AgeCommit message (Collapse)AuthorLines
Drop the snapshot format from the query commentBryce Kwon-1/+1
A snapshot's format comes from the suffix of its filename in the path, not from the query string.
Name every default asset link in the configsBryce Kwon-11/+11
The nginx sub-path recipe moved only the stylesheet and the logo, and left the script and the icon pointing at the domain root.
Pin the server configs to the releases they suitBryce Kwon-1/+7
Each release named is the one its project's own site listed as current on 2026-10-29.
Mark a page behind an auth filter privateBryce Kwon-14/+15
Only the login page carried a Cache-Control, so a page an auth filter had let a visitor see could be kept by a cache shared with the next visitor. The page also varies on the cookie that got them in.
Unify the docs, samples and extensionsBryce Kwon-15/+12
Refresh the server configs and drop unsafe-inlineBryce Kwon-94/+71
style-src allowed inline styles only for the diffstat bars, which take their width from colspan instead. t0004 now checks that the three configs pin the same policy.
Refuse unknown and spoofed hostnames in nginx.confBryce Kwon-0/+31
Rework the response headers in the server configsBryce Kwon-30/+132
Drop the Last-Modified, Expires and ETag headersBryce Kwon-1/+11
Make the server configs complete standalone filesBryce Kwon-219/+410
Reorganise the tree into vendor/ and custom/Bryce Kwon-0/+477