Merge pull request 'Portfoliosynk: 13 bilder som fastnat sedan 29/9 kommer med; en trasig bild stoppar inte de andra' (#3 ) from portfoliosynk-fix-2026-11-06 into main

Reviewed-on: #3
Portfolio sync: a photo that fails no longer stops the others; sharp accepts pixel-shift and 15000 px squares
2026-11-06 04:22:38 +00:00 · 2026-11-06 05:18:14 +01:00 · 2026-11-06 04:07:25 +00:00 · 2026-11-06 04:45:09 +01:00 · 2026-11-06 04:43:33 +01:00 · 2026-11-06 04:08:04 +01:00
299 changed files with 3479 additions and 719 deletions
@@ -0,0 +1,11 @@
 .git
 .github
 node_modules
 dist
 .astro
 .vscode
 .idea
 *.log
 .DS_Store
 README.md
 LICENSE
@@ -1,97 +0,0 @@
 # For most projects, this workflow file will not need changing; you simply need
 # to commit it to your repository.
 #
 # You may wish to alter this file to override the set of languages analyzed,
 # or to provide custom queries or build logic.
 #
 # ******** NOTE ********
 # We have attempted to detect the languages in your repository. Please check
 # the `language` matrix defined below to confirm you have the correct set of
 # supported CodeQL languages.
 #
 name: "CodeQL Advanced"
 on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]
  schedule:
    - cron: '23 16 * * 1'
 jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    # Runner size impacts CodeQL analysis time. To learn more, please see:
    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
    #   - https://gh.io/supported-runners-and-hardware-resources
    #   - https://gh.io/using-larger-runners (GitHub.com only)
    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
    permissions:
      # required for all workflows
      security-events: write
      # required to fetch internal or private CodeQL packs
      packages: read
      # only required for workflows in private repositories
      actions: read
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
        # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
        # Use `c-cpp` to analyze code written in C, C++ or both
        # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
        # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
        # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
        # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
        # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
    # Add any setup steps before running the `github/codeql-action/init` action.
    # This includes steps like installing compilers or runtimes (`actions/setup-node`
    # or others). This is typically only required for manual builds.
    # - name: Setup runtime (example)
    #   uses: actions/setup-example@v1
    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v4
      with:
        languages: ${{ matrix.language }}
        build-mode: ${{ matrix.build-mode }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.
        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
        # queries: security-extended,security-and-quality
    # If the analyze step fails for one of the languages you are analyzing with
    # "We were unable to automatically build your code", modify the matrix above
    # to set the build mode to "manual" for that language. Then modify this step
    # to build your code.
    # ℹ️ Command-line programs to run using the OS shell.
    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
    - name: Run manual build steps
      if: matrix.build-mode == 'manual'
      shell: bash
      run: |
        echo 'If you are using a "manual" build mode for one or more of the' \
          'languages you are analyzing, replace this with the commands to build' \
          'your code, for example:'
        echo '  make bootstrap'
        echo '  make release'
        exit 1
    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v4
      with:
        category: "/language:${{matrix.language}}"
@@ -0,0 +1,77 @@
 name: Portfolio-synk (Immich → portfolio)
 on:
  schedule:
    - cron: '0 3 * * *'      # dygnsvis 03:00 UTC
  workflow_dispatch:          # "på begäran" — manuell knapp / API-trigger
 permissions:
  contents: write             # för att committa nya bilder
 concurrency:
  group: portfolio-sync       # ingen parallell körning (race-skydd)
  cancel-in-progress: false
 jobs:
  sync:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: '22'
      - name: Install sharp
        run: npm install sharp@^0.33.5
      - name: Run portfolio sync
        id: sync
        env:
          IMMICH_API_KEY: ${{ secrets.IMMICH_API_KEY }}
        run: node scripts/portfolio-sync.mjs
      - name: Commit, PR & auto-merge if changed
        if: steps.sync.outputs.changed == 'true'
        env:
          GH_TOKEN: ${{ secrets.SYNC_PAT }}
          SYNC_PAT: ${{ secrets.SYNC_PAT }}
          REPO: ${{ github.repository }}
          ADDED: ${{ steps.sync.outputs.added }}
          REMOVED: ${{ steps.sync.outputs.removed }}
        run: |
          set -e
          BRANCH="sync/portfolio-$(date +%Y%m%d-%H%M%S)"
          git config user.name "portfolio-sync[bot]"
          git config user.email "actions@github.com"
          git checkout -b "$BRANCH"
          git add src/assets/images/portfolio/
          git commit -m "chore(portfolio): sync ${ADDED} added, ${REMOVED} removed from Immich"
          git push "https://x-access-token:${SYNC_PAT}@github.com/${REPO}.git" "$BRANCH"
          gh pr create --head "$BRANCH" --base main \
            --title "chore(portfolio): Immich sync (${ADDED} added, ${REMOVED} removed)" \
            --body "Automated portfolio sync from Immich portfolio tag."
          gh pr merge "$BRANCH" --squash --admin --delete-branch
      # Coolify auto-deployar på push till main (webhook) — GitHub-runnern når
      # inte Coolify (Tailscale-IP 100.x), så vi triggar inte härifrån.
      - name: Wait for Coolify auto-deploy
        if: steps.sync.outputs.changed == 'true'
        run: sleep 120
      - name: Purge Cloudflare cache
        if: steps.sync.outputs.changed == 'true'
        run: |
          curl -s -X POST "https://api.cloudflare.com/client/v4/zones/22c7ed24735e7417d814ef66d90e4397/purge_cache" \
            -H "Authorization: Bearer ${{ secrets.CF_PURGE_TOKEN }}" \
            -H "Content-Type: application/json" \
            -d '{"files":["https://imagesbyolofsson.se/portfolio"]}' || echo "CF-purge misslyckades (icke-kritiskt)"
      - name: Summary
        run: |
          echo "### Portfolio-synk klar" >> $GITHUB_STEP_SUMMARY
          echo "- Tillagda: ${{ steps.sync.outputs.added }}" >> $GITHUB_STEP_SUMMARY
          echo "- Borttagna: ${{ steps.sync.outputs.removed }}" >> $GITHUB_STEP_SUMMARY
          echo "- Ändring: ${{ steps.sync.outputs.changed }}" >> $GITHUB_STEP_SUMMARY
@@ -0,0 +1,21 @@
 # syntax=docker/dockerfile:1.7
 FROM node:22-alpine AS builder
 WORKDIR /app
 COPY package.json package-lock.json* ./
 RUN --mount=type=cache,target=/root/.npm \
    if [ -f package-lock.json ]; then npm ci; else npm install --no-audit --no-fund; fi
 COPY . .
 RUN npm run build
 FROM nginx:1.27-alpine AS runtime
 COPY --from=builder /app/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 RUN adduser -D -H -u 101 -s /sbin/nologin nginxuser 2>/dev/null || true
 EXPOSE 80
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD wget -q --spider http://127.0.0.1/ || exit 1
@@ -1,22 +1,102 @@
-# Homepage
+# Images by Olofsson
-Welcome to the Homepage!\
+A modern, responsive photography portfolio website built with Astro, Tailwind CSS, and advanced animations.
 ![Image 3](img3.jpg)\
 ![Image 4](img4.jpg)\
-## Navigation
+<br>
- Home\
+<div align="center">
- About\
+  <table>
- Contact\
+    <tr>
      <td align="center">
        <img src="https://raw.githubusercontent.com/Images-by-Olofsson/homepage/main/src/assets/images/3d-scroll/img1.jpg" width="250" alt="Portfolio Grid">
        <br><em> More </em>
      </td>
      <td align="center">
        <img src="https://raw.githubusercontent.com/Images-by-Olofsson/homepage/main/src/assets/images/3d-scroll/img2.jpg" width="250" alt="3D Scroll Effect">
        <br><em> At </em>
      </td>
      <td align="center">
        <img src="https://raw.githubusercontent.com/Images-by-Olofsson/homepage/main/src/assets/images/3d-scroll/img3.jpg" width="250" alt="Hero Section">
        <br><em>Imagesbyolofsson.se</em>
      </td>
    </tr>
  </table>
 </div>
-This is a modern design layout that showcases our projects. The use of images and text is intended to maintain an aesthetic appeal.<br> 
+<br>
 <br>
-## Gallery
+## Features
-Here are some images that represent our work:<br>
+Modern design with minimalist aesthetics and focus on imagery. Advanced animations including wave effects, 3D scroll transforms, and smoke particles. Fully responsive across all devices with optimized performance.
 - ![Image 1](img1.jpg)<br>
 - ![Image 2](img2.jpg)<br>
 - ![Image 3](img3.jpg)<br>
-Thank you for visiting!
+<br>
 ## Quick Start
 **Prerequisites**
 Node.js 18.0 or higher
 **Installation**
 ```bash
 git clone https://github.com/Images-by-Olofsson/homepage.git
 cd homepage
 npm install
 ```
 **Development**
 ```bash
 npm run dev
 ```
 **Build**
 ```bash
 npm run build
 npm run preview
 ```
 <br>
 ## Project Structure
 ```
 src/
 ├── assets/
 ├── components/
 │   ├── WaveBackground.astro
 │   ├── ThreeDScroll.astro
 │   ├── FloatingOrbs.astro
 │   └── Welcome.astro
 ├── layouts/
 │   ├── MainLayout.astro
 │   └── Layout.astro
 ├── pages/
 │   ├── index.astro
 │   ├── portfolio.astro
 │   ├── about.astro
 │   └── contact.astro
 └── styles/
    └── global.css
 ```
 <br>
 ## Technologies
 Astro, Tailwind CSS, TypeScript, Exifr
 <br>
 ## License
 MIT License - see LICENSE file for details
 <br>
 <div align="center">
  <p>Built by Linus Olofsson</p>
 </div>
@@ -0,0 +1,17 @@
 import { defineConfig } from 'astro/config';
 import tailwindcss from '@tailwindcss/vite';
 export default defineConfig({
  // Kanonisk adress: canonical, og:url, sitemap och JSON-LD byggs från denna.
  site: 'https://imagesbyolofsson.se',
  // En URL per sida: /about (aldrig /about/). Servern 301:ar /about/ -> /about.
  trailingSlash: 'never',
  build: {
    // about.astro -> dist/about.html (inte dist/about/index.html).
    // nginx/Caddy serverar /about via try_files $uri.html.
    format: 'file',
  },
  vite: {
    plugins: [tailwindcss()],
  },
 });
@@ -0,0 +1,99 @@
 # deploy/caddy-site.snippet
 # Caddy-motsvarigheten till nginx.conf för imagesbyolofsson.se (statisk dist/ från `astro build`,
 # build.format "file": /about -> about.html, 404 -> 404.html).
 #
 # Användning i Caddyfile (Caddy >= 2.7):
 #
 #   import /etc/caddy/snippets/caddy-site.snippet
 #
 #   www.imagesbyolofsson.se {
 #       import ibo_www_redirect
 #   }
 #   imagesbyolofsson.se {
 #       # Specialregler (på Cleura: handle för /about, /contact, /posters -> kundportalen,
 #       # se kundportalens deploy/cleura/caddy/Caddyfile) ska ligga FÖRE importen.
 #       import ibo_site /srv/imagesbyolofsson/dist
 #   }
 #
 # Argumentet är sökvägen till dist-katalogen på servern (justera till den riktiga).
 (ibo_www_redirect) {
 	redir https://imagesbyolofsson.se{uri} permanent
 }
 (ibo_site) {
 	root * {args[0]}
 	encode zstd gzip
 	# --- Säkerhetsheaders ---
 	# CSP: tillåter Meta Pixel (laddas först efter samtycke), anonym statistik via sendBeacon
 	# till customer.imagesbyolofsson.se och Cloudflares egna skript (/cdn-cgi, ev. Web Analytics).
 	# 'unsafe-inline' behövs för samtyckesskriptet och Astros inlinade skript/stilar.
 	header {
 		Strict-Transport-Security "max-age=31536000"
 		X-Content-Type-Options "nosniff"
 		X-Frame-Options "SAMEORIGIN"
 		Referrer-Policy "strict-origin-when-cross-origin"
 		Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=(), usb=()"
 		Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://connect.facebook.net https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://www.facebook.com https://*.facebook.com; font-src 'self' data:; connect-src 'self' https://customer.imagesbyolofsson.se https://www.facebook.com https://*.facebook.com https://connect.facebook.net https://cloudflareinsights.com; frame-src https://www.facebook.com; frame-ancestors 'self'; base-uri 'self'; form-action 'self'; object-src 'none'; upgrade-insecure-requests"
 		-Server
 	}
 	# --- Cache-Control (ömsesidigt uteslutande matchers) ---
 	@ibo_immutable path /_astro/*
 	header @ibo_immutable Cache-Control "public, max-age=31536000, immutable"
 	@ibo_media {
 		path *.jpg *.jpeg *.png *.webp *.avif *.gif *.svg *.ico *.woff *.woff2 *.ttf *.otf
 		not path /_astro/*
 	}
 	header @ibo_media Cache-Control "public, max-age=2592000"
 	@ibo_textfiles path *.xml *.txt
 	header @ibo_textfiles Cache-Control "public, max-age=3600"
 	@ibo_pages {
 		not path /_astro/*
 		not path *.jpg *.jpeg *.png *.webp *.avif *.gif *.svg *.ico *.woff *.woff2 *.ttf *.otf *.xml *.txt
 	}
 	header @ibo_pages Cache-Control "public, max-age=0, must-revalidate"
 	# --- 301:or ---
 	# Gamla indexerade adresser -> portfolion.
 	@ibo_old path /my-people /my-people/ /animales-and-nature /animales-and-nature/ /celebrations-with-family /celebrations-with-family/ /northen-lights /northen-lights/
 	redir @ibo_old /portfolio permanent
 	# /index.html -> /
 	redir /index.html / permanent
 	# /about.html -> /about (404-sidan hanteras separat nedan)
 	@ibo_htmlext {
 		path_regexp ibo_htmlext ^(/.+)\.html$
 		not path /404.html
 	}
 	redir @ibo_htmlext {re.ibo_htmlext.1}{?query} permanent
 	# Avslutande snedstreck: /about/ -> /about
 	@ibo_trailing path_regexp ibo_trailing ^(/.+)/$
 	redir @ibo_trailing {re.ibo_trailing.1}{?query} permanent
 	# 404-sidan ska bara synas som svar på okända adresser, inte som egen URL med 200.
 	@ibo_404page path /404 /404.html
 	error @ibo_404page 404
 	# --- Statiska filer ---
 	try_files {path} {path}.html
 	file_server
 	# Riktig 404: 404.html med status 404 (inte startsidan med 200).
 	handle_errors {
 		@ibo_notfound expression {err.status_code} == 404
 		handle @ibo_notfound {
 			root * {args[0]}
 			rewrite * /404.html
 			file_server {
 				status 404
 			}
 		}
 	}
 }
@@ -0,0 +1,15 @@
 #!/usr/bin/env bash
 # deploy/cleura/install-portfolio-sync.sh – installs the portfolio sync on the Cleura server (run as root from a
 # checkout of this repo). Needs /etc/portal/portfolio-sync.env (root 600) first; see portfolio-sync.sh for the keys.
 # Undo: systemctl disable --now portfolio-sync.timer && rm /etc/systemd/system/portfolio-sync.{service,timer}
 set -euo pipefail
 HERE=$(cd "$(dirname "$0")" && pwd)
 ENVF=/etc/portal/portfolio-sync.env
 [ -f "$ENVF" ] || { echo "$ENVF is missing - copy IMMICH_URL, PORTFOLIO_TAG_ID, IMMICH_API_KEY and GIT_URL there first"; exit 2; }
 [ "$(stat -c %a "$ENVF")" = "600" ] || chmod 600 "$ENVF"
 install -m 755 -o root -g root "$HERE/portfolio-sync.sh" /opt/portal/site/portfolio-sync.sh
 install -m 644 -o root -g root "$HERE/portfolio-sync.service" /etc/systemd/system/portfolio-sync.service
 install -m 644 -o root -g root "$HERE/portfolio-sync.timer" /etc/systemd/system/portfolio-sync.timer
 systemctl daemon-reload
 systemctl enable --now portfolio-sync.timer
 systemctl list-timers portfolio-sync.timer --no-pager
@@ -0,0 +1,11 @@
 [Unit]
 Description=Immich portfolio tag -> imagesbyolofsson-se repo -> live site (deploy/cleura/portfolio-sync.sh)
 After=network-online.target docker.service
 Wants=network-online.target
 Requires=docker.service
 [Service]
 Type=oneshot
 ExecStart=/opt/portal/site/portfolio-sync.sh
 TimeoutStartSec=45min
 Nice=10
@@ -0,0 +1,78 @@
 #!/usr/bin/env bash
 # deploy/cleura/portfolio-sync.sh – Immich "portfolio" tag -> this repo -> imagesbyolofsson.se, on the Cleura server.
 #
 # Replaces /opt/immich-sync/run-sync.sh on Nurem (started by n8n over SSH) when imagesbyolofsson.se moved to Cleura
 # (Linus 2026-11-06: everything on the Cleura server). Same steps: fetch main, run scripts/portfolio-sync.mjs,
 # commit + push to Gitea main when photos were added or removed, and then rebuild the live site with
 # /opt/portal/site/build-live.sh (EXIF check included). Nothing is built when nothing changed.
 #
 # Installed by deploy/cleura/install-portfolio-sync.sh as /opt/portal/site/portfolio-sync.sh, run by
 # portfolio-sync.timer every 20 minutes. Secrets: /etc/portal/portfolio-sync.env (root 600) with
 # IMMICH_URL, PORTFOLIO_TAG_ID, IMMICH_API_KEY (read-only Immich key) and GIT_URL (Gitea URL that may push main,
 # with user:token@ in it, as on Nurem).
 #
 # The Gitea token never lands on disk outside that env file: the clone's remote URL is stored without it, git gets
 # it from a credential helper at fetch/push time, and the Node container (npm install runs third-party code) gets
 # an empty tmpfs over .git and only the Immich variables.
 set -euo pipefail
 umask 077
 ENVF=${PORTFOLIO_SYNC_ENV:-/etc/portal/portfolio-sync.env}
 DIR=${PORTFOLIO_SYNC_DIR:-/opt/portal/site/sync/repo}
 NODE=node:22.22.0-alpine@sha256:e4bf2a82ad0a4037d28035ae71529873c069b13eb0455466ae0bc13363826e34
 exec 9>/run/lock/portfolio-sync.lock
 flock -n 9 || { echo "[sync] already running"; exit 0; }
 set -a; . "$ENVF"; set +a
 export IMMICH_URL="${IMMICH_URL:-https://foto.imagesbyolofsson.se/api}"
 export PORTFOLIO_TAG_ID="${PORTFOLIO_TAG_ID:-67d16b6c-0dea-42ef-a289-2c9e57fa5c5a}"
 [ -n "${IMMICH_API_KEY:-}" ] || { echo "FATAL: IMMICH_API_KEY missing in $ENVF"; exit 2; }
 [ -n "${GIT_URL:-}" ] || { echo "FATAL: GIT_URL missing in $ENVF"; exit 2; }
 # Split GIT_URL into the clean URL (stored in .git/config) and user/token (kept in this process only).
 read -r CLEAN_URL GIT_USER GIT_TOKEN < <(python3 - "$GIT_URL" <<'PY'
 import sys, urllib.parse as u
 p = u.urlsplit(sys.argv[1])
 host = p.hostname + (":%d" % p.port if p.port else "")
 print(u.urlunsplit((p.scheme, host, p.path, "", "")), u.unquote(p.username or "-"), u.unquote(p.password or "-"))
 PY
 )
 unset GIT_URL
 export GIT_USER GIT_TOKEN
 # shellcheck disable=SC2016 # $GIT_USER/$GIT_TOKEN are expanded by the helper's shell, not here.
 G=(git -c credential.helper= -c 'credential.helper=!f() { echo "username=$GIT_USER"; echo "password=$GIT_TOKEN"; }; f')
 if [ ! -d "$DIR/.git" ]; then
  mkdir -p "$(dirname "$DIR")"
  "${G[@]}" clone -q "$CLEAN_URL" "$DIR"
 fi
 chmod 700 "$(dirname "$DIR")" "$DIR"
 git -C "$DIR" remote set-url origin "$CLEAN_URL"
 echo "[sync] fetch + reset main"
 "${G[@]}" -C "$DIR" fetch -q origin main
 git -C "$DIR" checkout -q -B main origin/main
 git -C "$DIR" reset -q --hard origin/main
 echo "[sync] scripts/portfolio-sync.mjs"
 # portfolio-sync.mjs exits 1 when a single photo fails but still writes the others; those are committed below, and the
 # run ends with exit 1 so systemd shows that something needs a look (journalctl -u portfolio-sync).
 SYNC_RC=0
 docker run --rm --memory 3g --cpus 2 --network bridge \
  -e IMMICH_URL -e IMMICH_API_KEY -e PORTFOLIO_TAG_ID \
  -v "$DIR":/app --mount type=tmpfs,destination=/app/.git -w /app "$NODE" \
  sh -c 'npm install --no-audit --no-fund --loglevel=error >/dev/null && node scripts/portfolio-sync.mjs' || SYNC_RC=$?
 if git -C "$DIR" status --porcelain -- src/assets/images/portfolio | grep -q .; then
  git -C "$DIR" add -A src/assets/images/portfolio
  git -C "$DIR" -c user.name="portfolio-sync (Cleura)" -c user.email="Admin@imagesbyolofsson.se" \
    commit -q -m "chore(portfolio): sync $(date -u +%Y-%m-%d)"
  "${G[@]}" -C "$DIR" push -q origin main
  echo "[sync] pushed $(git -C "$DIR" rev-parse --short HEAD), rebuilding the live site"
  /opt/portal/site/build-live.sh main
 else
  echo "[sync] no changes"
 fi
 if [ "$SYNC_RC" != 0 ]; then
  echo "[sync] WARNING: portfolio-sync.mjs exited $SYNC_RC - some photos failed (see the lines with '!' above)"
  exit "$SYNC_RC"
 fi
@@ -0,0 +1,10 @@
 [Unit]
 Description=Portfolio sync every 20 minutes (Immich has no event when a photo is tagged, so it polls)
 [Timer]
 OnCalendar=*:0/20
 RandomizedDelaySec=60
 Persistent=true
 [Install]
 WantedBy=timers.target
@@ -0,0 +1,90 @@
 # nginx för imagesbyolofsson.se (Docker-image: dist/ i /usr/share/nginx/html).
 # Bygget använder build.format "file": /about -> about.html, 404 -> 404.html.
 # Samma regler som Caddy-varianten i deploy/caddy-site.snippet.
 # Cache-Control per sökväg (inte per Content-Type, så att /_astro/*.jpg också blir immutable).
 map $uri $ibo_cache_control {
    default                                                    "public, max-age=0, must-revalidate";
    ~^/_astro/                                                 "public, max-age=31536000, immutable";
    ~*\.(?:jpe?g|png|webp|avif|gif|svg|ico|woff2?|ttf|otf)$    "public, max-age=2592000";
    ~*\.(?:xml|txt)$                                           "public, max-age=3600";
 }
 # www -> apex (om www-trafik når den här containern).
 server {
    listen 80;
    server_name www.imagesbyolofsson.se;
    return 301 https://imagesbyolofsson.se$request_uri;
 }
 server {
    listen 80 default_server;
    server_name _;
    root /usr/share/nginx/html;
    index index.html;
    # Relativa Location-headers: bakom Cloudflare/proxy blir det aldrig http://host:80/...
    absolute_redirect off;
    server_tokens off;
    # Säkerhetsheaders. OBS: inga add_header i location-blocken nedan, annars ärvs inte dessa.
    # CSP: tillåter Meta Pixel (connect.facebook.net/facebook.com, laddas först efter samtycke),
    # den anonyma statistiken (sendBeacon till customer.imagesbyolofsson.se) och Cloudflares
    # egna skript (/cdn-cgi, ev. Web Analytics). 'unsafe-inline' behövs för samtyckesskriptet
    # och Astros inlinade skript/stilar; byt mot hashar (Astro experimental.csp) i ett senare steg.
    add_header Strict-Transport-Security "max-age=31536000" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=(), usb=()" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://connect.facebook.net https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://www.facebook.com https://*.facebook.com; font-src 'self' data:; connect-src 'self' https://customer.imagesbyolofsson.se https://www.facebook.com https://*.facebook.com https://connect.facebook.net https://cloudflareinsights.com; frame-src https://www.facebook.com; frame-ancestors 'self'; base-uri 'self'; form-action 'self'; object-src 'none'; upgrade-insecure-requests" always;
    add_header Cache-Control $ibo_cache_control always;
    # Gamla indexerade adresser -> närmaste nya sida.
    location ~ ^/(?:my-people|animales-and-nature|celebrations-with-family|northen-lights)/?$ {
        return 301 /portfolio;
    }
    # /index.html och /about.html -> rena URL:er (bara externa anrop; try_files nedan
    # serverar filerna internt utan att gå hit).
    location = /index.html {
        return 301 /;
    }
    location ~ ^(?<ibo_noext>/.+)\.html$ {
        return 301 $ibo_noext$is_args$args;
    }
    # Inga dubbletter med avslutande snedstreck: /about/ -> /about.
    location ~ ^(?<ibo_noslash>/.+)/$ {
        return 301 $ibo_noslash$is_args$args;
    }
    # Startsidan serveras direkt (ingen intern omdirigering till /index.html).
    location = / {
        try_files /index.html =404;
    }
    # Hashade Astro-filer: cachas ett år (immutable sätts via map ovan).
    location ^~ /_astro/ {
        access_log off;
        try_files $uri =404;
    }
    # Originalnedladdning (/download/original) proxas till Immich någon annanstans
    # (Cloudflare/Caddy). Finns den regeln i den här nginx: lägg den här ovanför.
    location / {
        try_files $uri $uri.html =404;
    }
    # Riktig 404: 404.html med status 404 (inte startsidan med 200).
    error_page 404 /404.html;
    location = /404.html {
        internal;
    }
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css text/xml application/xml application/json application/javascript application/xml+rss image/svg+xml;
 }
@@ -0,0 +1,38 @@
 # robots.txt – https://imagesbyolofsson.se
 #
 # Policy (beslut av Linus 2026-10-27): ALLA botar är välkomna, även AI-crawlers
 # och träningsbotar. Innehållet får användas av AI-assistenter med hänvisning
 # till Images by Olofsson (se /llms.txt). Cloudflare-sidan (AI Crawl Control /
 # "Block AI bots" / hanterad robots.txt) ställs in separat så att den inte
 # blockerar eller skriver över detta.
 User-agent: *
 Allow: /
 # AI-crawlers och träningsbotar: uttryckligen tillåtna.
 User-agent: GPTBot
 User-agent: OAI-SearchBot
 User-agent: ChatGPT-User
 User-agent: ClaudeBot
 User-agent: Claude-User
 User-agent: Claude-SearchBot
 User-agent: anthropic-ai
 User-agent: CCBot
 User-agent: Google-Extended
 User-agent: Applebot
 User-agent: Applebot-Extended
 User-agent: Bytespider
 User-agent: Amazonbot
 User-agent: meta-externalagent
 User-agent: meta-externalfetcher
 User-agent: FacebookBot
 User-agent: PerplexityBot
 User-agent: Perplexity-User
 User-agent: cohere-ai
 User-agent: Diffbot
 User-agent: YouBot
 User-agent: DuckAssistBot
 User-agent: MistralAI-User
 Allow: /
 Sitemap: https://imagesbyolofsson.se/sitemap-index.xml
@@ -0,0 +1,32 @@
 // Engangsjobb: skapa -s (800px) och -m (1600px) for redan synkade portfolio-bilder.
 // Kallan ar den befintliga 3000px-filen i repot - ingen ny nedladdning fran Immich.
 import fs from "node:fs";
 import path from "node:path";
 import sharp from "sharp";
 const DIR = "src/assets/images/portfolio";
 const SIZES = [{ suffix: "-s", dim: 800 }, { suffix: "-m", dim: 1600 }];
 const QUALITY = 88;
 const files = fs.readdirSync(DIR).filter(
  (f) => /^immich-[0-9a-f-]{36}-/i.test(f) && /\.jpg$/i.test(f) && !/-[sm]\.jpg$/i.test(f)
 );
 console.log(`hittade ${files.length} large-bilder`);
 let skapade = 0, hoppade = 0;
 for (const f of files) {
  const src = path.join(DIR, f);
  const base = src.replace(/\.jpg$/i, "");
  for (const { suffix, dim } of SIZES) {
    const dest = `${base}${suffix}.jpg`;
    if (fs.existsSync(dest)) { hoppade++; continue; }
    await sharp(src)
      .rotate()
      .resize(dim, dim, { fit: "inside", withoutEnlargement: true })
      .withMetadata()
      .jpeg({ quality: QUALITY })
      .toFile(dest);
    skapade++;
  }
 }
 console.log(`klart: ${skapade} skapade, ${hoppade} fanns redan`);
@@ -0,0 +1,133 @@
 #!/usr/bin/env node
 // Portfolio-synk: speglar Immich "portfolio"-taggade bilder till src/assets/images/portfolio/
 // Självläkande: härleder synkat tillstånd från immich-<assetId>-*-filnamn i repot.
 // Bevarar EXIF (portfolion läser DateTimeOriginal/Model/ISO för år/månad-filter + lightbox).
 import fs from "node:fs";
 import path from "node:path";
 import sharp from "sharp";
 const IMMICH = process.env.IMMICH_URL || "https://foto.imagesbyolofsson.se/api";
 const KEY = process.env.IMMICH_API_KEY;
 const TAGID = process.env.PORTFOLIO_TAG_ID || "67d16b6c-0dea-42ef-a289-2c9e57fa5c5a";
 const PORTFOLIO_DIR = "src/assets/images/portfolio";
 const MAX_DIM = 3000;
 const JPEG_QUALITY = 88;
 // RAW-format som sharp/libvips inte kan konvertera — hoppas över elegant.
 // Tagga JPEG-versionen (redigera RAW → exportera JPEG → tagga den) istället.
 const RAW_EXTENSIONS = [".cr2", ".cr3", ".arw", ".nef", ".dng", ".raf", ".orf", ".rw2", ".pef", ".srw"];
 function isRaw(name) {
  const lower = name.toLowerCase();
  return RAW_EXTENSIONS.some((ext) => lower.endsWith(ext));
 }
 if (!KEY) { console.error("IMMICH_API_KEY saknas"); process.exit(1); }
 async function api(method, pathname, body) {
  const res = await fetch(IMMICH + pathname, {
    method,
    headers: { "x-api-key": KEY, "Content-Type": "application/json" },
    body: body ? JSON.stringify(body) : undefined,
  });
  if (!res.ok) throw new Error(`${method} ${pathname} → ${res.status}: ${(await res.text()).slice(0, 200)}`);
  return res;
 }
 // Hämta alla portfolio-taggade assets (paginerat, unikt på id — search/metadata ger dubbletter över sidgräns)
 async function fetchTagged() {
  const map = new Map();
  let page = 1;
  while (true) {
    const res = await api("POST", "/search/metadata", { tagIds: [TAGID], size: 250, page });
    const d = await res.json();
    const items = d.assets.items;
    if (!items.length) break;
    for (const a of items) {
      const date = a.exifInfo?.dateTimeOriginal || a.fileCreatedAt;
      map.set(a.id, { id: a.id, name: a.originalFileName, date });
    }
    const next = d.assets.nextPage;
    if (!next) break;
    page = Number(next);
  }
  return [...map.values()];
 }
 // Vilka immich-<assetId>-*.jpg finns redan i repot? → { assetId: filename }
 function existingSynced() {
  if (!fs.existsSync(PORTFOLIO_DIR)) return {};
  const out = {};
  for (const f of fs.readdirSync(PORTFOLIO_DIR)) {
    const m = f.match(/^immich-([0-9a-f-]{36})-/i);
    if (m) out[m[1]] = f;
  }
  return out;
 }
 // Bygg destinationsfilnamn: immich-<assetId>-<ÅÅÅÅMMDD>-<safeOriginalName>.jpg
 function destName(asset) {
  const d = asset.date ? new Date(asset.date) : new Date();
  const ymd = `${d.getFullYear()}${String(d.getMonth() + 1).padStart(2, "0")}${String(d.getDate()).padStart(2, "0")}`;
  // strippa ev. "<assetid>__"-prefix från originalnamnet (från migreringen), behåll basnamn utan ändelse
  let base = asset.name.replace(/^[0-9a-f-]{36}__/i, "").replace(/\.[^.]+$/, "");
  base = base.replace(/[^\w.\-]/g, "_").slice(0, 60);
  return `immich-${asset.id}-${ymd}-${base}.jpg`;
 }
 async function downloadAndResize(asset, destPath) {
  const res = await api("GET", `/assets/${asset.id}/original`);
  const buf = Buffer.from(await res.arrayBuffer());
  // Pixel shift and the 15000 px Instagram squares can exceed sharp's default limit (268 MP). JPEGs are shrunk while
  // they are decoded, so memory stays low; the sync container still has a memory cap.
  await sharp(buf, { limitInputPixels: 1_000_000_000 })
    .rotate()                               // respektera EXIF-orientering
    .resize(MAX_DIM, MAX_DIM, { fit: "inside", withoutEnlargement: true })
    .withMetadata()                         // BEVARA EXIF (kritiskt för portfolions datum/kamera)
    .jpeg({ quality: JPEG_QUALITY })
    .toFile(destPath);
 }
 async function main() {
  const taggedAll = await fetchTagged();
  // Hoppa över RAW-filer elegant — de räknas inte mot synk (tagga JPEG-versionen istället)
  const skippedRaw = taggedAll.filter((a) => isRaw(a.name));
  const tagged = taggedAll.filter((a) => !isRaw(a.name));
  const synced = existingSynced();
  const taggedIds = new Set(tagged.map((a) => a.id));
  const toAdd = tagged.filter((a) => !synced[a.id]);
  const toRemove = Object.entries(synced).filter(([id]) => !taggedIds.has(id)).map(([id, file]) => ({ id, file }));
  console.log(`portfolio-synk: ${taggedAll.length} taggade (${tagged.length} bilder + ${skippedRaw.length} RAW), ${Object.keys(synced).length} redan synkade`);
  console.log(`→ lägg till: ${toAdd.length}, ta bort: ${toRemove.length}`);
  if (skippedRaw.length) {
    console.log(`⏭  Hoppade över ${skippedRaw.length} RAW-fil(er) — tagga JPEG-versionen istället:`);
    for (const r of skippedRaw) console.log(`     ${r.name}`);
  }
  fs.mkdirSync(PORTFOLIO_DIR, { recursive: true });
  for (const a of toAdd) {
    const fname = destName(a);
    const dest = path.join(PORTFOLIO_DIR, fname);
    try {
      await downloadAndResize(a, dest);
      console.log(`  + ${fname}`);
    } catch (e) {
      console.error(`  ! misslyckades ${a.name}: ${e.message}`);
      process.exitCode = 1; // signalera fel men fortsätt med resten
    }
  }
  for (const r of toRemove) {
    fs.rmSync(path.join(PORTFOLIO_DIR, r.file), { force: true });
    console.log(`  - ${r.file}`);
  }
  // skriv ut om något ändrats (workflow läser detta för att avgöra commit)
  const changed = toAdd.length > 0 || toRemove.length > 0;
  fs.writeFileSync(process.env.GITHUB_OUTPUT || "/dev/stdout",
    `changed=${changed}\nadded=${toAdd.length}\nremoved=${toRemove.length}\n`, { flag: "a" });
 }
 main().catch((e) => { console.error("FEL:", e.message); process.exit(1); });
--- a/Show More
+++ b/Show More