@@ -12,6 +12,7 @@ import {
 	User,
 } from "@/lib/db";
 import { clientIp, rateLimit } from "@/lib/rate-limit";
+import { isAllowed } from "@/lib/services/moderation";
 
 type FriendOutcome =
 	| "accepted"
@@ -376,6 +377,8 @@ export async function sendOfflineMessage(formData: FormData): Promise<void> {
 						.limit(1);
 					if (!recipient) {
 						outcome = "invalid";
+					} else if (!(await isAllowed(message)).ok) {
+						outcome = "invalid";
 					} else {
 						await db.insert(MessengerOffline).values({
 							userId: friendId,

src/actions/password-reset.test.ts

@@ -1,14 +1,14 @@
 // @ts-nocheck
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
-const { selectLimit, insertOnDup, mockSendMail, mockRedirect } = vi.hoisted(
-	() => ({
+const { selectLimit, selectWhere, insertOnDup, mockSendMail, mockRedirect } =
+	vi.hoisted(() => ({
 		selectLimit: vi.fn(),
 		insertOnDup: vi.fn().mockResolvedValue({}),
+		selectWhere: vi.fn(() => Promise.resolve([] as Array<{ id: number }>)),
 		mockSendMail: vi.fn(),
 		mockRedirect: vi.fn(),
-	}),
-);
+	}));
 
 vi.mock("next/navigation", () => ({
 	redirect: (...args: unknown[]) => {
@@ -24,6 +24,17 @@ vi.mock("@/lib/db", () => {
 				from: vi.fn(() => ({
 					where: vi.fn(() => ({
 						limit: selectLimit,
+						// Matches the deterministic `.orderBy(asc(User.id))` list
+						// reads used to resolve duplicate addresses.
+						orderBy: vi.fn(() => ({
+							// biome-ignore lint/suspicious/noThenProperty: Drizzle query thenable mock
+							then(
+								resolve: (v: unknown) => void,
+								reject: (e: unknown) => void,
+							) {
+								return Promise.resolve(selectWhere()).then(resolve, reject);
+							},
+						})),
 					})),
 				})),
 			})),
@@ -70,13 +81,14 @@ beforeEach(() => {
 describe("requestReset", () => {
 	it("sends a reset email when the user exists", async () => {
 		selectLimit.mockResolvedValue([{ id: 1 }]);
+		selectWhere.mockResolvedValue([{ id: 1 }]);
 
 		const fd = new FormData();
 		fd.set("email", "[email protected]");
 
 		await expect(requestReset(fd)).rejects.toThrow("redirect");
 
-		expect(selectLimit).toHaveBeenCalled();
+		expect(selectWhere).toHaveBeenCalled();
 		expect(insertOnDup).toHaveBeenCalled();
 		expect(mockSendMail).toHaveBeenCalledWith(
 			"[email protected]",
@@ -87,6 +99,7 @@ describe("requestReset", () => {
 
 	it("does not send email when user is not found", async () => {
 		selectLimit.mockResolvedValue([]);
+		selectWhere.mockResolvedValue([]);
 
 		const fd = new FormData();
 		fd.set("email", "[email protected]");

src/actions/password-reset.ts

@@ -1,11 +1,14 @@
 "use server";
 
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-import { eq } from "drizzle-orm";
+import { asc, eq } from "drizzle-orm";
 import { redirect } from "next/navigation";
 import { env } from "@/env";
+import { invalidateLoginCache } from "@/lib/auth/login-core";
 import { hashPassword } from "@/lib/auth/password";
+import { revokeUserCredentials } from "@/lib/auth/session-revocation";
 import { db, PasswordReset, User } from "@/lib/db";
+import { logger } from "@/lib/logger";
 import { clientIp, rateLimit } from "@/lib/rate-limit";
 import { logServerError } from "@/lib/server-log";
 import { captchaConfig, verifyCaptcha } from "@/lib/services/captcha";
@@ -17,6 +20,17 @@ function sha256(s: string): string {
 	return createHash("sha256").update(s).digest("hex");
 }
 
