docs: new root as prior history lost (orphan + GC); ~215 commits not recoverable

configs/tops/Caddyfile.snippet

@@ -0,0 +1,29 @@
+# Paste into host Caddyfile (/etc/caddy/Caddyfile) and reload Caddy.
+# Ports: 9090 ng1 | 9091 ng2 | 9092 ng3
+
+tops.ng1.hacktivism.ch {
+	header Alt-Svc "clear"
+	reverse_proxy 127.0.0.1:9090 {
+		header_up Host {host}
+		header_up X-Forwarded-For {remote_host}
+		header_up X-Forwarded-Proto {scheme}
+	}
+}
+
+tops.ng2.hacktivism.ch {
+	header Alt-Svc "clear"
+	reverse_proxy 127.0.0.1:9091 {
+		header_up Host {host}
+		header_up X-Forwarded-For {remote_host}
+		header_up X-Forwarded-Proto {scheme}
+	}
+}
+
+tops.ng3.hacktivism.ch {
+	header Alt-Svc "clear"
+	reverse_proxy 127.0.0.1:9092 {
+		header_up Host {host}
+		header_up X-Forwarded-For {remote_host}
+		header_up X-Forwarded-Proto {scheme}
+	}
+}

configs/tops/README.md

@@ -0,0 +1,73 @@
+# tops — `koopa-tops-ng1` … `ng3`
+
+| Item | Value |
+|------|--------|
+| Live | `/home/hernani/koopa-tops/` |
+| Containers | `koopa-tops-ng1`, `koopa-tops-ng2`, `koopa-tops-ng3` |
+| Image | `docker.io/library/nginx:1.27-alpine` |
+| Compose | `compose.yml` (this dir) |
+| Secrets | none |
+
+Site HTML is **not** in this repo (container wiring only).
+
+## Containers
+
+| Container | Host port | Caddy host |
+|-----------|-----------|------------|
+| `koopa-tops-ng1` | **9090** | `tops.ng1.hacktivism.ch` |
+| `koopa-tops-ng2` | **9091** | `tops.ng2.hacktivism.ch` |
+| `koopa-tops-ng3` | **9092** | `tops.ng3.hacktivism.ch` |
+
+Caddy snippet: `Caddyfile.snippet`.
+
+
+## nginx
+
+Mirror: `nginx-default.conf` → mounted as `/etc/nginx/conf.d/default.conf` in each container.
+
+### Cache (always fresh)
+
+Preview sites must not be cached by browsers/proxies:
+
+- `Cache-Control: no-store, no-cache, must-revalidate, max-age=0, private`
+- `Pragma: no-cache` / `Expires: 0`
+- `etag off` · `if_modified_since off` · `expires -1`
+
+After editing the conf on the host (bind mount), reload nginx **inside** the container (do not stop the container):
+
+```bash
+for c in koopa-tops-ng1 koopa-tops-ng2 koopa-tops-ng3; do
+  podman exec "$c" nginx -t && podman exec "$c" nginx -s reload
+done
+```
+
+## Autostart
+
+User unit `container-koopa-tops.service` (mirror in this dir) starts all three via compose.
+
+```bash
+# as hernani on koopa
+mkdir -p ~/.config/systemd/user
+cp ~/koopa-tops/deploy/container-koopa-tops.service ~/.config/systemd/user/
+systemctl --user daemon-reload
+systemctl --user enable --now container-koopa-tops.service
+```
+
+Needs linger so the unit runs without an interactive login:
+
+```bash
+# once as root, if needed
+loginctl enable-linger hernani
+loginctl show-user hernani -p Linger
+```
+
+Check:
+
+```bash
+systemctl --user status container-koopa-tops.service
+podman ps --filter name=koopa-tops
+```
+
+## Related
+
+`configs/ports.md` · `host/overview/LIVE.md`

