Reset branch to main

docs/self-hosting/apache.md

@@ -0,0 +1,247 @@
+# Deploy with Apache
+
+Host BentoPDF using Apache HTTP Server.
+
+## Prerequisites
+
+- Apache 2.4+
+- mod_rewrite enabled
+- SSL certificate (recommended)
+
+## Step 1: Build the Project
+
+```bash
+git clone https://github.com/alam00000/bentopdf.git
+cd bentopdf
+npm install
+npm run build
+```
+
+To customize branding, set environment variables before building:
+
+```bash
+VITE_BRAND_NAME="AcmePDF" VITE_BRAND_LOGO="images/acme-logo.svg" npm run build
+```
+
+## Step 2: Copy Files
+
+```bash
+sudo mkdir -p /var/www/bentopdf
+sudo cp -r dist/* /var/www/bentopdf/
+sudo chown -R www-data:www-data /var/www/bentopdf
+```
+
+## Step 3: Apache Configuration
+
+Create `/etc/apache2/sites-available/bentopdf.conf`:
+
+```apache
+<VirtualHost *:80>
+    ServerName your-domain.com
+    Redirect permanent / https://your-domain.com/
+</VirtualHost>
+
+<VirtualHost *:443>
+    ServerName your-domain.com
+    DocumentRoot /var/www/bentopdf
+
+    SSLEngine on
+    SSLCertificateFile /etc/letsencrypt/live/your-domain.com/fullchain.pem
+    SSLCertificateKeyFile /etc/letsencrypt/live/your-domain.com/privkey.pem
+
+    <Directory /var/www/bentopdf>
+        Options -Indexes +FollowSymLinks
+        AllowOverride All
+        Require all granted
+    </Directory>
+
+    # WASM MIME type
+    AddType application/wasm .wasm
+
+    # Prevent double-compression of pre-compressed files
+    SetEnvIfNoCase Request_URI "\.gz$" no-gzip
+
+    # Compression
+    <IfModule mod_deflate.c>
+        AddOutputFilterByType DEFLATE text/html text/plain text/css application/javascript application/json application/wasm
+    </IfModule>
+
+    # Cache headers
+    <IfModule mod_expires.c>
+        ExpiresActive On
+        ExpiresByType application/javascript "access plus 1 year"
+        ExpiresByType text/css "access plus 1 year"
+        ExpiresByType application/wasm "access plus 1 year"
+        ExpiresByType image/png "access plus 1 year"
+        ExpiresByType image/svg+xml "access plus 1 year"
+    </IfModule>
+
+    # Required headers for SharedArrayBuffer (LibreOffice WASM)
+    Header always set Cross-Origin-Embedder-Policy "require-corp"
+    Header always set Cross-Origin-Opener-Policy "same-origin"
+    Header always set Cross-Origin-Resource-Policy "cross-origin"
+
+    # Security headers
+    Header always set X-Frame-Options "SAMEORIGIN"
+    Header always set X-Content-Type-Options "nosniff"
+
+    # Pre-compressed LibreOffice WASM files
+    <FilesMatch "soffice\.wasm\.gz$">
+        ForceType application/wasm
+        Header set Content-Encoding "gzip"
+    </FilesMatch>
+    <FilesMatch "soffice\.data\.gz$">
+        ForceType application/octet-stream
+        Header set Content-Encoding "gzip"
+    </FilesMatch>
+</VirtualHost>
+```
+
+## Step 4: .htaccess for Routing
+
+Create `/var/www/bentopdf/.htaccess`:
+
+```apache
+RewriteEngine On
+RewriteBase /
+
+# Existing files/dirs - serve directly
+RewriteCond %{REQUEST_FILENAME} -f [OR]
+RewriteCond %{REQUEST_FILENAME} -d
+RewriteRule ^ - [L]
+
+# ============================================
+# LANGUAGE ROUTES
+# ============================================
+# Supported languages: de, es, zh, zh-TW, vi, it, id, tr, fr, pt
+# English has no prefix - served from root
+
+# English prefix redirects to root
+RewriteRule ^en/?$ / [R=301,L]
+RewriteRule ^en/(.+)$ /$1 [R=301,L]
+
+# Language prefix root (e.g., /de/ -> /de/index.html)
+RewriteCond %{DOCUMENT_ROOT}/$1/index.html -f
+RewriteRule ^(de|es|zh|zh-TW|vi|it|id|tr|fr|pt)/?$ /$1/index.html [L]
+
+# Language prefix with path (e.g., /de/merge-pdf -> /de/merge-pdf.html)
+RewriteCond %{DOCUMENT_ROOT}/$1/$2.html -f
+RewriteRule ^(de|es|zh|zh-TW|vi|it|id|tr|fr|pt)/([^/]+)/?$ /$1/$2.html [L]
+
+# ============================================
+# ADD .HTML EXTENSION (ROOT LEVEL)
+# ============================================
+RewriteCond %{REQUEST_FILENAME} !-f
+RewriteCond %{REQUEST_FILENAME} !-d
+RewriteCond %{REQUEST_FILENAME}.html -f
+RewriteRule ^([^/]+)$ $1.html [L]
+
+ErrorDocument 404 /404.html
+```
+
+## Step 5: Enable Required Modules
+
+```bash
+sudo a2enmod rewrite
+sudo a2enmod ssl
+sudo a2enmod headers
+sudo a2enmod expires
+sudo a2enmod deflate
+```
+
+## Step 6: Enable the Site
+
+```bash
+sudo a2ensite bentopdf.conf
+sudo apache2ctl configtest
+sudo systemctl reload apache2
+```
+
+## Subdirectory Deployment
+
+To host at `/pdf/`:
+
+1. Build with base URL:
+
+```bash
+BASE_URL=/pdf/ npm run build
+```
+
+2. Update `.htaccess`:
+
+```apache
+RewriteEngine On
+RewriteBase /pdf/
+
+# Existing files/dirs - serve directly
+RewriteCond %{REQUEST_FILENAME} -f [OR]
+RewriteCond %{REQUEST_FILENAME} -d
+RewriteRule ^ - [L]
+
+# Language routes
+RewriteRule ^en/?$ /pdf/ [R=301,L]
+RewriteRule ^en/(.+)$ /pdf/$1 [R=301,L]
+
+RewriteCond %{DOCUMENT_ROOT}/pdf/$1/index.html -f
+RewriteRule ^(de|es|zh|zh-TW|vi|it|id|tr|fr|pt)/?$ /pdf/$1/index.html [L]
+
+RewriteCond %{DOCUMENT_ROOT}/pdf/$1/$2.html -f