+/**
+ * Back to the reset form with a *code*, never with the human-readable message:
+ * a raw `?error=` value would be rendered on our own domain, which is a
+ * perfect phishing skeleton. The page maps each code to a translation.
+ */
+function errorRedirect(email: string, token: string, code: string): never {
+	return redirect(
+		`/reset?email=${encodeURIComponent(email)}&token=${encodeURIComponent(token)}&error=${code}`,
+	);
+}
+
 export async function requestReset(formData: FormData): Promise<void> {
 	const email = String(formData.get("email") ?? "")
 		.normalize("NFC")
@@ -40,12 +54,23 @@ export async function requestReset(formData: FormData): Promise<void> {
 	// Always respond the same way so we don't reveal which emails exist.
 	if (allowed && /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
 		try {
-			const [user] = await db
+			const matches = await db
 				.select({ id: User.id })
 				.from(User)
 				.where(eq(User.mail, email))
-				.limit(1);
+				.orderBy(asc(User.id));
+			if (matches.length > 1) {
+				logger.warn("Password reset address is not unique", {
+					email,
+					accountCount: matches.length,
+					using: matches[0]?.id,
+				});
+			}
+			const user = matches[0];
 			if (user) {
+				// Duplicate addresses exist on legacy databases; resetting the
+				// *oldest* account keeps the choice deterministic instead of
+				// "whatever row the engine returns first".
 				const token = randomBytes(32).toString("hex");
 				const hashed = sha256(token);
 				const createdAt = new Date();
@@ -80,13 +105,11 @@ export async function resetPassword(formData: FormData): Promise<void> {
 
 	// Throttle reset attempts per IP (5 per 15 min) to prevent token brute-force.
 	if (!(await rateLimit(`resetpwd:${await clientIp()}`, 5, 15 * 60_000)).ok) {
-		redirect(
-			`/reset?email=${encodeURIComponent(email)}&token=${encodeURIComponent(token)}&error=${encodeURIComponent("Too many attempts — try again later")}`,
-		);
+		redirect(errorRedirect(email, token, "ratelimit"));
 	}
 
-	let error: string | null = null;
-	if (password.length < 6) error = "Password must be at least 6 characters";
+	let error: "password" | "invalid" | "failed" | null = null;
+	if (password.length < 12) error = "password";
 
 	if (!error) {
 		try {
@@ -107,20 +130,29 @@ export async function resetPassword(formData: FormData): Promise<void> {
 				row != null && a.length === b.length && timingSafeEqual(a, b);
 
 			if (!row || !fresh || !match) {
-				error = "This reset link is invalid or has expired";
+				error = "invalid";
 			} else {
-				const [user] = await db
+				const matches = await db
 					.select({ id: User.id })
 					.from(User)
 					.where(eq(User.mail, email))
-					.limit(1);
+					.orderBy(asc(User.id));
+				const user = matches[0];
 				if (!user) {
-					error = "Account not found";
+					error = "invalid";
 				} else {
-					await db
-						.update(User)
-						.set({ password: await hashPassword(password) })
-						.where(eq(User.id, user.id));
+					const newHash = await hashPassword(password);
+					// A password change has to end every existing session: the
+					// popular reason for resetting is a compromised account, and a
+					// stolen cookie/API token must not outlive the reset.
+					await Promise.all([
+						db
+							.update(User)
+							.set({ password: newHash })
+							.where(eq(User.id, user.id)),
+						revokeUserCredentials(user.id),
+					]);
+					await invalidateLoginCache(email);
 					await db
 						.delete(PasswordReset)
 						.where(eq(PasswordReset.email, email))
@@ -132,14 +164,12 @@ export async function resetPassword(formData: FormData): Promise<void> {
 				}
 			}
 		} catch {
-			error = "Could not reset the password — try again";
+			error = "failed";
 		}
 	}
 
 	if (error) {
-		redirect(
-			`/reset?email=${encodeURIComponent(email)}&token=${encodeURIComponent(token)}&error=${encodeURIComponent(error)}`,
-		);
+		redirect(errorRedirect(email, token, error));
 	}
 	redirect("/login?reset=1");
 }

src/actions/permissions.ts

@@ -175,8 +175,10 @@ export const setCmsPermissions = adminAction(
 );
 
 /**
- * Re-apply the same grant repair as migration 0018:
- * - ranks with admin.dashboard get all admin.*
+ * Re-apply the grant repair from migration 0018/0034:
+ * - ranks with admin.dashboard get all admin.*.view (read-only: the sidebar
+ *   needs to open, nothing more — a blanket `admin.%` grant here is what
+ *   promoted rank 6 to full admin)
  * - ranks >= 6 get admin.*.view + dashboard
  * - ranks >= 7 get edit/manage/execute tools used by the sidebar
  */
@@ -187,7 +189,9 @@ export const repairAdminNavAclGrants = adminAction(
 			INSERT INTO \`acl_model_permissions\` (\`model_type\`, \`model_id\`, \`permission_id\`)
 			SELECT 'Role', ar.id, ap.id
 			FROM \`acl_roles\` ar
-			JOIN \`acl_permissions\` ap ON ap.slug LIKE 'admin.%'
+			-- View slugs only: widening this to all admin.* turned "can open the
+			-- panel" into "is a full admin" for every mid rank (see 0034).
+			JOIN \`acl_permissions\` ap ON ap.slug LIKE 'admin.%' AND ap.slug LIKE '%.view'
 			WHERE EXISTS (
 			  SELECT 1
 			  FROM \`acl_model_permissions\` amp

src/actions/register.test.ts

@@ -184,6 +184,7 @@ describe("register", () => {
 		expect(result).toEqual({
 			error: "Username must be at least 3 characters",
 			ok: false,
+			code: "usernameMinLength",
 		});
 		expect(state.insert).not.toHaveBeenCalled();
 	});
@@ -191,6 +192,7 @@ describe("register", () => {
 	it("rejects usernames containing characters outside the allowed set", async () => {
 		const result = await register(PREV, buildForm({ username: "bad name!" }));
 		expect(result.error).toContain("letters, numbers, underscore and hyphen");
+		expect(result.code).toBe("usernamePattern");
 		expect(state.insert).not.toHaveBeenCalled();
 	});
 
@@ -199,6 +201,7 @@ describe("register", () => {
 		expect(result).toEqual({
 			error: "Enter a valid email address",
 			ok: false,
+			code: "emailValid",
 		});
 	});
 
@@ -207,6 +210,7 @@ describe("register", () => {
 		expect(result).toEqual({
 			error: "Password must be at least 12 characters",
 			ok: false,
+			code: "passwordMinLength",
 		});
 		expect(state.insert).not.toHaveBeenCalled();
 	});
@@ -220,6 +224,7 @@ describe("register", () => {
 			}),
 		);
 		expect(result.error).toContain("uppercase");
+		expect(result.code).toBe("passwordUpper");
 	});
 
 	it("rejects passwords without a digit", async () => {
@@ -231,6 +236,7 @@ describe("register", () => {
 			}),
 		);
 		expect(result.error).toContain("digit");
+		expect(result.code).toBe("passwordDigit");
 	});
 
 	it("rejects passwords without a special character", async () => {
@@ -242,6 +248,7 @@ describe("register", () => {
 			}),
 		);
 		expect(result.error).toContain("special");
+		expect(result.code).toBe("passwordSpecial");
 	});
 
 	it("rejects mismatched password confirmations", async () => {
@@ -249,13 +256,18 @@ describe("register", () => {
 			PREV,
 			buildForm({ password_confirmation: "Different1" }),
 		);
-		expect(result).toEqual({ error: "Passwords do not match", ok: false });
+		expect(result).toEqual({
+			error: "Passwords do not match",
+			ok: false,
+			code: "passwordsMatch",
+		});
 	});
 
 	it("throttles sign-ups per IP", async () => {
 		state.rateLimit.mockResolvedValueOnce({ ok: false, retryAfter: 120 });
 		const result = await runValidRegistration();
 		expect(result.error).toContain("Too many sign-up attempts");
+		expect(result.code).toBe("rateLimited");
 		expect(state.insert).not.toHaveBeenCalled();
 	});
 
