@pitaj It's an issue of preference I guess. I'd like to avoid grunt being a dev tool forcing me to deviate from my integrations needs. If grunt would support multiple instances, it would be great and I'd use it. Else I'd stick with the current big hammer method of always recompiling unconditionally and restarting nodebb afterwards. Accepting the additional penalty of nginx rev proxy streaming timeouts. Not elegant but it works.

Currently, I'm deploying with the following security config. Working fine so far, I'd like to get some community feedback. add_header Content-Security-Policy "default-src 'none'; \ connect-src 'self' https://forum.myforum.com/ wss://forum.myforum.com/ https://bootswatch.com/ https://api.github.com/; \ script-src 'self' 'unsafe-inline https://forum.myforum.com/ https://storage.googleapis.com/; \ img-src 'self' data: https://forum.myforum.com/ https://bootswatch.com/ https://i.imgur.com/ https://www.gravatar.com/; \ style-src 'self' 'unsafe-inline' https://forum.myforum.com/ https://fonts.googleapis.com/ https://maxcdn.bootstrapcdn.com/; \ font-src https://forum.myforum.com/ https://maxcdn.bootstrapcdn.com/bootswatch/latest/fonts/ chrome-extension://* https://fonts.gstatic.com/; \ frame-ancestors 'self'; \ object-src 'none'; manifest-src https://forum.myforum.com/;"; add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";׬ add_header 'Referrer-Policy' 'same-origin';¬ add_header X-Content-Type-Options nosniff;¬ add_header X-XSS-Protection "1; mode=block";¬ add_header X-Download-Options noopen;¬ add_header X-Permitted-Cross-Domain-Policies none;¬ add_header X-Frame-Options "SAMEORIGIN"; Helpful website for testing was https://observatory.mozilla.org/ edit: add manifest-src to enable webmanifest loading

It'd be awesome to have the 2FA plugin support FIDO2 devices for 2FA authentication. Like yubikeys, solos etc.

@baris Dam.. there it is, where all those magic strings meet! Thank you.

SOLVED Found the solution. Still had proxy directives in nginx config envs other than location / {}. So it was again an error introduced by an nginx config deviating from the recommendation by https://docs.nodebb.org/configuring/scaling/ .

SOLVED In the end, it was a proxy/cache issue, I assume. After fixing the proxy directives' placement in nginx config, disabling nginx caching, rebuilding and reloading nodebb and switching themes and back again, the issue was no longer there. After reenabling caching, everything was still ok. In case it should become clearer what caused the issue, I'll update this answer. For the JS issue, refer to https://community.nodebb.org/topic/16031/template-js-not-executed . Thanks.

@baris Thank you. Very valuable feedback. Ought the theme quickstart to be kept in sync with the plugin quickstart?

@pitaj Oh, this looks very promising. Thank you for the pointer.

@pitaj Wonderful. Thank you.

@pitaj Well, this info is golden. This clearly needs to be documented well and easily found. The usage message of ./nodebb setup --help should indicate the expected syntax and strikingly point out config.json is the wrong syntax in this case to be fed into ./nodebb setup. In the long run, there should be no special case or different syntax between node app --setup and ./nodebb setup. Thank you, @PitaJ, @Max-0 .