ixgadmin 243d4eefcd Run with DEBUG off and add HSTS and CSP headers ... DEBUG was on in production, so an error rendered a full traceback and the DEBUG-only media route served /media/ixg-documents/... publicly, bypassing the document permission checks. Set DJANGO_DEBUG=False in the env files (untracked) and add friendly 500/404/403 templates. With DEBUG off Django no longer serves /static/, so nginx does: the static root moves to /var/www/ixg-platform-static (mounted into the app container) because /root is not traversable by www-data. HSTS (max-age 1y, includeSubDomains) is added to every HTTPS host, and a pragmatic CSP to the app/ops/portal locations. 'unsafe-inline' is required by the inline scripts/styles; self-hosting the CDN assets and nonces is a follow-up.		2026-09-25 12:37:40 +00:00
..
guides	Add User Guides Viewer (Help Centre) - role-gated wiki help pages	2026-08-07 14:19:49 +00:00
ops	Make logout a POST and end the Keycloak session	2026-09-21 12:53:14 +00:00
portal	Make logout a POST and end the Keycloak session	2026-09-21 12:53:14 +00:00
403.html	Run with DEBUG off and add HSTS and CSP headers	2026-09-25 12:37:40 +00:00
404.html	Run with DEBUG off and add HSTS and CSP headers	2026-09-25 12:37:40 +00:00
500.html	Run with DEBUG off and add HSTS and CSP headers	2026-09-25 12:37:40 +00:00