@@ -273,6 +285,7 @@ describe("register", () => {
 		expect(result).toEqual({
 			error: "Captcha verification failed. Please try again.",
 			ok: false,
+			code: "captchaFailed",
 		});
 		expect(state.verifyCaptcha).toHaveBeenCalledWith("token", "203.0.113.9");
 		expect(state.insert).not.toHaveBeenCalled();
@@ -290,6 +303,7 @@ describe("register", () => {
 		expect(result).toEqual({
 			error: "You must accept the terms and conditions to register.",
 			ok: false,
+			code: "termsRequired",
 		});
 		expect(state.insert).not.toHaveBeenCalled();
 	});
@@ -298,7 +312,11 @@ describe("register", () => {
 		state.checkVpn.mockResolvedValue({ blocked: true });
 		state.siteGet.mockResolvedValueOnce("Custom VPN message");
 		const result = await runValidRegistration();
-		expect(result).toEqual({ error: "Custom VPN message", ok: false });
+		expect(result).toEqual({
+			error: "Custom VPN message",
+			ok: false,
+			code: "vpnBlocked",
+		});
 		expect(state.insert).not.toHaveBeenCalled();
 	});
 
@@ -317,6 +335,7 @@ describe("register", () => {
 		state.countTotal = 2;
 		const result = await runValidRegistration();
 		expect(result.error).toContain("maximum number of accounts");
+		expect(result.code).toBe("maxAccountsPerIp");
 		expect(state.insert).not.toHaveBeenCalled();
 	});
 
@@ -340,6 +359,7 @@ describe("register", () => {
 		expect(result).toEqual({
 			error: "That username is already taken",
 			ok: false,
+			code: "usernameTaken",
 		});
 		expect(state.insert).not.toHaveBeenCalled();
 	});
@@ -350,6 +370,7 @@ describe("register", () => {
 		expect(result).toEqual({
 			error: "Registration is temporarily unavailable",
 			ok: false,
+			code: "unavailable",
 		});
 		expect(state.logger.warn).toHaveBeenCalledWith(
 			"Username uniqueness check failed during registration",
@@ -365,6 +386,7 @@ describe("register", () => {
 		expect(result).toEqual({
 			error: "That username is already taken",
 			ok: false,
+			code: "usernameTaken",
 		});
 		expect(state.logger.error).not.toHaveBeenCalled();
 	});
@@ -373,6 +395,7 @@ describe("register", () => {
 		state.insert.mockRejectedValueOnce(new Error("db exploded"));
 		const result = await runValidRegistration();
 		expect(result.error).toContain("Could not create the account");
+		expect(result.code).toBe("createFailed");
 		expect(state.logger.error).toHaveBeenCalledWith(
 			"Account creation failed",
 			expect.objectContaining({ message: "db exploded" }),

src/actions/register.ts

@@ -121,19 +121,72 @@ const registerSchema = z
 		path: ["passwordConfirmation"],
 	});
 
