File Structure
norton shop/
├── .gitignore ← Excludes content/uploads from git tracking
├── admin/
│ ├── index.php ← Admin panel (all content management)
│ ├── config.php ← Server and admin settings
│ ├── send-mail.php ← Contact form email handler
│ ├── microproof.js ← Self-hosted captcha script (admin subdomain copy)
│ ├── microproof.php ← Captcha verification endpoint (admin subdomain copy)
│ ├── webauthn.php ← WebAuthn/FIDO2 security key support
│ ├── reset-totp.php ← Emergency CLI tool: reset a user's login
│ ├── migrate-secrets.php ← One-off migration: encrypt TOTP secrets
│ ├── dev-server.php ← Local dev router (mimics nginx deny rules)
│ ├── php-dev.ini ← PHP config for dev server
│ ├── .user.ini ← PHP-FPM config for production
│ ├── nginx.conf ← Production nginx site config (server blocks + bot blocking)
│ ├── nginx-main.conf ← Production nginx main config (http block, rate limits, headers)
│ ├── Dockerfile ← PHP-FPM image (dev & referenced by server-setup.sh)
│ ├── docker-compose.yml ← Dev docker setup
│ └── bip-39-english.txt ← BIP-39 word list (never serve over HTTP)
│ [NOT IN GIT — server only:]
│ ├── users.json ← User accounts (created on first admin visit)
│ ├── audit.json ← Audit log (auto-managed)
│ ├── .encryption-key ← Auto-generated AES-256 key
│ ├── .versions.json ← Content version history (auto-managed)
│ ├── .rate-limits.json ← Login rate limit data (auto-managed)
│ ├── .sessions.json ← Active session tracking (auto-managed)
│ ├── .ip-salt ← Random salt for IP hashing (auto-generated)
│ ├── .ip-geo-cache.json ← IP-to-country lookup cache (auto-managed)
│ ├── .vapid-keys.json ← VAPID keys for push notifications (auto-generated)
│ └── drafts.json ← Unpublished content drafts (auto-managed)
├── api/
│ └── webhook.php ← Codeberg webhook receiver (auto-deploy)
├── content/ [NOT IN GIT — managed by admin panel]
│ ├── site-config.js ← Front-end settings (CDN/API URLs, contact, hours)
│ ├── json/ ← All content JSON (offers, news, team, etc.)
│ └── markdown/ ← Page content as .txt files
├── docs/
│ ├── index.html ← Documentation index
│ ├── server-guide/
│ │ └── index.html ← This document
│ └── editing-guide/
│ └── index.html ← Guide for the shop team
├── documents/ [NOT IN GIT — uploaded via admin panel]
├── static/
│ ├── css/ ← Stylesheets (style.css, counter.css, directory.css, jobs.css)
│ ├── fonts/ ← Custom fonts (Friz Quadrata)
│ ├── img/ ← Site images (logo, OG image, static assets)
│ │ ├── gallery/ [NOT IN GIT — uploaded via admin]
│ │ ├── team/ [NOT IN GIT — uploaded via admin]
│ │ └── directory/ [NOT IN GIT — uploaded via admin]
│ ├── js/ ← JavaScript (app.js, includes.js, counter.js, directory.js, jobs.js)
│ ├── server/
│ │ └── counter/
│ │ └── counter.php ← Visitor counter API
│ ├── video/ [NOT IN GIT — uploaded via admin]
│ └── 404.html ← CDN 404 page
├── index.html ← Homepage
├── about/index.html ← Public pages use clean URLs (/about/, /board/, etc.)
├── board/index.html
├── clt/index.html
├── community/index.html
├── contact/index.html
├── directory/index.html
├── housing/index.html
├── jobs/index.html
├── membership/index.html
├── post-office/index.html
├── privacy/index.html
├── 404.html ← Main site 404 page
├── offline.html ← Offline fallback (self-contained, no external deps)
├── sw.js ← Service worker (caching, push notifications, offline)
├── manifest.json ← PWA manifest (app name, icons, theme colour)
├── robots.txt ← Crawler rules (blocks all bots, kept in sync with nginx)
├── microproof.js ← Self-hosted captcha script
├── microproof.php ← Captcha verification endpoint
├── deploy.sh ← Deployment script (pulls code, syncs nginx config, restarts)
├── server-init.sh ← VPS initial setup script
├── server-setup.sh ← Docker Compose + nginx + SSL setup
└── LICENSE.md ← AGPL 3.0+