Merged the template branch into main to pick up the 33 upstream changes.

Reconciled the bootstrap-customised files: kept the CCN naming, canonical
origin, database slug and analytics comments, dropped the template-only
Makefile, README.md and Scripts/bootstrap that bootstrap removes, and took
the template's ordering for the security headers in the production compose.

Services/Website/Sources/Library/Public/Extensions/AbsoluteConfigKey+Constants.swift

@@ -58,6 +58,11 @@ extension AbsoluteConfigKey {
         /// The absolute configuration key for the server's name.
         public static let serverName: AbsoluteConfigKey = .init(.HTTP.serverName)
     }
+    /// A namespace for the HTTPS redirect configuration keys, as absolute keys.
+    public enum HTTPS {
+        /// The absolute configuration key for reading the visitor's original scheme from the `X-Forwarded-Proto` header.
+        public static let trustForwardedProto: AbsoluteConfigKey = .init(.HTTPS.trustForwardedProto)
+    }
     /// A namespace for the logging configuration keys, as absolute keys.
     public enum Log {
         /// The absolute configuration key for the minimum log level.

Services/Website/Sources/Library/Public/Extensions/ConfigKey+Constants.swift

@@ -58,6 +58,12 @@ extension ConfigKey {
         /// The configuration key for the server's name.
         public static let serverName: ConfigKey = "http.serverName"
     }
+    /// A namespace for the HTTPS redirect configuration keys.
+    public enum HTTPS {
+        /// The configuration key for reading the visitor's original scheme from the `X-Forwarded-Proto` header, redirecting the plain-HTTP
+        /// ones to the site origin (enable only behind a trusted proxy that sets the header).
+        public static let trustForwardedProto: ConfigKey = "https.trustForwardedProto"
+    }
     /// A namespace for the logging configuration keys.
     public enum Log {
         /// The configuration key for the minimum log level.
@@ -92,4 +98,9 @@ extension ConfigKey {
         /// The configuration key for the `Strict-Transport-Security` header value (omitted when unset).
         public static let strictTransportSecurity: ConfigKey = "security.strictTransportSecurity"
     }
+    /// A namespace for the site configuration keys.
+    public enum Site {
+        /// The configuration key for the public origin the site is served at (scheme and host, no trailing slash).
+        public static let origin: ConfigKey = "site.origin"
+    }
 }

Services/Website/Sources/Library/Public/Extensions/NotFoundMiddleware+Defaults.swift

@@ -5,10 +5,10 @@ public extension NotFoundMiddleware {
 
     // MARK: Initializers
 
-    /// Creates a not-found middleware that renders the website's error page, localized to the module's String Catalog languages.
+    /// Creates a not-found middleware that renders the website's not-found page, localized to the module's String Catalog languages.
     /// - Parameters:
     ///   - assetVersion: the version token appended to the page's asset URLs, or `nil` (the default) to leave them unversioned.
-    ///   - analytics: the analytics tracker the error page embeds, or `nil` (the default) to omit it.
+    ///   - analytics: the analytics tracker the page embeds, or `nil` (the default) to omit the tracker script.
     init(
         assetVersion: String? = nil,
         analytics: Analytics? = nil

Services/Website/Sources/Library/Public/Extensions/String+Constants.swift

@@ -24,7 +24,9 @@ extension String {
     /// A namespace for the persistence's default configuration values and recognized tokens.
     public enum Database {
         /// The default persistence driver: in-memory SQLite, which needs no external infrastructure.
-        public static let driver = "inMemory"
+        public static let driver = driverInMemory
+        /// The driver token selecting the in-memory SQLite backend.
+        public static let driverInMemory = "inMemory"
         /// The driver token selecting the PostgreSQL backend.
         public static let driverPostgres = "postgres"
         /// The default PostgreSQL host.
@@ -34,9 +36,11 @@ extension String {
         /// The default database username.
         public static let username = "ccn"
         /// The default TLS posture token.
-        public static let tls = "prefer"
+        public static let tls = tlsPrefer
         /// The TLS token disabling TLS.
         public static let tlsOff = "off"
+        /// The TLS token upgrading to TLS only when the server offers it.
+        public static let tlsPrefer = "prefer"
         /// The TLS token requiring TLS.
         public static let tlsRequire = "require"
     }
@@ -50,4 +54,13 @@ extension String {
         /// The website server's name.
         public static let name = "CCNWebsite"
     }
+    /// A namespace for the site string constants.
+    public enum Site {
+        /// The default public origin the site is served at (scheme and host, no trailing slash).
+        ///
+        /// Bootstrap writes the canonical URL it prompts for here, leaving it empty for the placeholder. An empty or non-HTTPS origin disables
+        /// the HTTPS redirect, which `https.trustForwardedProto` must enable besides — a `301` is cached for a long time, so it is never issued
+        /// at a host nobody named.
+        public static let origin = ""
+    }
 }