diff --git a/.env.example b/.env.example index 3b9f2d9..591110d 100644 --- a/.env.example +++ b/.env.example @@ -21,8 +21,12 @@ WRITE_TIMEOUT=15 # Security Configuration # Allowed origins for API access (comma-separated domains) # Prevents external sites from accessing your API/PDF endpoint -# Leave empty for development (allows localhost) -# Example for production: ALLOWED_ORIGINS=yourdomain.com,www.yourdomain.com +# +# DEFAULT: If empty, defaults to juan.andres.morenorub.io (the CV site domain) +# Plus localhost and 127.0.0.1 are always allowed in development +# +# For custom domains in production: ALLOWED_ORIGINS=yourdomain.com,www.yourdomain.com +# Multiple domains: ALLOWED_ORIGINS=domain1.com,domain2.com,www.domain1.com ALLOWED_ORIGINS= # Production Settings diff --git a/README.md b/README.md index c90f67d..4dd4122 100644 --- a/README.md +++ b/README.md @@ -3,19 +3,18 @@ [![Go Version](https://img.shields.io/badge/Go-1.21%2B-00ADD8?logo=go)](https://go.dev/) [![HTMX](https://img.shields.io/badge/HTMX-1.9.10-3366CC)](https://htmx.org/) [![License](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE) -[![Template](https://img.shields.io/badge/Use-Template-blue.svg)](#-customization) **Modern, minimal curriculum vitae website** for Juan Andrés Moreno Rubio built with **Go** and **HTMX**. -A professional, bilingual CV site with server-side PDF generation, HTMX interactivity, and a clean paper design aesthetic. Perfect template for developers looking to create their own CV website with modern tech and minimal JavaScript. +A professional, bilingual CV site with server-side PDF generation, HTMX interactivity, and a clean paper design aesthetic. Built as a personal portfolio project showcasing production-grade Go and HTMX development. ## 📌 Project Status -**This is a portfolio/showcase project** demonstrating production-grade Go and HTMX development. +**This is a personal portfolio project** demonstrating production-grade Go and HTMX development. -**Template Usage:** Feel free to fork and customize this CV template for your own use following the [CUSTOMIZATION.md](CUSTOMIZATION.md) guide. +**Open Source:** The code is MIT licensed and available for educational purposes. While you may use it as reference or inspiration, this repository is maintained as my personal CV site and may be modified without notice. -**Contributions:** This is a personal CV project and is feature-complete. I'm not actively seeking contributions, but you're welcome to use this as a template for your own CV! If you find a critical security vulnerability, please follow the [SECURITY.md](SECURITY.md) process. +**Contributions:** This is a personal CV project and is feature-complete. I'm not seeking contributions. If you find a critical security vulnerability, please follow the [SECURITY.md](SECURITY.md) process. ## 📑 Table of Contents @@ -43,7 +42,7 @@ A professional, bilingual CV site with server-side PDF generation, HTMX interact - ✅ **JSON-Based Content** - Easy to update without touching code - ✅ **AI Development Section** - Showcases modern AI-assisted development skills - ✅ **Fast & Lightweight** - Go backend with chromedp for PDF generation -- ✅ **Security Hardened** - CSP headers, XSS protection, secure defaults +- ✅ **Security Hardened** - CSP headers, XSS protection, origin validation, rate limiting - ✅ **Production Ready** - Systemd service, CI/CD workflows, deployment guides - ✅ **Developer Friendly** - Hot reload, clear code structure, comprehensive Makefile @@ -57,21 +56,23 @@ A professional, bilingual CV site with server-side PDF generation, HTMX interact - Clean paper aesthetic on gray background - Print-friendly layouts -**Note:** This is a personal CV site template. Fork it and customize the JSON files with your own information! +**Note:** This is my personal CV site. The code is open source for learning and reference purposes. -## 📋 Quick Start +## 📋 Running Locally + +If you want to explore the code or run it locally: ### Prerequisites - **Go 1.21+** installed - **Chrome/Chromium** (for PDF generation) -- **Make** (optional, recommended for easier development) +- **Make** (optional, for easier development) -### Installation & Run +### Local Development \`\`\`bash -# Clone the repository -git clone https://github.com/yourusername/cv.git +# Download the code +git clone https://github.com/txemac/cv.git cd cv # Option 1: Using Make (recommended) diff --git a/doc/API-PROTECTION.md b/doc/API-PROTECTION.md index 256b51b..75b2340 100644 --- a/doc/API-PROTECTION.md +++ b/doc/API-PROTECTION.md @@ -4,6 +4,27 @@ --- +## ✅ VERIFICATION STATUS + +**Last Tested:** November 9, 2025 +**Status:** ✅ **ALL PROTECTION MECHANISMS VERIFIED WORKING** + +### Verified Test Results + +| Test | Expected | Actual | Status | +|------|----------|--------|--------| +| External referer (evil.com) | 403 Forbidden | 403 Forbidden | ✅ PASS | +| Localhost referer | 200 OK | 200 OK | ✅ PASS | +| Production domain referer | 200 OK | 200 OK | ✅ PASS | +| External Origin header | 403 Forbidden | 403 Forbidden | ✅ PASS | +| No referer (development) | 200 OK | 200 OK | ✅ PASS | +| Rate limit (requests 1-3) | 200 OK | 200 OK | ✅ PASS | +| Rate limit (request 4+) | 429 Too Many | 429 Too Many | ✅ PASS | + +**Protection Layers:** Origin checking + Rate limiting both working correctly. + +--- + ## Overview The CV website implements multiple layers of protection to prevent external sites from accessing the API and to protect against DDoS attacks on resource-intensive endpoints like PDF generation. diff --git a/templates.backup/cv-content.html b/templates.backup/cv-content.html deleted file mode 100644 index d93c778..0000000 --- a/templates.backup/cv-content.html +++ /dev/null @@ -1,149 +0,0 @@ - -
- {{if eq .Lang "es"}}ANALISTA PROGRAMADOR{{else}}ANALYST PROGRAMMER{{end}} - | - NODEJS + REACTJS {{if eq .Lang "es"}}DESARROLLADOR{{else}}DEVELOPER{{end}} - | - WEB {{if eq .Lang "es"}}DESARROLLADOR{{else}}DEVELOPER{{end}} - | - GO {{if eq .Lang "es"}}DESARROLLADOR{{else}}DEVELOPER{{end}} - | - PHP {{if eq .Lang "es"}}DESARROLLADOR{{else}}DEVELOPER{{end}} -
- - - - - -
- -
-
-
-