+RewriteRule ^(de|es|zh|zh-TW|vi|it|id|tr|fr|pt)/([^/]+)/?$ /pdf/$1/$2.html [L]
+
+# Root level .html extension
+RewriteCond %{REQUEST_FILENAME} !-f
+RewriteCond %{REQUEST_FILENAME} !-d
+RewriteCond %{REQUEST_FILENAME}.html -f
+RewriteRule ^([^/]+)$ $1.html [L]
+
+ErrorDocument 404 /pdf/404.html
+```
+
+## Troubleshooting
+
+### WASM 404 Errors
+
+Ensure MIME type is configured:
+
+```apache
+AddType application/wasm .wasm
+```
+
+### Rewrite Not Working
+
+Check that mod_rewrite is enabled:
+
+```bash
+sudo a2enmod rewrite
+```
+
+### Word/ODT/Excel to PDF Not Working
+
+LibreOffice WASM requires `SharedArrayBuffer`, which needs these headers:
+
+```apache
+Header always set Cross-Origin-Embedder-Policy "require-corp"
+Header always set Cross-Origin-Opener-Policy "same-origin"
+```
+
+The pre-compressed `.wasm.gz` and `.data.gz` files also need correct `Content-Encoding`:
+
+```apache
+<FilesMatch "soffice\.wasm\.gz$">
+    ForceType application/wasm
+    Header set Content-Encoding "gzip"
+</FilesMatch>
+<FilesMatch "soffice\.data\.gz$">
+    ForceType application/octet-stream
+    Header set Content-Encoding "gzip"
+</FilesMatch>
+```
+
+Ensure `mod_headers` is enabled: `sudo a2enmod headers`
+
+### Permission Denied
+
+```bash
+sudo chown -R www-data:www-data /var/www/bentopdf
+sudo chmod -R 755 /var/www/bentopdf
+```

docs/self-hosting/aws.md

@@ -0,0 +1,189 @@
+# Deploy to AWS S3 + CloudFront
+
+Host BentoPDF on AWS for maximum control and scalability.
+
+## Architecture
+
+```
+User → CloudFront (CDN) → S3 (Static Files)
+```
+
+## Step 1: Create S3 Bucket
+
+```bash
+# Create bucket
+aws s3 mb s3://your-bentopdf-bucket --region us-east-1
+
+# Enable static website hosting
+aws s3 website s3://your-bentopdf-bucket \
+  --index-document index.html \
+  --error-document index.html
+```
+
+## Step 2: Build and Upload
+
+```bash
+# Build the project (optionally with custom branding)
+# VITE_BRAND_NAME="AcmePDF" VITE_BRAND_LOGO="images/acme-logo.svg" npm run build
+npm run build
+
+# Sync to S3
+aws s3 sync dist/ s3://your-bentopdf-bucket \
+  --delete \
+  --cache-control "max-age=31536000"
+
+# Set correct MIME types for WASM
+aws s3 cp s3://your-bentopdf-bucket/ s3://your-bentopdf-bucket/ \
+  --recursive \
+  --exclude "*" \
+  --include "*.wasm" \
+  --content-type "application/wasm" \
+  --metadata-directive REPLACE
+```
+
+## Step 3: Create CloudFront Distribution
+
+```bash
+aws cloudfront create-distribution \
+  --origin-domain-name your-bentopdf-bucket.s3.amazonaws.com \
+  --default-root-object index.html
+```
+
+Or use the AWS Console:
+
+1. Go to CloudFront → Create distribution
+2. Origin domain: Select your S3 bucket
+3. Enable "Origin Access Control"
+4. Default root object: `index.html`
+5. Create distribution
+
+## Step 3b: Response Headers Policy (Required for LibreOffice WASM)
+
+LibreOffice-based conversions (Word, Excel, PowerPoint to PDF) require `SharedArrayBuffer`, which needs specific response headers. Create a CloudFront Response Headers Policy:
+
+1. Go to CloudFront → Policies → Response headers
+2. Create a custom policy with these headers:
+
+| Header                         | Value          |
+| ------------------------------ | -------------- |
+| `Cross-Origin-Embedder-Policy` | `require-corp` |
+| `Cross-Origin-Opener-Policy`   | `same-origin`  |
+| `Cross-Origin-Resource-Policy` | `cross-origin` |
+
+3. Attach the policy to your distribution's default cache behavior
+
+Or via CLI:
+
+```bash
+aws cloudfront create-response-headers-policy \
+  --response-headers-policy-config '{
+    "Name": "BentoPDF-COEP-COOP",
+    "CustomHeadersConfig": {
+      "Quantity": 3,
+      "Items": [
+        {"Header": "Cross-Origin-Embedder-Policy", "Value": "require-corp", "Override": true},
+        {"Header": "Cross-Origin-Opener-Policy", "Value": "same-origin", "Override": true},
+        {"Header": "Cross-Origin-Resource-Policy", "Value": "cross-origin", "Override": true}
+      ]
+    }
+  }'
+```
+
+## Step 3c: S3 Metadata for Pre-Compressed WASM Files
+
+The LibreOffice WASM files are pre-compressed (`.wasm.gz`, `.data.gz`). Set the correct Content-Type and Content-Encoding so browsers decompress them:
+
+```bash
+# Set correct headers for soffice.wasm.gz
+aws s3 cp s3://your-bentopdf-bucket/libreoffice-wasm/soffice.wasm.gz \
+  s3://your-bentopdf-bucket/libreoffice-wasm/soffice.wasm.gz \
+  --content-type "application/wasm" \
+  --content-encoding "gzip" \
+  --metadata-directive REPLACE
+
+# Set correct headers for soffice.data.gz
+aws s3 cp s3://your-bentopdf-bucket/libreoffice-wasm/soffice.data.gz \
+  s3://your-bentopdf-bucket/libreoffice-wasm/soffice.data.gz \
+  --content-type "application/octet-stream" \
+  --content-encoding "gzip" \
+  --metadata-directive REPLACE
+```
+
+::: warning Important
+Without the response headers policy, `SharedArrayBuffer` is unavailable and LibreOffice WASM conversions will hang at ~55%. Without the correct Content-Encoding on the `.gz` files, the browser receives raw gzip bytes and WASM compilation fails.