+/**
+ * Stable, locale-independent reason for a failed sign-up. The client maps these
+ * onto `pages.register.<code>` so the form speaks the visitor's language; the
+ * English `error` string stays as a fallback and for API/log consumers.
+ */
+export type RegisterErrorCode =
+	| "usernameMinLength"
+	| "usernameMaxLength"
+	| "usernamePattern"
+	| "usernameReserved"
+	| "usernameTaken"
+	| "emailValid"
+	| "emailDisposable"
+	| "passwordMinLength"
+	| "passwordMaxLength"
+	| "passwordUpper"
+	| "passwordLower"
+	| "passwordDigit"
+	| "passwordSpecial"
+	| "passwordsMatch"
+	| "termsRequired"
+	| "captchaFailed"
+	| "rateLimited"
+	| "vpnBlocked"
+	| "maxAccountsPerIp"
+	| "unavailable"
+	| "createFailed"
+	| "invalidInput";
+
+/** Maps the schema's English messages onto locale-independent codes. */
+const ZOD_MESSAGE_CODES: Record<string, RegisterErrorCode> = {
+	"Username must be at least 3 characters": "usernameMinLength",
+	"Username must be at most 25 characters": "usernameMaxLength",
+	"Username may only contain letters, numbers, underscore and hyphen":
+		"usernamePattern",
+	"This username is reserved": "usernameReserved",
+	"Enter a valid email address": "emailValid",
+	"Temporary email domains are not allowed": "emailDisposable",
+	"Password must be at least 12 characters": "passwordMinLength",
+	"Password is too long": "passwordMaxLength",
+	"Password must contain at least one uppercase letter": "passwordUpper",
+	"Password must contain at least one lowercase letter": "passwordLower",
+	"Password must contain at least one digit": "passwordDigit",
+	"Password must contain at least one special character": "passwordSpecial",
+	"Passwords do not match": "passwordsMatch",
+};
+
 // A valid starter Habbo figure so the avatar renders in-client immediately.
 const DEFAULT_LOOK = "hr-100-.hd-180-1.ch-255-66.lg-280-110.sh-305-62";
 
 export interface RegisterState {
 	error: string | null;
 	ok: boolean;
+	/** Locale-independent reason, present on every failure. */
+	code?: RegisterErrorCode;
 }
 
 export async function register(
 	_prevState: RegisterState,
 	formData: FormData,
 ): Promise<RegisterState> {
-	const fail = (error: string): RegisterState => ({ error, ok: false });
+	const fail = (error: string, code: RegisterErrorCode): RegisterState => ({
+		error,
+		ok: false,
+		code,
+	});
 	const raw = {
 		username: String(formData.get("username") ?? "")
 			.normalize("NFC")
@@ -155,7 +208,8 @@ export async function register(
 
 	const parsed = registerSchema.safeParse(raw);
 	if (!parsed.success) {
-		return fail(parsed.error.issues[0]?.message ?? "Invalid input");
+		const message = parsed.error.issues[0]?.message ?? "Invalid input";
+		return fail(message, ZOD_MESSAGE_CODES[message] ?? "invalidInput");
 	}
 
 	const { username, mail, password, look } = parsed.data;
@@ -166,6 +220,7 @@ export async function register(
 	if (!(await rateLimit(`register:${ip}`, 5, 10 * 60_000)).ok) {
 		return fail(
 			"Too many sign-up attempts. Please wait a few minutes and try again.",
+			"rateLimited",
 		);
 	}
 
@@ -174,18 +229,25 @@ export async function register(
 	if (cfg.provider !== "none") {
 		const token = String(formData.get(cfg.field) ?? "").normalize("NFC");
 		if (!(await verifyCaptcha(token, ip)))
-			return fail("Captcha verification failed. Please try again.");
+			return fail(
+				"Captcha verification failed. Please try again.",
+				"captchaFailed",
+			);
 	}
 
 	// Terms acceptance check.
 	if (!raw.termsAccepted)
-		return fail("You must accept the terms and conditions to register.");
+		return fail(
+			"You must accept the terms and conditions to register.",
+			"termsRequired",
+		);
 
 	// VPN/proxy block (only when enabled in /admin/vpn).
 	if ((await checkVpn(ip)).blocked) {
 		return fail(
 			(await siteSettings.get("vpn_block_message", "")) ||
 				"Registrations from VPN/proxy connections are not allowed.",
+			"vpnBlocked",
 		);
 	}
 
@@ -200,6 +262,7 @@ export async function register(
 		if (Number(row?.total ?? 0) >= max)
 			return fail(
 				"You have reached the maximum number of accounts for your connection.",
+				"maxAccountsPerIp",
 			);
 	}
 
