Harden onion boot flow and deepen site surfaces

Add persistent onion key backup and restore, improve startup resilience, and flesh out the major site verticals with richer navigation, search coverage, and operator documentation.

Made-with: Cursor

scripts/classroom-ufw.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+# Optional firewall for a demo host: clearnet cannot reach Next/nginx loopback fronts.
+# Run once with sudo after SSH access is confirmed. Re-read if your SSH port is not 22.
+#
+#   sudo bash scripts/classroom-ufw.sh
+#
+set -euo pipefail
+[[ "${EUID}" -eq 0 ]] || { echo "Run as root (sudo)."; exit 1; }
+
+SSH_PORT="${SSH_PORT:-22}"
+
+echo "This will enable UFW: default deny incoming, allow outgoing, allow TCP ${SSH_PORT} (SSH)."
+echo "Tor hidden services use outbound circuits only; no inbound clearnet ports are opened for CyberLux."
+read -r -p "Continue? [y/N] " ok || true
+[[ "${ok:-}" =~ ^[Yy]$ ]] || { echo "Aborted."; exit 0; }
+
+ufw default deny incoming
+ufw default allow outgoing
+ufw allow "${SSH_PORT}/tcp" comment "ssh"
+ufw --force enable
+ufw status verbose