configs/tops/compose.yml

@@ -0,0 +1,61 @@
+# koopa-tops — host ports 9090–9092
+# Live: /home/hernani/koopa-tops/
+# Usage: cd ~/koopa-tops && podman compose -f deploy/compose.yml up -d
+
+services:
+  tops-ng1:
+    image: docker.io/library/nginx:1.27-alpine
+    container_name: koopa-tops-ng1
+    restart: unless-stopped
+    ports:
+      - "9090:80"
+    volumes:
+      - ../ng1:/usr/share/nginx/html:ro
+    labels:
+      org.hacktivism.service: tops-ng1
+      org.hacktivism.host_port: "9090"
+      org.hacktivism.site: tops.ng1.hacktivism.ch
+      org.hacktivism.managed_by: koopa-admin
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1/"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+
+  tops-ng2:
+    image: docker.io/library/nginx:1.27-alpine
+    container_name: koopa-tops-ng2
+    restart: unless-stopped
+    ports:
+      - "9091:80"
+    volumes:
+      - ../ng2:/usr/share/nginx/html:ro
+    labels:
+      org.hacktivism.service: tops-ng2
+      org.hacktivism.host_port: "9091"
+      org.hacktivism.site: tops.ng2.hacktivism.ch
+      org.hacktivism.managed_by: koopa-admin
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1/"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+
+  tops-ng3:
+    image: docker.io/library/nginx:1.27-alpine
+    container_name: koopa-tops-ng3
+    restart: unless-stopped
+    ports:
+      - "9092:80"
+    volumes:
+      - ../ng3:/usr/share/nginx/html:ro
+    labels:
+      org.hacktivism.service: tops-ng3
+      org.hacktivism.host_port: "9092"
+      org.hacktivism.site: tops.ng3.hacktivism.ch
+      org.hacktivism.managed_by: koopa-admin
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1/"]
+      interval: 30s
+      timeout: 5s
+      retries: 3

configs/tops/container-koopa-tops.service

@@ -0,0 +1,35 @@
+# tops.ng1–ng3 (podman compose) — start on user session / boot (linger)
+#
+# On koopa as hernani:
+#   mkdir -p ~/.config/systemd/user
+#   cp deploy/container-koopa-tops.service ~/.config/systemd/user/
+#   systemctl --user daemon-reload
+#   systemctl --user enable --now container-koopa-tops.service
+#
+# Once as root (if not already): loginctl enable-linger hernani
+
+[Unit]
+Description=Podman koopa-tops (tops.ng1–ng3 static nginx)
+Documentation=file:///home/hernani/koopa-tops/README.md
+Wants=network-online.target
+After=network-online.target
+RequiresMountsFor=%t/containers /home/hernani/koopa-tops
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+WorkingDirectory=/home/hernani/koopa-tops
+Environment=PODMAN_SYSTEMD_UNIT=%n
+Restart=on-failure
+RestartSec=15
+TimeoutStartSec=120
+TimeoutStopSec=60
+
+ExecStartPre=/bin/bash -c "chmod -R a+rX /home/hernani/koopa-tops/ng1 /home/hernani/koopa-tops/ng2 /home/hernani/koopa-tops/ng3 2>/dev/null || true"
+
+ExecStart=/bin/bash -c "if podman compose version >/dev/null 2>&1; then podman compose -f deploy/compose.yml up -d; elif command -v podman-compose >/dev/null 2>&1; then podman-compose -f deploy/compose.yml up -d; else echo \"no podman compose\" >&2; exit 1; fi"
+
+ExecStop=/bin/bash -c "if podman compose version >/dev/null 2>&1; then podman compose -f deploy/compose.yml stop; elif command -v podman-compose >/dev/null 2>&1; then podman-compose -f deploy/compose.yml stop; else podman stop koopa-tops-ng1 koopa-tops-ng2 koopa-tops-ng3 2>/dev/null || true; fi"
+
+[Install]
+WantedBy=default.target

configs/tops/nginx-default.conf

@@ -0,0 +1,47 @@
+# Shared nginx config for tops.ng1–ng3 static previews.
+# Language root redirect mirrors taler-ops.ch (Accept-Language → /en|/de|/fr).
+# Cache: always revalidate / never store — design previews must show latest HTML/assets.
+
+map $http_accept_language $accept_lang {
+    default en;
+    ~*^de de;
+    ~*^fr fr;
+    ~*^en en;
+}
+
+server {
+    listen 80;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Relative Location: so Caddy/HTTPS clients stay on https://host/...
+    absolute_redirect off;
+    port_in_redirect off;
+    server_name_in_redirect off;
+
+    # Never serve stale preview content from browser/proxy caches
+    etag off;
+    if_modified_since off;
+    expires -1;
+    add_header Cache-Control "no-store, no-cache, must-revalidate, max-age=0, private" always;
+    add_header Pragma "no-cache" always;
+    add_header Expires "0" always;
+
+    # Like https://taler-ops.ch/ — bare root picks language from Accept-Language
+    location = / {
+        return 302 /$accept_lang/;
+    }
+    location = /index.html {
+        return 302 /$accept_lang/;
+    }
+
+    # Bare page names that exist under /{lang}/ (ng2; 302→404 on ng1 if missing)
+    location ~ ^/(merchants|users|users-[a-z]+)\.html$ {
+        return 302 /$accept_lang$uri;
+    }
+
+    location / {
+        try_files $uri $uri/ $uri/index.html =404;
+    }
+}