+:::
+
+## Step 4: S3 Bucket Policy
+
+Allow CloudFront to access the bucket:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "AllowCloudFrontAccess",
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "cloudfront.amazonaws.com"
+      },
+      "Action": "s3:GetObject",
+      "Resource": "arn:aws:s3:::your-bentopdf-bucket/*",
+      "Condition": {
+        "StringEquals": {
+          "AWS:SourceArn": "arn:aws:cloudfront::ACCOUNT_ID:distribution/DISTRIBUTION_ID"
+        }
+      }
+    }
+  ]
+}
+```
+
+## Step 5: Custom Error Pages
+
+Configure 404 to return `index.html` for SPA routing:
+
+1. CloudFront → Error pages
+2. Create custom error response:
+   - HTTP error code: 404
+   - Response page path: `/index.html`
+   - HTTP response code: 200
+
+## Cost Estimation
+
+| Resource                   | Estimated Cost |
+| -------------------------- | -------------- |
+| S3 Storage (~500MB)        | ~$0.01/month   |
+| CloudFront (1TB transfer)  | ~$85/month     |
+| CloudFront (10GB transfer) | ~$0.85/month   |
+
+::: tip
+Use S3 Intelligent Tiering for cost optimization on infrequently accessed files.
+:::
+
+## Automation with Terraform
+
+```hcl
+# main.tf
+resource "aws_s3_bucket" "bentopdf" {
+  bucket = "your-bentopdf-bucket"
+}
+
+resource "aws_cloudfront_distribution" "bentopdf" {
+  origin {
+    domain_name = aws_s3_bucket.bentopdf.bucket_regional_domain_name
+    origin_id   = "S3Origin"
+  }
+
+  enabled             = true
+  default_root_object = "index.html"
+
+  default_cache_behavior {
+    allowed_methods  = ["GET", "HEAD"]
+    cached_methods   = ["GET", "HEAD"]
+    target_origin_id = "S3Origin"
+
+    viewer_protocol_policy = "redirect-to-https"
+  }
+}
+```

docs/self-hosting/cloudflare.md

@@ -0,0 +1,154 @@
+# Deploy to Cloudflare Pages
+
+[Cloudflare Pages](https://pages.cloudflare.com) offers fast, global static site hosting with unlimited bandwidth.
+
+## Quick Deploy
+
+1. Go to [Cloudflare Pages](https://dash.cloudflare.com/?to=/:account/pages)
+2. Click "Create a project"
+3. Connect your GitHub repository
+
+## Build Configuration
+
+| Setting                | Value           |
+| ---------------------- | --------------- |
+| Framework preset       | None            |
+| Build command          | `npm run build` |
+| Build output directory | `dist`          |
+| Root directory         | `/`             |
+
+## Environment Variables
+
+Add these in Settings → Environment variables:
+
+| Variable                | Value                                      |
+| ----------------------- | ------------------------------------------ |
+| `NODE_VERSION`          | `18`                                       |
+| `SIMPLE_MODE`           | `false` (optional)                         |
+| `VITE_BRAND_NAME`       | Custom brand name (optional)               |
+| `VITE_BRAND_LOGO`       | Logo path relative to `public/` (optional) |
+| `VITE_FOOTER_TEXT`      | Custom footer/copyright text (optional)    |
+| `VITE_DEFAULT_LANGUAGE` | Default UI language, e.g. `fr` (optional)  |
+
+## Configuration File
+
+Create `_headers` in your `public` folder:
+
+```
+# Required security headers for SharedArrayBuffer (used by LibreOffice WASM)
+/*
+  Cross-Origin-Embedder-Policy: require-corp
+  Cross-Origin-Opener-Policy: same-origin
+  Cross-Origin-Resource-Policy: cross-origin
+
+# Pre-compressed LibreOffice WASM binary
+/libreoffice-wasm/soffice.wasm.gz
+  Content-Type: application/wasm
+  Content-Encoding: gzip
+  Cache-Control: public, max-age=31536000, immutable
+
+# Pre-compressed LibreOffice WASM data
+/libreoffice-wasm/soffice.data.gz
+  Content-Type: application/octet-stream
+  Content-Encoding: gzip
+  Cache-Control: public, max-age=31536000, immutable
+
+# Cache WASM files aggressively
+/*.wasm
+  Cache-Control: public, max-age=31536000, immutable
+  Content-Type: application/wasm
+
+# Service worker
+/sw.js
+  Cache-Control: no-cache
+```
+
+::: warning Important
+The `Cross-Origin-Embedder-Policy` and `Cross-Origin-Opener-Policy` headers are required for Word/ODT/Excel/PowerPoint to PDF conversions. Without them, `SharedArrayBuffer` is unavailable and the LibreOffice WASM engine will fail to initialize.
+:::
+
+Create `_redirects` for SPA routing:
+
+```
+/*    /index.html   200
+```
+
+## Custom Domain
+
+1. Go to your Pages project
+2. Click "Custom domains"
+3. Add your domain
+4. Cloudflare will auto-configure DNS if the domain is on Cloudflare
+
+## Advantages
+
+- **Free unlimited bandwidth**
+- **Global CDN** with 300+ edge locations
+- **Automatic HTTPS**
+- **Preview deployments** for pull requests
+- **Fast builds**
+
+## Troubleshooting
+
+### Large File Uploads
+
+Cloudflare Pages supports files up to 25 MB. WASM modules should be fine, but if you hit limits, consider:
+
+```bash
+# Split large files during build
+npm run build
+```
+
+### Worker Size Limits
+
+If using Cloudflare Workers for advanced routing, note the 1 MB limit for free plans.