@@ -210,10 +273,11 @@ export async function register(
 			.from(User)
 			.where(eq(User.username, username))
 			.limit(1);
-		if (existing) return fail("That username is already taken");
+		if (existing)
+			return fail("That username is already taken", "usernameTaken");
 	} catch {
 		logger.warn("Username uniqueness check failed during registration");
-		return fail("Registration is temporarily unavailable");
+		return fail("Registration is temporarily unavailable", "unavailable");
 	}
 
 	const now = Math.floor(Date.now() / 1000);
@@ -233,7 +297,7 @@ export async function register(
 	} catch (err) {
 		const code = (err as { cause?: { code?: string } }).cause?.code;
 		if (code === "ER_DUP_ENTRY") {
-			return fail("That username is already taken");
+			return fail("That username is already taken", "usernameTaken");
 		}
 		logger.error("Account creation failed", {
 			code,
@@ -241,6 +305,7 @@ export async function register(
 		});
 		return fail(
 			"Could not create the account. Please try again or contact staff.",
+			"createFailed",
 		);
 	}
 

src/actions/rooms.test.ts

@@ -76,14 +76,17 @@ describe("rooms actions", () => {
 		});
 		state.del.mockResolvedValue([{ affectedRows: 1 }]);
 		state.update.mockResolvedValue([{ affectedRows: 1 }]);
+		// The item/room ownership lookups must find their row.
+		state.roomRows = [{ name: "Lobby" }, { id: 4 }];
 	});
 
 	it("requires the ROOMS_EDIT permission for updateRoomItem", async () => {
-		await updateRoomItem({ roomId: 9, itemId: 4, custom: "x" });
+		// `custom` is not an allow-listed column, so it must never reach `.set()`.
+		await updateRoomItem({ roomId: 9, itemId: 4, rot: 4, custom: "x" });
 		expect(state.requirePermission).toHaveBeenCalledWith("admin.room.edit");
 		expect(state.update).toHaveBeenCalledWith(
 			Items,
-			{ custom: "x" },
+			{ rot: 4 },
 			expect.anything(),
 		);
 		expect(state.logStaffActivity).toHaveBeenCalledWith(

src/actions/rooms.ts

@@ -9,16 +9,63 @@ import { rcon } from "@/lib/services/rcon";
 import { logStaffActivity } from "@/lib/services/staff-activity";
 import { notify } from "@/lib/services/webhook";
 
+// Only these columns may be patched from the client. Spreading the whole payload
+// into `.set()` let a caller rewrite roomId/userId/extraData of any row, which
+// is mass assignment and IDOR in one.
+const ROOM_ITEM_FIELDS = [
+	"wallPos",
+	"x",
+	"y",
+	"z",
+	"rot",
+	"extraData",
+	"wiredData",
+	"limitedData",
+	"guildId",
+] as const;
+
+const ROOM_FIELDS = ["name", "description", "state", "usersMax"] as const;
+
+function pickAllowed(
+	fields: Record<string, unknown>,
+	allowed: readonly string[],
+): Record<string, unknown> {
+	const out: Record<string, unknown> = {};
+	for (const key of allowed) {
+		if (Object.hasOwn(fields, key) && fields[key] !== undefined) {
+			out[key] = fields[key];
+		}
+	}
+	return out;
+}
+
+function toPositiveInt(value: unknown): number | null {
+	const n = typeof value === "number" ? value : Number(value);
+	return Number.isInteger(n) && n > 0 ? n : null;
+}
+
 export async function updateRoomItem(payload: Record<string, unknown>) {
 	const staff = await requirePermission(PERMS.ROOMS_EDIT);
-	const { roomId, itemId, ...data } = payload as {
-		roomId: number;
-		itemId: number;
-		[key: string]: unknown;
-	};
+	const roomId = toPositiveInt(payload.roomId);
+	const itemId = toPositiveInt(payload.itemId);
+	if (!roomId || !itemId) {
+		throw new Error("Invalid room or item id");
+	}
+	// The item must belong to the room the staff member is editing.
+	const [item] = await db
+		.select({ id: Items.id })
+		.from(Items)
+		.where(and(eq(Items.id, itemId), eq(Items.roomId, roomId)))
+		.limit(1);
+	if (!item) throw new Error("Item not found in this room");
+
 	await db
 		.update(Items)
-		.set(data as Partial<typeof Items.$inferInsert>)
+		.set(
+			pickAllowed(payload, ROOM_ITEM_FIELDS) as Partial<
+				typeof Items.$inferInsert
+			>,
+		)
 		.where(eq(Items.id, itemId));
 	await logStaffActivity({
 		staffId: staff.id,
@@ -117,24 +164,20 @@ export async function deleteRoom({ id }: { id: number }) {
 	revalidatePath("/admin/rooms");
 }
 
