4 Commits

Include renames

Author	SHA1	Message	Date
shadowdaoandClaude Opus 4.7	6ee2cf13b0	kb(whp/admin): document panel HSTS + VM-rebuild lockout recovery ... The WHP panel sends Strict-Transport-Security max-age=31536000 includeSubDomains on every response (correct for prod). When a server is rebuilt, the regenerated self-signed cert no longer matches what the admin's browser cached as HSTS-valid, and there is no clickable 'proceed unsafely' escape — the admin is locked out of their own panel by hostname. Add a Caution Aside under Network & SSL describing the symptom, the two-browser HSTS confirmation pattern, and the three recovery paths (IP-direct + LE issuance, browser HSTS clear, real cert preserved across rebuilds). Frames LE issuance as a first-day operation, not an incident response. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-29 09:21:08 -07:00
shadowdao	33d1da92ca	docs(admin): add Data-drive encryption (LUKS) article ... Covers the opt-in LUKS2 encryption of /docker available on new server installs. Reboot UX (web unlock at :8444, SSH fallback), threat model in plain English, what LUKS does and doesn't protect against, header backup handling, passphrase rotation outline, and the "do not enable this if you need unattended reboots" caveat. Sidebar order 7 (after Backups in the admin section). Linked from the admin overview "What's in this section" list and from the VDS comparison section of "What is containerized hosting?". No cost / pricing language by design — operational positioning is still being decided.	2026-05-23 08:59:16 -07:00
shadowdao	119d376029	docs(admin): rewrite + extend WHP super-admin section from real UI ... Verified every page against the live admin panel on whp01 (read-only). Five existing articles rewritten; one new article added; customer-facing backups article updated to match server reality. Article changes - overview: super admin = the root user only (no UI to add another); WHMCS portal route doesn't apply for admin; accurate sidebar map of every admin-only section; customer backups don't cover server config (multiple locations, not just /etc — full-server backup is the right safety net). - server-settings: walked all six tabs (System / Services / Mail / DNS / Network & SSL / Security); clarified that host Apache + PHP-FPM serve the WHP control panel, not customer sites; that MySQL runs as a container so host MySQL config is client-facing; that custom container needs are met by publishing a custom Docker image (linked to repo.anhonesthost.net/cloud-hosting-platform/ for examples). - coraza-waf: real Firing rules / CRS catalog / Activity tabs; global WAF mode pill (off/detect/enforce); per-rule + per-host overrides; Ask AI link; security.db source-of-truth + SIGHUP reload note. - site-monitoring: split into the three actual admin pages — AI Monitor dashboard, Issues, Ignore Rules — with stat tiles + health-check timeline + ignore-rule AND-semantics. - user-management: account types corrected to full / domain_dns / mail_dns (verified in web-files/pages/user-management.php:26); system users are protected against deletion (verified is_protected_user in web-files/libs/usermgmt.php:697); delegated users are admin-editable (not read-only); suspension page is served by haproxy's 503 errorfile (verified in haproxy-manager-base/haproxy_tarpit_config.txt:31) so troubleshooting points at haproxy reload / container logs. - new admin/backups: customer-data backups vs full-server backups; auto-backups only run with a default target; how to add global vs per-customer targets; how to fire on-demand backups for any user; troubleshooting around missing targets / failed test / disk pressure. - how-to/backups (customer): aside about default-target requirement; new section explaining what full-server backups cover vs customer backups (managed plans + VDS covered by AnHonestHost; elsewhere is the server operator's responsibility). New components / tooling - admin-signin partial: 'sign in directly at :8443 as root'. - Head.astro override + medium-zoom: click-to-zoom lightbox on every article image; auto-reattaches after Starlight client navigation. - capture-admin.ts: read-only Playwright capture for admin docs with multi-pass redaction (server hostnames, mail server, customer domains, customer usernames in table cells, IPs except RFC1918 and public resolvers, password/key/token/secret/api input values, plus LiteLLM URLs, model names, JWT/sk-prefix API keys, root → admin).	2026-05-18 10:49:43 -07:00
shadowdao	fef98357c7	docs(admin): add WHP super-admin section (5 draft articles) ... Adds /whp/admin/ with: overview, server-settings, coraza-waf, site-monitoring, user-management. Articles are product-neutral (no VDS in titles or required framing) since super admin may be offered as a separate service later. They're marked Draft via: - 'Draft' sidebar badge on the group + each article - A draft callout partial at the top of every page noting WIP The super-admin-callout partial (renamed from vds-only-callout) mentions VDS as today's most common way to get super admin without locking the docs to that single product.	2026-05-17 18:04:01 -07:00