+
+## CORS Proxy Worker (For Digital Signatures)
+
+The Digital Signature tool requires a CORS proxy to fetch certificate chains. Deploy the included worker:
+
+```bash
+cd cloudflare
+npx wrangler login
+npx wrangler deploy
+```
+
+### Security Features
+
+| Feature                 | Description                    |
+| ----------------------- | ------------------------------ |
+| **URL Restrictions**    | Only certificate URLs allowed  |
+| **File Size Limit**     | Max 10MB per request           |
+| **Rate Limiting**       | 60 req/IP/min (requires KV)    |
+| **Private IP Blocking** | Blocks localhost, internal IPs |
+
+### Enable Rate Limiting
+
+```bash
+# Create KV namespace
+npx wrangler kv namespace create "RATE_LIMIT_KV"
+
+# Add to wrangler.toml with returned ID:
+# [[kv_namespaces]]
+# binding = "RATE_LIMIT_KV"
+# id = "YOUR_ID"
+
+npx wrangler deploy
+```
+
+### Build with Proxy URL
+
+```bash
+VITE_CORS_PROXY_URL=https://your-worker.workers.dev npm run build
+```
+
+Or with Docker:
+
+```bash
+export VITE_CORS_PROXY_URL="https://your-worker.workers.dev"
+DOCKER_BUILDKIT=1 docker build \
+  --secret id=VITE_CORS_PROXY_URL,env=VITE_CORS_PROXY_URL \
+  -t your-bentopdf .
+```
+
+> **Note:** See [README](https://github.com/alam00000/bentopdf#digital-signature-cors-proxy-required) for HMAC signature setup.

docs/self-hosting/cors-proxy.md

@@ -0,0 +1,172 @@
+# CORS Proxy for Certificate Fetching
+
+The digital signature tool uses a CORS proxy to fetch issuer certificates from external Certificate Authorities (CAs). This is necessary because many CA servers don't include CORS headers in their responses, which prevents direct browser-based fetching.
+
+Additionally, many CA servers serve certificates over plain HTTP. When your BentoPDF instance is hosted over HTTPS, browsers block these HTTP requests (mixed content policy). The CORS proxy resolves both issues by routing requests through an HTTPS endpoint with proper headers.
+
+## How It Works
+
+When signing a PDF with a certificate:
+
+1. The `zgapdfsigner` library tries to build a complete certificate chain
+2. It fetches issuer certificates from URLs embedded in your certificate's AIA (Authority Information Access) extension
+3. These requests are routed through a CORS proxy that adds the necessary `Access-Control-Allow-Origin` headers
+4. The proxy returns the certificate data to the browser
+
+## Self-Hosting the CORS Proxy
+
+If you're self-hosting BentoPDF, you'll need to deploy your own CORS proxy for digital signatures to work with certificates that require chain fetching.
+
+### Option 1: Cloudflare Workers (Recommended)
+
+1. **Install Wrangler CLI**:
+
+   ```bash
+   npm install -g wrangler
+   ```
+
+2. **Login to Cloudflare**:
+
+   ```bash
+   wrangler login
+   ```
+
+3. **Clone BentoPDF and update allowed origins**:
+
+   ```bash
+   git clone https://github.com/alam00000/bentopdf.git
+   cd bentopdf/cloudflare
+   ```
+
+   Open `cors-proxy-worker.js` and change the `ALLOWED_ORIGINS` array to your domain:
+
+   ```js
+   const ALLOWED_ORIGINS = [
+     'https://your-domain.com',
+     'https://www.your-domain.com',
+   ];
+   ```
+
+   ::: warning Important
+   Without this change, the proxy will reject all requests from your site with a **403 Forbidden** error. The default only allows requests from `bentopdf.com`.
+   :::
+
+4. **Deploy the proxy**:
+
+   ```bash
+   wrangler deploy
+   ```
+
+   Note your worker URL (e.g., `https://bentopdf-cors-proxy.your-subdomain.workers.dev`).
+
+5. **Rebuild BentoPDF with the proxy URL**:
+
+   If using Docker:
+
+   ```bash
+   export VITE_CORS_PROXY_URL="https://your-worker.workers.dev"
+   DOCKER_BUILDKIT=1 docker build \
+     --secret id=VITE_CORS_PROXY_URL,env=VITE_CORS_PROXY_URL \
+     -t your-bentopdf .
+   ```
+
+   If building from source:
+
+   ```bash
+   VITE_CORS_PROXY_URL=https://your-worker.workers.dev npm run build
+   ```
+
+### Option 2: Custom Backend Proxy
+
+You can also create your own proxy endpoint. The requirements are:
+
+1. Accept GET requests with a `url` query parameter
+2. Fetch the URL from your server (no CORS restrictions server-side)
+3. Return the response with these headers:
+   - `Access-Control-Allow-Origin: https://your-domain.com`
+   - `Access-Control-Allow-Methods: GET, OPTIONS`
+   - `X-Content-Type-Options: nosniff`
+
+Example Express.js implementation:
+
+```javascript
+app.get('/api/cert-proxy', async (req, res) => {
+  const targetUrl = req.query.url;
+
+  // Validate it's a certificate URL
+  if (!isValidCertUrl(targetUrl)) {
+    return res.status(400).json({ error: 'Invalid URL' });
+  }
+
+  try {
+    const response = await fetch(targetUrl);
+    const data = await response.arrayBuffer();
+
+    res.set('Access-Control-Allow-Origin', 'https://your-domain.com');
+    res.set('Content-Type', 'application/octet-stream');
+    res.set('X-Content-Type-Options', 'nosniff');
+    res.send(Buffer.from(data));
+  } catch (error) {
+    res.status(500).json({ error: 'Proxy error' });
+  }
+});
+```
+
+## Security Considerations
+
+The included Cloudflare Worker has several security measures:
+
+| Feature                 | Description                                                                            |
+| ----------------------- | -------------------------------------------------------------------------------------- |
+| **Origin Validation**   | Only allows requests from domains listed in `ALLOWED_ORIGINS`                          |
+| **URL Restrictions**    | Only allows certificate URLs (`.crt`, `.cer`, `.pem`, `/certs/`, `/ocsp`, `/crl`)      |
+| **Private IP Blocking** | Blocks IPv4/IPv6 private ranges, link-local, loopback, decimal IPs, and cloud metadata |
+| **Content-Type Safety** | Only returns safe certificate MIME types, blocks upstream content-type injection       |
+| **File Size Limit**     | Streams response with 10MB limit, aborts mid-download if exceeded                      |
+| **Rate Limiting**       | 60 requests per IP per minute (requires KV)                                            |
+| **HMAC Signatures**     | Optional client-side signing (deters casual abuse)                                     |
+
+## Disabling the Proxy
+
+If you don't want to use a CORS proxy, set the environment variable to an empty string:
+
+```
+VITE_CORS_PROXY_URL=
+```
+
+**Note**: Without the proxy, signing with certificates that require external chain fetching (like FNMT or some corporate CAs) will fail with a "Failed to fetch" error.
