From 613d46d0679be473e726c8f8315592a3c2270340 Mon Sep 17 00:00:00 2001
From: twotalesanimation <80506065+twotalesanimation@users.noreply.github.com>
Date: Sat, 17 Oct 2026 06:27:00 +0200
Subject: [PATCH] /previz: remove password protection

Pages stay unlisted (noindex, not in sitemap, not linked) and uncached.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .dockerignore      |  1 -
 .gitignore         |  2 --
 DEPLOY.md          | 16 ----------------
 docker-compose.yml |  4 ----
 docker/nginx.conf  |  7 ++-----
 5 files changed, 2 insertions(+), 28 deletions(-)

diff --git a/.dockerignore b/.dockerignore
index 0256fe1..a6d701c 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -7,5 +7,4 @@ content/*.mp4
 content/*.pdf
 *.md
 !README.md
-docker/auth
 content/crowd
diff --git a/.gitignore b/.gitignore
index 6f17b5d..c30672a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -53,5 +53,3 @@ content/*.mov
 # previz source renders (web versions in public/previz)
 content/crowd/
 
-# server-side login files for /previz/ (see DEPLOY.md)
-docker/auth/
diff --git a/DEPLOY.md b/DEPLOY.md
index 7702fe0..b21607b 100644
--- a/DEPLOY.md
+++ b/DEPLOY.md
@@ -112,22 +112,6 @@ The workflow is already in the repo (`.gitea/workflows/deploy.yml`). In Gitea, o
 Test it: push any commit to `main` and watch **Actions** in the repo. The job should run
 `git pull` and `docker compose up -d --build`, then the site updates.
 
-### 8. Password for /previz/
-
-Client previz pages under `/previz/` need a login (HTTP basic auth in `docker/nginx.conf`).
-The password file stays on the server and is never committed. Create it once:
-
-```bash
-cd /opt/ttvfx_web
-mkdir -p docker/auth
-printf "production:$(openssl passwd -apr1)\n" > docker/auth/previz.htpasswd   # prompts for the password
-docker compose up -d --force-recreate
-```
-
-`production` is the username. To change the password, run the `printf` line again. nginx reads
-the file on every request, so no restart is needed. To add a second login, append another line
-with `>>`. If the file is missing, `/previz/` returns a 500 error, so it is never left open.
-
 ---
 
 ## Day to day
diff --git a/docker-compose.yml b/docker-compose.yml
index 956fc24..b14e638 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -5,10 +5,6 @@ services:
 
     restart: unless-stopped
 
-    # Login for /previz/ (gitignored; created once on the server, see DEPLOY.md)
-    volumes:
-      - ./docker/auth:/etc/nginx/auth:ro
-
     networks:
       - npm_default
 
diff --git a/docker/nginx.conf b/docker/nginx.conf
index da034b8..b1df78a 100644
--- a/docker/nginx.conf
+++ b/docker/nginx.conf
@@ -23,12 +23,9 @@ server {
         add_header Cache-Control "public, max-age=604800";
     }
 
-    # Client previz pages: password protected (file lives on the server, see DEPLOY.md).
-    # ^~ beats the media regex above, so nothing in here gets a public cache header
-    # and Cloudflare never serves it to someone who hasn't logged in.
+    # Client previz pages: never cached, so updated renders show up straight away.
+    # ^~ beats the media regex above, so nothing in here gets the week-long cache.
     location ^~ /previz/ {
-        auth_basic "Two Tales VFX previz";
-        auth_basic_user_file /etc/nginx/auth/previz.htpasswd;
         add_header Cache-Control "private, no-store";
         try_files $uri $uri/ $uri.html =404;
     }