# Rules and limits

## What can go in a hotsite

Static files: HTML, CSS, JavaScript, images, fonts, PDF, JSON. The site is
served as-is, with a one-week cache for media and code files. A `404.html`
at the root becomes the error page.

**Redirects.** A `_redirects` file at the root, one rule per line,
`source target [301|302]`. Exact paths only, no wildcards:

```
/2019/   /                                   301
/        https://www.sympla.com.br/event     302
```

The file itself is never served. Invalid lines refuse the publish with the
list of what is wrong.

**Nothing runs on the server.** `.php`, `.cgi`, `.py`, `.sh` and similar
files are refused at upload time, and even if one slipped through the server
answers 404 for them. This is deliberate: hotsites are static. If a project
needs PHP or a database it belongs on the WordPress lane on the rapadura.net
multisite. See [WordPress sites](wordpress.md).

**Secrets are refused.** `.env`, keys (`.pem`, `.key`, `id_rsa`), `.ssh` and
`.aws` folders, `wp-config.php` and the like block the whole publish, with
the list of what was found. The fix is to publish only the build output
directory, never the repository root.

Noise directories (`.git`, `node_modules`, `.cache`, `vendor`) are skipped
silently.

## Names

- A hotsite is `name.zone`. Zones: `rapadura.net` and `phpcomrapadura.org`.
- The name is 1 to 63 characters: lowercase letters, digits and single
  hyphens. No `--`, accents or dots.
- Reserved names (`www`, `mail`, `panel`, `agents`, `api`, `blog`, `admin`
  among others) and names already used by another site on the server are
  refused.
- A recently deleted name is held for restore; choose another.

**Custom domain.** A static hotsite can also answer at a domain you own,
like `www.myevent.com.br`. Ask with `rapadura domain add <site> <domain>`
(or the `request_domain` tool): the request waits for the owner's approval,
and the reply says which DNS record to create (an `A` record pointing at the
edge). After approval the certificate is issued on its own at the first
visit. `rapadura domain list` and `rapadura domain remove` need no approval.
Static sites only for now. Refused: names under `rapadura.net` or
`phpcomrapadura.org` (that is a site, not a domain), names already used by
another site on the server, and anything beyond lowercase letters, digits,
hyphens and dots.

## Limits

| what | default |
|---|---|
| sites per person | 20 |
| size per site | 500 MB |
| size per file | 100 MB |
| files per site | 20,000 |
| versions kept | 20 (older ones are pruned; the live version never) |

`rapadura zones` shows the values in force. Need more? Ask the administrator.

## Security and access

- Nobody gets SSH, a panel or a server password. Only the CLI.
- Login is through GitHub, by invitation. Each machine gets its own token,
  stored in `~/.config/rapadura/credentials.json` with `0600` permissions.
- Tokens expire after 90 days and can be revoked at any time
  (`rapadura logout` revokes the current machine's).
- You see and change only your own sites. The administrator sees all.
- Every action lands in the audit log: who, what, which site, when.
- **Never** paste your token into chat, a commit, an issue or a log. If it
  leaked, revoke it.

## Versions and rollback

Each publish is an immutable version, numbered from 1. The switch between
versions is atomic: either the whole site changes or nothing does. Before
reporting success the gateway validates the configuration, reloads the
server and checks that the new version is really being served. If any step
fails, the previous version stays live and the error comes back to you.

Every retained version also answers at its own address,
`https://<name>--v<n>.<zone>` (shown in the receipt and in
`rapadura versions`), so you can compare versions or show one that is no
longer live.