+
+## Troubleshooting
+
+### "Signing error: TypeError: Failed to fetch"
+
+This usually means either:
+
+1. **No CORS proxy configured** — Set `VITE_CORS_PROXY_URL` and rebuild
+2. **Mixed content blocked** — Your site is HTTPS but the certificate's issuer URL is HTTP. The CORS proxy resolves this.
+3. **CORS proxy rejecting your origin** — Check that your domain is in the `ALLOWED_ORIGINS` array in `cors-proxy-worker.js`
+
+### "403 Forbidden" from the proxy
+
+Your domain is not in the `ALLOWED_ORIGINS` list. Edit `cors-proxy-worker.js`:
+
+```js
+const ALLOWED_ORIGINS = ['https://your-domain.com'];
+```
+
+Then redeploy: `npx wrangler deploy`
+
+### Testing the proxy
+
+```bash
+curl -H "Origin: https://your-domain.com" \
+  "https://your-proxy.workers.dev?url=http://www.cert.fnmt.es/certs/ACUSU.crt"
+```
+
+### Certificates That Work Without Proxy
+
+Some certificates include the full chain in the P12/PFX file and don't require external fetching:
+
+- Self-signed certificates
+- Some commercial CAs that bundle intermediate certificates
+- Certificates you've manually assembled with the full chain

docs/self-hosting/docker.md

@@ -0,0 +1,449 @@
+# Deploy with Docker / Podman
+
+The easiest way to self-host BentoPDF in a production environment.
+
+> [!IMPORTANT]
+> **Required Headers for Office File Conversion**
+>
+> LibreOffice-based tools (Word, Excel, PowerPoint conversion) require these HTTP headers for `SharedArrayBuffer` support:
+>
+> - `Cross-Origin-Opener-Policy: same-origin`
+> - `Cross-Origin-Embedder-Policy: require-corp`
+>
+> The official container images include these headers. If using a reverse proxy (Traefik, Caddy, etc.), ensure these headers are preserved or added.
+
+> [!TIP]
+> **Podman Users:** All `docker` commands work with Podman by replacing `docker` with `podman` and `docker-compose` with `podman-compose`.
+
+## Quick Start
+
+```bash
+# Docker
+docker run -d \
+  --name bentopdf \
+  -p 3000:8080 \
+  --restart unless-stopped \
+  ghcr.io/alam00000/bentopdf:latest
+
+# Podman
+podman run -d \
+  --name bentopdf \
+  -p 3000:8080 \
+  ghcr.io/alam00000/bentopdf:latest
+```
+
+## Docker Compose / Podman Compose
+
+Create `docker-compose.yml`:
+
+```yaml
+services:
+  bentopdf:
+    image: ghcr.io/alam00000/bentopdf:latest
+    container_name: bentopdf
+    ports:
+      - '3000:8080'
+    restart: unless-stopped
+    healthcheck:
+      test: ['CMD', 'curl', '-f', 'http://localhost:8080']
+      interval: 30s
+      timeout: 10s
+      retries: 3
+```
+
+Run:
+
+```bash
+# Docker Compose
+docker compose up -d
+
+# Podman Compose
+podman-compose up -d
+```
+
+## Build Your Own Image
+
+```dockerfile
+# Dockerfile
+FROM node:20-alpine AS builder
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+FROM nginxinc/nginx-unprivileged:alpine
+COPY --from=builder /app/dist /usr/share/nginx/html
+COPY nginx.conf /etc/nginx/nginx.conf
+EXPOSE 8080
+CMD ["nginx", "-g", "daemon off;"]
+```
+
+Build and run:
+
+```bash
+docker build -t bentopdf:custom .
+docker run -d -p 3000:8080 bentopdf:custom
+```
+
+## Environment Variables
+
+| Variable                | Description                     | Default                                                        |
+| ----------------------- | ------------------------------- | -------------------------------------------------------------- |
+| `SIMPLE_MODE`           | Build without LibreOffice tools | `false`                                                        |
+| `BASE_URL`              | Deploy to subdirectory          | `/`                                                            |
+| `VITE_WASM_PYMUPDF_URL` | PyMuPDF WASM module URL         | `https://cdn.jsdelivr.net/npm/@bentopdf/pymupdf-wasm@0.11.16/` |
+| `VITE_WASM_GS_URL`      | Ghostscript WASM module URL     | `https://cdn.jsdelivr.net/npm/@bentopdf/gs-wasm/assets/`       |
+| `VITE_WASM_CPDF_URL`    | CoherentPDF WASM module URL     | `https://cdn.jsdelivr.net/npm/coherentpdf/dist/`               |
+| `VITE_DEFAULT_LANGUAGE` | Default UI language             | `en`                                                           |
+| `VITE_BRAND_NAME`       | Custom brand name               | `BentoPDF`                                                     |
+| `VITE_BRAND_LOGO`       | Logo path relative to `public/` | `images/favicon-no-bg.svg`                                     |
+| `VITE_FOOTER_TEXT`      | Custom footer/copyright text    | `© 2026 BentoPDF. All rights reserved.`                        |
+
+WASM module URLs are pre-configured with CDN defaults — all advanced features work out of the box. Override these for air-gapped or self-hosted deployments.
+
+`VITE_DEFAULT_LANGUAGE` sets the UI language for first-time visitors. Supported values: `en`, `ar`, `be`, `fr`, `de`, `es`, `zh`, `zh-TW`, `vi`, `tr`, `id`, `it`, `pt`, `nl`, `da`. Users can still switch languages — this only changes the default.
+
+Example:
+
+```bash
+# Build with French as the default language
+docker build --build-arg VITE_DEFAULT_LANGUAGE=fr -t bentopdf .
+docker run -d -p 3000:8080 bentopdf
+```
+
+### Custom Branding
+
+Replace the default BentoPDF logo, name, and footer text with your own. Place your logo file in the `public/` folder (or use an existing image), then pass the branding variables at build time:
+
+```bash
+docker build \
+  --build-arg VITE_BRAND_NAME="AcmePDF" \
+  --build-arg VITE_BRAND_LOGO="images/acme-logo.svg" \
+  --build-arg VITE_FOOTER_TEXT="© 2026 Acme Corp. Internal use only." \
+  -t acmepdf .
+```
+
+Branding works in both full mode and Simple Mode, and can be combined with all other build-time options.
