/previz: remove password protection

Pages stay unlisted (noindex, not in sitemap, not linked) and uncached.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.dockerignore

@@ -7,5 +7,4 @@ content/*.mp4
 content/*.pdf
 *.md
 !README.md
-docker/auth
 content/crowd

.gitignore

@@ -53,5 +53,3 @@ content/*.mov
 # previz source renders (web versions in public/previz)
 content/crowd/
 
-# server-side login files for /previz/ (see DEPLOY.md)
-docker/auth/

DEPLOY.md

@@ -112,22 +112,6 @@ The workflow is already in the repo (`.gitea/workflows/deploy.yml`). In Gitea, o
 Test it: push any commit to `main` and watch **Actions** in the repo. The job should run
 `git pull` and `docker compose up -d --build`, then the site updates.
 
-### 8. Password for /previz/
-
-Client previz pages under `/previz/` need a login (HTTP basic auth in `docker/nginx.conf`).
-The password file stays on the server and is never committed. Create it once:
-
-```bash
-cd /opt/ttvfx_web
-mkdir -p docker/auth
-printf "production:$(openssl passwd -apr1)\n" > docker/auth/previz.htpasswd   # prompts for the password
-docker compose up -d --force-recreate
-```
-
-`production` is the username. To change the password, run the `printf` line again. nginx reads
-the file on every request, so no restart is needed. To add a second login, append another line
-with `>>`. If the file is missing, `/previz/` returns a 500 error, so it is never left open.
-
 ---
 
 ## Day to day

docker-compose.yml

@@ -5,10 +5,6 @@ services:
 
     restart: unless-stopped
 
-    # Login for /previz/ (gitignored; created once on the server, see DEPLOY.md)
-    volumes:
-      - ./docker/auth:/etc/nginx/auth:ro
-
     networks:
       - npm_default
 

docker/nginx.conf

@@ -23,12 +23,9 @@ server {
         add_header Cache-Control "public, max-age=604800";
     }
 
-    # Client previz pages: password protected (file lives on the server, see DEPLOY.md).
-    # ^~ beats the media regex above, so nothing in here gets a public cache header
-    # and Cloudflare never serves it to someone who hasn't logged in.
+    # Client previz pages: never cached, so updated renders show up straight away.
+    # ^~ beats the media regex above, so nothing in here gets the week-long cache.
     location ^~ /previz/ {
-        auth_basic "Two Tales VFX previz";
-        auth_basic_user_file /etc/nginx/auth/previz.htpasswd;
         add_header Cache-Control "private, no-store";
         try_files $uri $uri/ $uri.html =404;
     }