Kokkoja: first public assembly

Assembled from the development repository by tools/make_release.sh.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/nginx-site.conf

@@ -0,0 +1,39 @@
+# nginx server block for a Kokkoja web site: the client's files at
+# https://kokkoja.andykopra.com/ and the relay at wss://kokkoja.andykopra.com/relay.
+# Installed by deploy/setup_vps.sh as /etc/nginx/sites-available/kokkoja.
+#
+# This is the plain HTTP form.  certbot --nginx -d kokkoja.andykopra.com
+# adds the TLS listener and turns this block into a redirect.
+
+server {
+    listen 80;
+    server_name kokkoja.andykopra.com;
+
+    root /var/www/kokkoja;
+    index index.html;
+
+    # The relay.  The client connects to <relay address>/room/<room id>,
+    # so /relay/room/<id> here becomes /room/<id> at the relay.
+    location /relay/ {
+        proxy_pass http://127.0.0.1:8770/;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header X-Forwarded-For $remote_addr;
+        # The relay pings every 20 seconds; a quiet lesson must not be cut off.
+        proxy_read_timeout 1h;
+        proxy_send_timeout 1h;
+    }
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+
+    # The client is a few small files that change with every deployment:
+    # browsers ask whether they have changed rather than keeping old ones.
+    add_header Cache-Control "no-cache" always;
+    # The client loads nothing from anywhere else, and may not be framed.
+    add_header Content-Security-Policy "default-src 'self'; connect-src 'self' wss://kokkoja.andykopra.com; img-src 'self' blob: data:; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "no-referrer" always;
+}