+
+### Custom WASM URLs (Air-Gapped / Self-Hosted)
+
+> [!IMPORTANT]
+> WASM URLs are baked into the JavaScript at **build time**. The WASM files are downloaded by the **user's browser** at runtime — Docker does not download them during the build. For air-gapped networks, you must host the WASM files on an internal server that browsers can reach.
+
+**Full air-gapped workflow:**
+
+```bash
+# 1. On a machine WITH internet — download WASM packages
+npm pack @bentopdf/pymupdf-wasm@0.11.14
+npm pack @bentopdf/gs-wasm
+npm pack coherentpdf
+
+# 2. Build the image with your internal server URLs
+docker build \
+  --build-arg VITE_WASM_PYMUPDF_URL=https://internal-server.example.com/wasm/pymupdf/ \
+  --build-arg VITE_WASM_GS_URL=https://internal-server.example.com/wasm/gs/ \
+  --build-arg VITE_WASM_CPDF_URL=https://internal-server.example.com/wasm/cpdf/ \
+  -t bentopdf .
+
+# 3. Export the image
+docker save bentopdf -o bentopdf.tar
+
+# 4. Transfer bentopdf.tar + the .tgz WASM packages into the air-gapped network
+
+# 5. Inside the air-gapped network — load and run
+docker load -i bentopdf.tar
+
+# Extract WASM packages to your internal web server
+mkdir -p /var/www/wasm/pymupdf /var/www/wasm/gs /var/www/wasm/cpdf
+tar xzf bentopdf-pymupdf-wasm-0.11.14.tgz -C /var/www/wasm/pymupdf --strip-components=1
+tar xzf bentopdf-gs-wasm-*.tgz -C /var/www/wasm/gs --strip-components=1
+tar xzf coherentpdf-*.tgz -C /var/www/wasm/cpdf --strip-components=1
+
+# Run BentoPDF
+docker run -d -p 3000:8080 --restart unless-stopped bentopdf
+```
+
+Set a variable to empty string to disable that module (users must configure manually via Advanced Settings).
+
+## Custom User ID (PUID/PGID)
+
+For environments that require running as a specific non-root user (NAS devices, Kubernetes with security contexts, organizational policies), BentoPDF provides a separate Dockerfile with LSIO-style PUID/PGID support.
+
+### Build and Run
+
+```bash
+# Build the non-root image
+docker build -f Dockerfile.nonroot -t bentopdf-nonroot .
+
+# Run with custom UID/GID
+docker run -d \
+  --name bentopdf \
+  -p 3000:8080 \
+  -e PUID=1000 \
+  -e PGID=1000 \
+  --restart unless-stopped \
+  bentopdf-nonroot
+```
+
+### Environment Variables
+
+| Variable       | Description           | Default |
+| -------------- | --------------------- | ------- |
+| `PUID`         | User ID to run as     | `1000`  |
+| `PGID`         | Group ID to run as    | `1000`  |
+| `DISABLE_IPV6` | Disable IPv6 listener | `false` |
+
+### Docker Compose
+
+```yaml
+services:
+  bentopdf:
+    build:
+      context: .
+      dockerfile: Dockerfile.nonroot
+    container_name: bentopdf
+    ports:
+      - '3000:8080'
+    environment:
+      - PUID=1000
+      - PGID=1000
+    restart: unless-stopped
+```
+
+### How It Works
+
+The container starts as root, creates a user with the specified PUID/PGID, adjusts ownership on all writable directories, then drops privileges using `su-exec`. The nginx process runs entirely as your specified user.
+
+> [!NOTE]
+> The standard `Dockerfile` uses `nginx-unprivileged` (UID 101) and is recommended for most deployments. Use `Dockerfile.nonroot` only when you need a specific UID/GID.
+
+> [!WARNING]
+> PUID/PGID cannot be `0` (root). The entrypoint validates inputs and will exit with an error for invalid values.
+
+## With Traefik (Reverse Proxy)
+
+```yaml
+services:
+  traefik:
+    image: traefik:v2.10
+    command:
+      - '--providers.docker=true'
+      - '--entrypoints.web.address=:80'
+      - '--entrypoints.websecure.address=:443'
+      - '--certificatesresolvers.letsencrypt.acme.email=you@example.com'
+      - '--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json'
+      - '--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web'
+    ports:
+      - '80:80'
+      - '443:443'
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./letsencrypt:/letsencrypt
+
+  bentopdf:
+    image: ghcr.io/alam00000/bentopdf:latest
+    labels:
+      - 'traefik.enable=true'
+      - 'traefik.http.routers.bentopdf.rule=Host(`pdf.example.com`)'
+      - 'traefik.http.routers.bentopdf.entrypoints=websecure'
+      - 'traefik.http.routers.bentopdf.tls.certresolver=letsencrypt'
+      - 'traefik.http.services.bentopdf.loadbalancer.server.port=8080'
+      # Required headers for SharedArrayBuffer (LibreOffice WASM)
+      - 'traefik.http.routers.bentopdf.middlewares=bentopdf-headers'
+      - 'traefik.http.middlewares.bentopdf-headers.headers.customresponseheaders.Cross-Origin-Opener-Policy=same-origin'
+      - 'traefik.http.middlewares.bentopdf-headers.headers.customresponseheaders.Cross-Origin-Embedder-Policy=require-corp'
+    restart: unless-stopped
+```
+
+## With Caddy (Reverse Proxy)
+
+```yaml
+services:
+  caddy:
+    image: caddy:2
+    ports:
+      - '80:80'
+      - '443:443'
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile
+      - caddy_data:/data
+
+  bentopdf:
+    image: ghcr.io/alam00000/bentopdf:latest
+    restart: unless-stopped
+
+volumes:
+  caddy_data:
+```
+
+Caddyfile:
+
+```
+pdf.example.com {
+    reverse_proxy bentopdf:8080
+    header Cross-Origin-Opener-Policy "same-origin"
+    header Cross-Origin-Embedder-Policy "require-corp"
+}
+```
+
+## Resource Limits
+
+```yaml
+services:
+  bentopdf:
+    image: ghcr.io/alam00000/bentopdf:latest
+    deploy:
+      resources:
+        limits:
+          cpus: '1'
+          memory: 512M
+        reservations:
+          cpus: '0.25'
+          memory: 128M
+```
+
+## Podman Quadlet (Systemd Integration)
+
+[Quadlet](https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html) allows you to run Podman containers as systemd services. This is ideal for production deployments on Linux systems.
+
+### Basic Quadlet Setup
+
+Create a container unit file at `~/.config/containers/systemd/bentopdf.container` (user) or `/etc/containers/systemd/bentopdf.container` (system):
+
+```ini
+[Unit]
+Description=BentoPDF - Privacy-first PDF toolkit
+After=network-online.target
+Wants=network-online.target
+
+[Container]
+Image=ghcr.io/alam00000/bentopdf:latest
+ContainerName=bentopdf
+PublishPort=3000:8080
+AutoUpdate=registry
+
+[Service]
+Restart=always
+TimeoutStartSec=300
+
+[Install]
+WantedBy=default.target
+```
+
+### Enable and Start
+
+```bash
+# Reload systemd to detect new unit
+systemctl --user daemon-reload
+
+# Start the service
+systemctl --user start bentopdf
+
+# Enable on boot
+systemctl --user enable bentopdf
+
+# Check status
+systemctl --user status bentopdf
+
+# View logs
+journalctl --user -u bentopdf -f
+```
+
+> [!TIP]
+> For system-wide deployment, use `systemctl` without `--user` flag and place the file in `/etc/containers/systemd/`.
+
+### Simple Mode Quadlet
+
+For Simple Mode deployment, create `bentopdf-simple.container`:
+
+```ini
+[Unit]
+Description=BentoPDF Simple Mode - Clean PDF toolkit
+After=network-online.target
+Wants=network-online.target
+
+[Container]
+Image=ghcr.io/alam00000/bentopdf-simple:latest
+ContainerName=bentopdf-simple
+PublishPort=3000:8080
+AutoUpdate=registry
+
+[Service]
+Restart=always
+TimeoutStartSec=300
+
+[Install]
+WantedBy=default.target
+```
+
+### Quadlet with Health Check
+
+```ini
+[Unit]
+Description=BentoPDF with health monitoring
+After=network-online.target
+Wants=network-online.target
+
+[Container]
+Image=ghcr.io/alam00000/bentopdf:latest
+ContainerName=bentopdf
+PublishPort=3000:8080
+AutoUpdate=registry
+HealthCmd=curl -f http://localhost:8080 || exit 1
+HealthInterval=30s
+HealthTimeout=10s
+HealthRetries=3
+
+[Service]
+Restart=always
+TimeoutStartSec=300
+
+[Install]
+WantedBy=default.target
+```
+
+### Auto-Update with Quadlet
+
+Podman can automatically update containers when new images are available:
+
+```bash
+# Enable auto-update timer
+systemctl --user enable --now podman-auto-update.timer
+
+# Check for updates manually
+podman auto-update
+
+# Dry run (check without updating)
+podman auto-update --dry-run
+```
+
+### Quadlet Network Configuration
+
+For custom network configuration, create a network file `bentopdf.network`:
+
+```ini
+[Network]
+Subnet=10.89.0.0/24
+Gateway=10.89.0.1
+```
+
+Then reference it in your container file:
+
+```ini
+[Container]
+Image=ghcr.io/alam00000/bentopdf:latest
+ContainerName=bentopdf
+PublishPort=3000:8080
+Network=bentopdf.network
+```
+
+## Updating
+
+```bash
+# Pull latest image
+docker compose pull
+
+# Recreate container
+docker compose up -d
+```

docs/self-hosting/hostinger.md

@@ -0,0 +1,266 @@
+# Deploy to Hostinger
+
+[Hostinger](https://hostinger.com) is a popular shared hosting provider. This guide covers deploying BentoPDF to Hostinger's shared hosting.
+
+## Prerequisites
+
+- Hostinger hosting plan with file manager access
+- Node.js installed locally for building
+
+## Step 1: Build the Project
+
+```bash
+git clone https://github.com/alam00000/bentopdf.git
+cd bentopdf
+npm install
+npm run build
+```
+
+The built files will be in the `dist` folder.
+
+## Step 2: Upload to Hostinger
+
+### Root Domain Deployment
+
+1. Log in to your Hostinger account
+2. Go to **File Manager** → **public_html**
+3. **Delete** any existing files (backup if needed)
+4. **Upload** all contents of your local `dist` folder to `public_html`
+
+### Subdirectory Deployment
+
+If deploying to a subdirectory (e.g., `yourdomain.com/pdf-tools/`):
+
+1. Build with the correct base URL:
+
+```bash
+BASE_URL=/pdf-tools/ npm run build
+```
+
+2. Create the folder in Hostinger:
+   - Go to **File Manager** → **public_html**
+   - Create a new folder: `pdf-tools`
+3. Upload all contents of `dist` to `public_html/pdf-tools/`
+
+## Step 3: Create .htaccess File
+
+Create a `.htaccess` file in the root of your deployment folder (`public_html` or `public_html/pdf-tools/`):
+
+::: warning Important
+For subdirectory deployment, change `RewriteBase /` to `RewriteBase /pdf-tools/` (or your folder name).
