[Flosk6]

What and why

The website (spawner.run, a separate repository) builds its documentation from docs/*.md and CHANGELOG.md. An adversarial review of that site found what this pull request fixes: pages that were false or missing, a quick start that cannot work (it never registers the project), no guide for previews of pull requests, and links that lead to a stale branch. It also found that the installer pins Traefik 3.5, which no longer gets security fixes.

Traefik 3.7

• TRAEFIK_IMAGE moves to traefik:v3.7@sha256:575fa15b… (3.7.14, the digest of the index from docker buildx imagetools inspect). The advisories published since 3.5's end of support are fixed in 3.6 and 3.7 only, among them a bypass of path-scoped routing and middlewares, request smuggling and a header sanitization bypass.
• Every entry point drops request headers whose name holds a character other than a letter, a digit or a dash (aliasheadersstrategy=delete, from 3.7.12): PHP or CGI read X_Spawner_Preview or X.Forwarded.For as the dashed name, which the middlewares remove or set. Spawner's own headers are dashed. An application that relies on a header with an underscore would stop receiving it (nginx drops them by default too). The development stack runs the same option.
• Traefik 3.7 embeds lego v5, which dropped the DNS providers azure (use azuredns), dnspod, googledomains, cloudxns, brandit, iwantmyname and iij (use iijdpf): in the changelog.
• Follow-up, not here: Traefik 3.7 logs two warnings per forwardAuth middleware at each configuration rebuild while trustForwardHeader and maxResponseBodySize are unset (router.service.ts).

Installer

• Below 4 GiB of memory, the defaults fit no environment: it says so and names SPAWNER_ENV_MEMORY and MIN_REQUIRED_FREE_MEMORY_GB.
• An /opt/spawner holding only .env and dns.env is accepted, as on a new server restored from a backup (the marker is read from .env); --upgrade stops when compose.yaml is missing.
• Messages: links to spawner.run, the Let's Encrypt e-mail is the account's contact, the Compose hint for Ubuntu's Docker, --purge says it deletes the secrets.

CLI, dashboard, release

• spawner init links spawner.yaml to https://spawner.run/docs/manifest/ instead of the v1 branch; the agent instructions say what to do on exit code 6; a 90-day token no longer expires "in 89d 24h".
• The dashboard's Docs button opens https://spawner.run/docs/ (the latest release's docs, rather than the running tag's directory on GitHub).
• npm: homepage https://spawner.run, the description, keywords people search with, and mcpName. A last release job publishes server.json to the official MCP Registry (GitHub OIDC, stable releases, after npm, unable to block it); 2.1.0 on npm has no mcpName, so the first listing comes with the next release.
• Release notes open with what Spawner is, give the install and upgrade commands apart, list the files, and verify them with the attestations or SHA256SUMS. Image labels point to the site.

Documentation

• New pages: quickstart.md, ci.md (GitHub Actions and GitLab CI), examples.md, troubleshooting.md.
• Corrections: 4 GiB minimum; a restore the installer accepts; uninstall and local install from the release URL; the compose policy as the code applies it (build.platform is refused); memory shared between services; public URLs never wake an environment; GitHub login creates accounts for members of its organization; every key of spawner.yaml; every CLI option, variable and error code; the nine MCP tools; more agents; "capacity" instead of "room"; the dashboard's names since 2.1.0.
• The facts of fix: sources a project lists, connections that lose access, uploads that stop at a limit #18 to fix(install): the low findings of the review on the installer, the image and the data #21 carried into the rewritten pages: source repositories, CPU and process budgets, NET_RAW, the firewall, no bootstrap token by default, attestations, the local secrets that stay home, the 5 queued uploads. configuration.md no longer says the Settings page overrides SPAWNER_ENV_CPUS and SPAWNER_ENV_PIDS: only the environment sets them.
• README and npm page: what Spawner is, links to the site, the quick start with the registration, the MCP tools.

Before merging

• The README, spawner init and the Docs button point to https://spawner.run, which is not online yet: the site goes live right after this merges, then follows each release.
• .github/assets/dashboard-*.png are the site's current screenshots, whose sidebar still says v2.0.0: to retake on a 2.1 stack.

Checks

• Tests next to the code (format.spec.ts, init.spec.ts), and the end-to-end check below still to run

• Documentation and CHANGELOG.md updated when the behaviour changes

• pnpm lint, pnpm typecheck and pnpm test pass: 578 tests (core 231, api 219, utils 24, cli 104).

• install.sh: bash -n after the merge with master; shellcheck 0.11.0 was clean on the version before it. The secret prompts were checked through a pty and the non-interactive paths in a Debian container; the installer's compose.yaml renders and parses in the three TLS modes.

• release.yml is valid YAML and its 12 run blocks pass bash -n.

• The site builds from these docs with no broken link or anchor.

• Not run: scripts/e2e-engine.sh with Traefik 3.7 (docker compose pull traefik && scripts/e2e-engine.sh), needed before merging; the workflows of ci.md were checked statically, never run on GitHub or GitLab.