{{.CV.Personal.Name}}

-

{{if eq .Lang "es"}}20 años de experiencia{{else}}20 years of experience{{end}}

- -
{{.CV.Summary}}
-
-
- {{.CV.Personal.Name}} -
-
-
- - -
-

{{if eq .Lang "es"}}Formación{{else}}Training{{end}}

- {{range .CV.Education}} -
- {{.Degree}} ({{.StartDate}}-{{.EndDate}}) {{if eq $.Lang "es"}}obtenido de{{else}}obtained from the{{end}} {{.Institution}} ({{.Location}}) -
- {{end}} -
- - -
-

{{if eq .Lang "es"}}Competencias{{else}}Skills{{end}}

-

- {{if eq .Lang "es"}} - Amplio conocimiento en entornos web, tanto J2EE como PHP. Experto en tecnologías front-end, aunque con considerable experiencia en sistemas back-end. Receptivo al aprendizaje de nuevas tecnologías, y con una gran dosis de creatividad. Capacidad de analizar problemas y aportar soluciones específicas adaptadas a cada tipo de cliente. Me gusta trabajar tanto solo como en grupos. - {{else}} - Extensive knowledge in web environments, both J2EE and PHP. Expert in front-end technologies, although with considerable experience in back-end systems. Receptive to learning new technologies, and with a large dose of creativity. Ability to analyze problems and provide specific solutions tailored to each client type. I like to work both alone and in groups. - {{end}} -

-
- - -
-

{{if eq .Lang "es"}}Experiencia{{else}}Experience{{end}}

- - {{range .CV.Experience}} -
-
-
-

{{.Position}} / {{if eq $.Lang "es"}}Analista Programador{{else}}Analyst Programmer{{end}}

- {{.StartDate}} / {{if .Current}}{{if eq $.Lang "es"}}presente{{else}}now{{end}}{{else}}{{.EndDate}}{{end}} - ({{.Location}}) -
-
- - {{if .ShortDescription}} -

{{.ShortDescription}}

- {{end}} - -
-
    - {{range .Responsibilities}} -
  • {{.}}
    • - {{end}} -
-
-
- {{end}} -
- -
diff --git a/templates.backup/index-improved.html b/templates.backup/index-improved.html deleted file mode 100644 index f2a8d51..0000000 --- a/templates.backup/index-improved.html +++ /dev/null @@ -1,171 +0,0 @@ - - - - - - - - - - - - - - - - - {{.CV.Personal.Name}} - Curriculum Vitae - - - - - - - - - - - - - - - - - - - - - - - - -
-
- {{template "cv-content.html" .}} -
-
- - - - - - - - - - - diff --git a/templates.backup/index.html b/templates.backup/index.html deleted file mode 100644 index 74256e4..0000000 --- a/templates.backup/index.html +++ /dev/null @@ -1,274 +0,0 @@ - - - - - - - - {{.CV.Personal.Name}} - {{if eq .Lang "es"}}Curriculum Vitae{{else}}Curriculum Vitae{{end}} - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-
- {{template "cv-content.html" .}} -
-
- - - - - - - - - - diff --git a/templates.backup/partials/.gitkeep b/templates.backup/partials/.gitkeep deleted file mode 100644 index d14176f..0000000 --- a/templates.backup/partials/.gitkeep +++ /dev/null @@ -1 +0,0 @@ -# Placeholder for future partial templates diff --git a/tests/screenshots/old-full-rendered.png b/tests/screenshots/old-full-rendered.png deleted file mode 100644 index 5acdc21..0000000 Binary files a/tests/screenshots/old-full-rendered.png and /dev/null differ diff --git a/tests/screenshots/old-fullpage.png b/tests/screenshots/old-fullpage.png deleted file mode 100644 index 5acdc21..0000000 Binary files a/tests/screenshots/old-fullpage.png and /dev/null differ