-export async function updateRoom({
-	id,
-	...data
-}: {
-	id: number;
-	name?: string;
-	description?: string;
-	state?: string;
-	usersMax?: number;
-}) {
+export async function updateRoom({ id, ...data }: Record<string, unknown>) {
 	const staff = await requirePermission(PERMS.ROOMS_EDIT);
-	await db.update(Rooms).set(data).where(eq(Rooms.id, id));
+	const roomId = toPositiveInt(id);
+	if (!roomId) throw new Error("Invalid room id");
+	await db
+		.update(Rooms)
+		.set(pickAllowed(data, ROOM_FIELDS) as Partial<typeof Rooms.$inferInsert>)
+		.where(eq(Rooms.id, roomId));
 	await logStaffActivity({
 		staffId: staff.id,
 		action: "room_update",
-		description: `Updated room #${id}`,
+		description: `Updated room #${roomId}`,
 		targetType: "room",
-		targetId: id,
+		targetId: roomId,
 	});
-	revalidatePath(`/admin/rooms/${id}`);
+	revalidatePath(`/admin/rooms/${roomId}`);
 }

src/actions/social.test.ts

@@ -14,8 +14,13 @@ const state = vi.hoisted(() => ({
 	selectQueue: [] as Queue,
 	rows: [] as Array<Record<string, unknown>>,
 	failInsert: false,
+	isAllowed: vi.fn(async () => ({ ok: true })),
 }));
 
+// The real moderation module loads the word filter through the (mocked) db
+// select queue, which would shift the rows the forum assertions rely on.
+vi.mock("@/lib/services/moderation", () => ({ isAllowed: state.isAllowed }));
+
 vi.mock("next/cache", () => ({ revalidatePath: state.revalidatePath }));
 vi.mock("next/navigation", () => ({
 	redirect: (path: string) => {
@@ -210,6 +215,7 @@ describe("postThread", () => {
 		state.failInsert = false;
 		state.selectQueue = [];
 		state.rows = [];
+		state.isAllowed.mockResolvedValue({ ok: true });
 		state.transaction.mockImplementation(
 			async (fn: (tx: unknown) => Promise<unknown>, txDb: unknown) => fn(txDb),
 		);
@@ -283,6 +289,18 @@ describe("postThread", () => {
 		expect(state.insert).not.toHaveBeenCalled();
 	});
 
+	it("rejects content blocked by the word filter before hitting the db", async () => {
+		state.isAllowed.mockResolvedValue({ ok: false, reason: "bad" });
+		state.selectQueue = [[{ id: 10 }]];
+		await expect(postThread(threadForm())).rejects.toThrow(
+			"/guilds/10/forum/new?error=invalid",
+		);
+		expect(state.isAllowed).toHaveBeenCalledWith(
+			"Welcome thread Hello from the community",
+		);
+		expect(state.insert).not.toHaveBeenCalled();
+	});
+
 	it("reports not_found when the guild does not exist", async () => {
 		state.selectQueue = [[]];
 		await expect(postThread(threadForm())).rejects.toThrow(
@@ -324,6 +342,7 @@ describe("replyToThread", () => {
 		state.failInsert = false;
 		state.selectQueue = [];
 		state.rows = [];
+		state.isAllowed.mockResolvedValue({ ok: true });
 		state.transaction.mockImplementation(
 			async (fn: (tx: unknown) => Promise<unknown>, txDb: unknown) => fn(txDb),
 		);
@@ -361,6 +380,16 @@ describe("replyToThread", () => {
 		expect(state.update.mock.calls[0][1]).toMatchObject({ postsCount: 1 });
 	});
 
+	it("rejects a reply blocked by the word filter before hitting the db", async () => {
+		state.isAllowed.mockResolvedValue({ ok: false, reason: "bad" });
+		state.selectQueue = [[{ id: 20, locked: 0, postsCount: 3 }]];
+		await expect(replyToThread(replyForm())).rejects.toThrow(
+			"/guilds/10/forum/20?error=invalid",
+		);
+		expect(state.isAllowed).toHaveBeenCalledWith("A thoughtful reply");
+		expect(state.insert).not.toHaveBeenCalled();
+	});
+
 	it("rejects missing or non-positive ids by redirecting to /guilds", async () => {
 		await expect(replyToThread(replyForm({ guildId: "abc" }))).rejects.toThrow(
 			"/guilds",

src/actions/social.ts

@@ -13,6 +13,7 @@ import {
 	MessengerFriendships,
 } from "@/lib/db";
 import { clientIp, rateLimit } from "@/lib/rate-limit";
+import { isAllowed } from "@/lib/services/moderation";
 
 // Guild forum subjects are VARCHAR(255); the comment/message body lives in
 // guilds_forums_comments.message which is TEXT. Keep the first post's message
@@ -235,6 +236,8 @@ export async function postThread(formData: FormData): Promise<void> {
 					.slice(0, MESSAGE_MAX);
 				if (!subject || !message) {
 					outcome = "invalid";
+				} else if (!(await isAllowed(`${subject} ${message}`)).ok) {
+					outcome = "invalid";
 				} else {
 					const now = Math.floor(Date.now() / 1000);
 
@@ -326,6 +329,8 @@ export async function replyToThread(formData: FormData): Promise<void> {
 					.slice(0, MESSAGE_MAX);
 				if (!message) {
 					outcome = "invalid";
+				} else if (!(await isAllowed(message)).ok) {
+					outcome = "invalid";
 				} else {
 					const now = Math.floor(Date.now() / 1000);
 

src/actions/twofactor.ts

@@ -78,6 +78,22 @@ async function verifyTwoFactorCode(
 export async function beginTwoFactor(): Promise<void> {
 	const id = await sessionUserId();
 	if (!env.APP_KEY) redirect("/settings/2fa?error=noappkey");
+
+	if (!(await rateLimit(`2fa-begin:${id}`, 5, 30_000)).ok)
+		redirect("/settings/2fa?error=ratelimit");
+
+	// Re-running this action while 2FA is confirmed would be a silent *downgrade*
+	// (the new secret is stored unconfirmed, and unconfirmed means "login gate
+	// off"), so the existing setup has to be disabled through the proper flow
+	// first: a valid code, not just an authenticated session.
+	const [current] = await db
+		.select({ twoFactorConfirmedAt: User.twoFactorConfirmedAt })
+		.from(User)
+		.where(eq(User.id, id))
+		.limit(1);
+	if (current?.twoFactorConfirmedAt)
+		redirect("/settings/2fa?error=alreadyenabled");
+
 	const secret = generateTotpSecret();
 	const encrypted = new LaravelEncrypter(env.APP_KEY).encrypt(secret);
 	const codes = generateRecoveryCodes();
@@ -104,12 +120,19 @@ export async function confirmTwoFactor(formData: FormData): Promise<void> {
 		.normalize("NFC")
 		.trim();
 
-	const { ok } = await verifyTwoFactorCode(id, code);
+	const { ok, updatedRecoveryCodes } = await verifyTwoFactorCode(id, code);
 	if (!ok) redirect("/settings/2fa?error=badcode");
 
+	// A recovery code spends itself on use, so persist the remainder together
+	// with the confirmation instead of dropping the caller's own update.
 	await db
 		.update(User)
-		.set({ twoFactorConfirmedAt: new Date() })
+		.set({
+			twoFactorConfirmedAt: new Date(),
+			...(updatedRecoveryCodes !== undefined
+				? { twoFactorRecoveryCodes: updatedRecoveryCodes }
+				: {}),
+		})
 		.where(eq(User.id, id));
 	redirect("/settings/2fa?enabled=1");
 }