Arx: follow-ups (Pro purchase test, extension page redesign, node rollout, ModSecurity plan, niletech leftovers)

Imported from GitHub issue El-SaMa/oma#135 by @El-SaMa.

---

Follow-ups for the Arx WordPress security work (hardening, vulnerability feeds, quarantine vault, fingerprints, lanetti-arx plugin, /products/arx landing, Arx Pro sale). Everything below is still open. The handbook page is apps/web/content/admin-docs/hosting/arx.md.

Do not touch: LaneDNS (lanedns.lanetti.fi, website 058ffc56…) stays out of Arx. Keep ModSecurity off unless item 3 is done first. Do not overwrite the Arx agent, firewall or Shield work owned by the other Arx stream.

1. Test an Arx Pro purchase end to end

Live since 2026-10-02: catalog arx (Personal 2.90 / Plus 6.90 / Agency 14.90 € per month; plan ids arx_pro_1/5/30; seats in services/core-api/src/licensing/plans.ts, 3327635d). Licence product c68f6b95 is published. Page: https://lanetti.fi/extensions/arx

• Buy Plus with a 100% coupon and check that the licence key gets 5 activations
• Activate in the lanetti-arx plugin on a site that is not hosted by us and check that Pro unlocks (daily checks, malware scan, quarantine)
• Cancel the test order and void the invoice (clean test data)

2. Roll Arx out to other app nodes (operator said wait; do it when asked)

Arx runs on nilek only. The landing says it is "included in Lanetti hosting", so that claim is not yet true on every node.

• Run the deploy/ansible/nilek-site-security.yml equivalent for laituri, satama, ranta and kauppa: oma-arx-wp, oma-arx-sigs timer, oma-site-scan.sh with sha256
• Enrol the WordPress sites, check, then secure_recommended site by site with the HTTP verify

3. ModSecurity (optional, operator decides)

Enhance ships libmodsecurity with OWASP CRS (3.x line). On laituri the module is built in and /etc/modsecurity.d/modsec.conf is empty, so it is off. Arx web_firewall only flips the Enhance per-domain toggle. Do not enable it blind; it breaks WordPress (Elementor, checkout, forms).

• Watch mode first (SecRuleEngine DetectionOnly), CRS paranoia level 1, plus the official WordPress rule exclusions plugin (kauppa, laituri, satama since 2026-10-14; WooCommerce checkout exclusions added)
• Arx reads the audit log for 7 to 14 days and builds per-site SecRuleRemoveById exclusions inside the # BEGIN oma-arx vhost block (server-level modsecurity_rules)
• Only then block, with the same apply, verify and roll back flow (niletech blocking since 2026-10-13; other sites after ~1 week of watch data)

4. Site leftovers

• niletech: block_xmlrpc was left off because Jetpack is active, and php_uploads was skipped. Decide with the operator.
• niletech: 2 unexpected files in wp-includes (Requests/certificates/cacert.pem, .htaccess) and 2 modified plugin files. Review them and mark as benign or replace them. (Restore original files exists since 4ce4b834; the 2026-10-13 plugin updates may already have replaced them.)
• maxfort.fi is amber because of 1 outdated plugin

5. Nice to have

• Arx catalog and extension copy is English only (same as Backsies). Add fi and sv if the catalog gains per-locale fields.

6. Redesign the extension pages (operator: "format and design is so lame")

apps/web/app/(site)/extensions/[slug]/page.tsx (109 lines) and extensions/page.tsx are plain compared to the rest of the marketing site. Affects https://lanetti.fi/extensions/arx, /extensions/backsies and /extensions/lafu-reports-pro.

• Rebuild [slug] with the shared marketing components the product pages use: page-hero, feature-grid / feature-split, app-market-pricing (plan cards like hosting), check-list, faq-list, cta-band, breadcrumb, json-ld. Use mktContainer from lib/marketing/type-chrome.
• Per-product brand hero: Arx uses the navy castle look from /products/arx (components/arx/arx-castle.tsx, /brand/arx-*.svg). Backsies and LAFU get their own logo and accent.
• Plan cards: price per month, site count, highlights, "Popular" badge, buy CTA into checkout. Show feature boxes and FAQ from the catalog (featureBoxes, faq).
• Link back to the full landing where one exists (Arx → /products/arx). The /products/arx plugin plans section should link to /extensions/arx instead of "Talk to us".
• Give /extensions a proper store grid (shadow cards like the products: app-market-store-card).
• All copy as next-intl keys in en/fi/sv (plus the portal locales for customer copy), no em or en dashes; pnpm i18n:check passes
• Check at phone width; run public smoke after the deploy