refactor: modularize chat backend, update docs for .m4s segments

2026-08-07 13:16:44 +02:00
1 parent 46e878bef6
commit b3a10ba3ef
@@ -0,0 +1,117 @@
+# Cloudflare and UptimeRobot Manual Completion Checklist
+
+Purpose: execute and record all manual dashboard tasks that cannot be automated from repository workflows.
+
+## Status Legend
+
+- [ ] Pending
+- [x] Done
+
+## 1) Cloudflare Pages Link and Build
+
+- [ ] Connect repo to Cloudflare Pages project
+- [ ] Build command set to: `cd frontend && npm run build`
+- [ ] Output directory set to: `frontend/dist`
+- [ ] Production domain attached to `linearvoid.tv`
+
+Evidence to capture:
+
+- Screenshot of Pages deployment settings
+- Deployment URL and latest deployment timestamp
+
+## 2) Tiered Cache Enablement and Validation
+
+- [ ] Smart Tiered Cache enabled for zone
+- [ ] Warm request made to hot HLS segment
+- [ ] Warm request made to live manifest
+- [ ] `Cf-Cache-Status: HIT` observed on repeated requests
+
+Validation commands:
+
+```bash
+curl -I https://media.linearvoid.tv/hls/playlist.m3u8
+curl -I https://media.linearvoid.tv/hls/<segment>.m4s
+```
+
+Evidence to capture:
+
+- Headers from first request (expected MISS)
+- Headers from repeated request (expected HIT)
+
+## 3) WAF and Bot Protection
+
+- [ ] OWASP Managed Ruleset enabled
+- [ ] Mode set to Simulate
+- [ ] Simulate mode reviewed for 48h
+- [ ] Mode switched to Block after false-positive review
+- [ ] Bot Fight Mode enabled
+
+Evidence to capture:
+
+- WAF ruleset status screenshot
+- Count of blocked/challenged events after cutover
+
+## 4) Rate Limiting Rules
+
+- [ ] Rule created for `/api/admin/login`
+- [ ] Rule created for `/api/admin/*`
+- [ ] Threshold set to `10 requests / 10 seconds / IP`
+- [ ] Action set to Managed Challenge
+- [ ] Rule order validated
+
+Validation approach:
+
+- Use burst requests from a test client and verify challenge behavior without blocking legitimate admin flow.
+
+Evidence to capture:
+
+- Rule definitions screenshot
+- Test result notes (challenge seen / no lockout)
+
+## 5) HTTPS and WSS Hardening
+
+- [ ] Always Use HTTPS enabled
+- [ ] HSTS enabled with max-age 31536000
+- [ ] HSTS includeSubDomains enabled
+- [ ] HSTS preload enabled
+- [ ] Minimum TLS version set to 1.2+
+- [ ] SSL mode verified as Full (strict)
+- [ ] WSS endpoint validated through proxy (`wss://linearvoid.tv/ws`)
+
+Validation commands:
+
+```bash
+curl -I https://linearvoid.tv
+curl -I https://linearvoid.tv/health
+```
+
+Evidence to capture:
+
+- Response headers showing HSTS
+- Successful browser WebSocket connect in devtools
+
+## 6) UptimeRobot Monitors
+
+- [ ] HTTP monitor added for `https://linearvoid.tv/health` (5m)
+- [ ] Keyword monitor added for `https://linearvoid.tv/hls/playlist.m3u8` (keyword `#EXTM3U`, 5m)
+- [ ] Alert trigger set to 2 consecutive failures
+- [ ] Notification channels configured (email + Discord/Slack webhook)
+
+Evidence to capture:
+
+- Monitor dashboard screenshot
+- Test alert delivery confirmation
+
+## 7) Sign-Off
+
+- [ ] Cloudflare manual tasks complete
+- [ ] UptimeRobot tasks complete
+- [ ] TODO items updated to done
+- [ ] Changelog entry added for completion batch
+
+Sign-off fields:
+
+- Owner:
+- Date:
+- Environment (test-lab or production):
+- Notes: