AGENTIO MUSIC — DEPLOYMENT
==========================

This is a static website: no database, no PHP and no server-side application code.

Files:
  index.html                 Main Agentio page
  riseup/index.html          Rise Up competition page
  assets/style.css           Site styling
  assets/agentio-portrait.webp
  assets/rise-up-hero.webp

Deploy to the existing server:

1. Copy the CONTENTS of this folder into:
   /var/www/agentiomusic.com/

2. Check permissions:
   sudo chown -R root:root /var/www/agentiomusic.com
   sudo find /var/www/agentiomusic.com -type d -exec chmod 755 {} \;
   sudo find /var/www/agentiomusic.com -type f -exec chmod 644 {} \;

3. Test nginx:
   sudo nginx -t

4. Reload nginx:
   sudo systemctl reload nginx

Then visit:
   https://agentiomusic.com
   https://agentiomusic.com/riseup/

SECURITY HEADERS (recommended once the site is confirmed working)
----------------------------------------------------------------
Add these lines inside the HTTPS server block for agentiomusic.com:

add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Content-Security-Policy "default-src 'self'; img-src 'self' data:; style-src 'self'; script-src 'self'; font-src 'self'; connect-src 'self'; frame-ancestors 'self'; base-uri 'self'; form-action 'self'" always;

IMPORTANT: If a YouTube player, Google form, analytics or other third-party service is embedded later, the Content-Security-Policy will need to be expanded for that service.
