Ships the cross-cutting hardening set:
- SecurityHeadersMiddleware: per-request nonce-based CSP, HSTS
(production only), Referrer-Policy, Permissions-Policy,
X-Content-Type-Options, frame-ancestors 'none', form-action 'self'.
- AccessLogMiddleware: one http_request INFO event per request
(method/path/status/duration_ms/ip/ua). Skips /healthz, redacts
/admin/auth/consume/<token> paths, logs 500 + re-raises on
downstream exceptions.
- Public base.html inline nav-toggle script gets a nonce so it
passes strict CSP without relaxing to 'unsafe-inline'.
- Dockerfile: non-root app user (uid/gid 10001) + stdlib-only
HEALTHCHECK against /healthz.
- scripts/backup.sh: sqlite3 .backup + tar data/media with
14-entry retention; host-side cron install documented.
- .gitea/workflows/build-image.yml: on push to master /
workflow_dispatch, builds and publishes
git.sneakygeek.net/ptarrant/chicken_babies_site:latest +
sha-<short>, with GIT_COMMIT_SHA threaded as a build-arg so
/healthz keeps reporting the right commit in deployed images.
- 8 new tests (security headers + access log).
Pre-existing dev failures (logo asset rename + RESEND env
pollution) remain unchanged; verified not Phase 6 regressions.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Phase 1 brand palette reused --c-sky for both the header background and
the word "Babies" inside the logo art, erasing it visually. Same class
of problem hit the contact page mailto callout.
- Split logo into chick mark + HTML site title so the wordmark colors
no longer need to coexist with the header surface. Generator gains
build_logo_mark_{png,webp} with a widest-gap column scan to crop.
- Header moves to --c-wheat; nav active state flips to ink pill with
cream text; muted Shop link reads as coming-soon (italic + dim +
not-allowed).
- Contact page mailto callout reskinned to ink/cream (strong CTA) and
form note shifts from pale sky-deep to ink at 70% opacity.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Ship base Jinja layout (header/nav/main/footer with skip link and aria-current),
mobile-first single-file CSS using the ROADMAP palette tokens, and four public
routes: /, /about, /contact, /shop. Blog index renders via a stable
PostService.list_published() stub returning [] — Phase 2 only swaps the body.
About is static placeholder copy, /contact ships an inert form plus a mailto:
link driven by ADMIN_CONTACT_EMAIL, /shop shows a "Coming soon" card.
Adds a Pillow-based scripts/generate_static_assets.py producing resized logo
PNG + WebP, multi-size favicon.ico, and a 180x180 apple-touch-icon on a cream
background. Outputs committed for a reproducible build.
Also ship docs/MANUAL_TESTING.md with per-route / responsive / a11y / static-
asset checklists, and mark Phase 1 complete in docs/ROADMAP.md.