+:::
+
+```apache
+RewriteEngine On
+RewriteBase /
+
+# ============================================
+# 1. SECURITY HEADERS (CRITICAL FOR WASM)
+# ============================================
+<IfModule mod_headers.c>
+    Header always set X-Frame-Options "SAMEORIGIN"
+    Header always set X-Content-Type-Options "nosniff"
+    Header always set X-XSS-Protection "1; mode=block"
+    Header always set Referrer-Policy "strict-origin-when-cross-origin"
+    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
+
+    # REQUIRED for soffice.js (SharedArrayBuffer)
+    Header always set Cross-Origin-Opener-Policy "same-origin"
+    Header always set Cross-Origin-Embedder-Policy "require-corp"
+</IfModule>
+
+# ============================================
+# 2. BROWSER CACHING
+# ============================================
+<IfModule mod_expires.c>
+    ExpiresActive On
+    ExpiresByType image/jpeg "access plus 1 year"
+    ExpiresByType image/png "access plus 1 year"
+    ExpiresByType image/gif "access plus 1 year"
+    ExpiresByType image/webp "access plus 1 year"
+    ExpiresByType image/svg+xml "access plus 1 year"
+    ExpiresByType image/x-icon "access plus 1 year"
+    ExpiresByType font/woff2 "access plus 1 year"
+    ExpiresByType font/woff "access plus 1 year"
+    ExpiresByType font/ttf "access plus 1 year"
+    ExpiresByType text/css "access plus 1 month"
+    ExpiresByType application/javascript "access plus 1 month"
+    ExpiresByType application/wasm "access plus 1 year"
+    ExpiresByType application/gzip "access plus 1 year"
+    ExpiresByType text/html "access plus 0 seconds"
+</IfModule>
+
+# ============================================
+# 3. COMPRESSION (STANDARD)
+# ============================================
+# Prevent server from double-compressing files
+SetEnvIfNoCase Request_URI "\.gz$" no-gzip
+SetEnvIfNoCase Request_URI "\.br$" no-gzip
+SetEnvIfNoCase Request_URI "\.wasm$" no-gzip
+
+<IfModule mod_deflate.c>
+    AddOutputFilterByType DEFLATE text/plain
+    AddOutputFilterByType DEFLATE text/html
+    AddOutputFilterByType DEFLATE text/xml
+    AddOutputFilterByType DEFLATE text/css
+    AddOutputFilterByType DEFLATE application/xml
+    AddOutputFilterByType DEFLATE application/xhtml+xml
+    AddOutputFilterByType DEFLATE application/rss+xml
+    AddOutputFilterByType DEFLATE application/javascript
+    AddOutputFilterByType DEFLATE application/x-javascript
+    AddOutputFilterByType DEFLATE application/json
+    AddOutputFilterByType DEFLATE image/svg+xml
+    AddOutputFilterByType DEFLATE font/woff
+    AddOutputFilterByType DEFLATE font/ttf
+</IfModule>
+
+# ============================================
+# 4. MIME TYPES & SPECIAL FILE HANDLING
+# ============================================
+AddType application/javascript .js .mjs
+AddType application/wasm .wasm
+AddType font/woff2 .woff2
+AddType font/woff .woff
+AddType image/webp .webp
+
+# Handle soffice.wasm.gz correctly
+<FilesMatch "soffice\.wasm\.gz$">
+    ForceType application/wasm
+    Header set Content-Encoding "gzip"
+    Header set Cross-Origin-Resource-Policy "cross-origin"
+    Header append Vary Accept-Encoding
+</FilesMatch>
+
+# Handle data.gz
+<FilesMatch "soffice\.data\.gz$">
+    ForceType application/octet-stream
+    Header set Content-Encoding "gzip"
+    Header append Vary Accept-Encoding
+</FilesMatch>
+
+# ============================================
+# 5. REDIRECTS & ROUTING
+# ============================================
+# Canonical WWW (update domain as needed)
+RewriteCond %{HTTP_HOST} ^bentopdf\.com [NC]
+RewriteRule ^(.*)$ https://www.bentopdf.com/$1 [L,R=301]
+
+# Force HTTPS
+RewriteCond %{HTTPS} off
+RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
+
+# Remove trailing slash (except for language root directories)
+RewriteCond %{REQUEST_FILENAME} !-d
+RewriteCond %{REQUEST_URI} !^/(de|es|zh|zh-TW|vi|it|id|tr|fr|pt)/$
+RewriteCond %{REQUEST_URI} (.+)/$
+RewriteRule ^ %1 [R=301,L]
+
+# Existing files/dirs - serve directly
+RewriteCond %{REQUEST_FILENAME} -f [OR]
+RewriteCond %{REQUEST_FILENAME} -d
+RewriteRule ^ - [L]
+
+# ============================================
+# 5.1. LANGUAGE ROUTES
+# ============================================
+# Supported languages: de, es, zh, zh-TW, vi, it, id, tr, fr, pt
+# English has no prefix - served from root
+
+# English prefix redirects to root (for SEO consistency)
+RewriteRule ^en/?$ / [R=301,L]
+RewriteRule ^en/(.+)$ /$1 [R=301,L]
+
+# Language prefix root (e.g., /de/ -> /de/index.html)
+RewriteCond %{DOCUMENT_ROOT}/$1/index.html -f
+RewriteRule ^(de|es|zh|zh-TW|vi|it|id|tr|fr|pt)/?$ /$1/index.html [L]
+
+# Language prefix with path (e.g., /de/merge-pdf -> /de/merge-pdf.html)
+RewriteCond %{DOCUMENT_ROOT}/$1/$2.html -f
+RewriteRule ^(de|es|zh|zh-TW|vi|it|id|tr|fr|pt)/([^/]+)/?$ /$1/$2.html [L]
+
+# ============================================
+# 5.5. DOCS ROUTING (VitePress)
+# ============================================
+RewriteCond %{REQUEST_URI} ^/docs
+RewriteCond %{REQUEST_FILENAME} !-f
+RewriteCond %{REQUEST_FILENAME}\.html -f
+RewriteRule ^(.*)$ $1.html [L]
+
+# ============================================
+# 6. ADD .HTML EXTENSION IF FILE EXISTS (ROOT LEVEL ONLY)
+# ============================================
+RewriteCond %{REQUEST_FILENAME} !-f
+RewriteCond %{REQUEST_FILENAME} !-d
+RewriteCond %{REQUEST_FILENAME}.html -f
+RewriteRule ^([^/]+)$ $1.html [L]
+
+# ============================================
+# 7. ERROR PAGES
+# ============================================
+ErrorDocument 404 /404.html
+```
+
+## Subdirectory .htaccess Example
+
+For `yourdomain.com/pdf-tools/`, update these lines:
+
+```apache
+RewriteBase /pdf-tools/
+
+# ... (same content as above, but update paths) ...
+
+# Language prefix root
+RewriteCond %{DOCUMENT_ROOT}/pdf-tools/$1/index.html -f
+RewriteRule ^(de|es|zh|zh-TW|vi|it|id|tr|fr|pt)/?$ /pdf-tools/$1/index.html [L]
+
+# Language prefix with path
+RewriteCond %{DOCUMENT_ROOT}/pdf-tools/$1/$2.html -f
+RewriteRule ^(de|es|zh|zh-TW|vi|it|id|tr|fr|pt)/([^/]+)/?$ /pdf-tools/$1/$2.html [L]
+
+# Root level .html extension
+RewriteCond %{REQUEST_FILENAME} !-f
+RewriteCond %{REQUEST_FILENAME} !-d
+RewriteCond %{REQUEST_FILENAME}.html -f
+RewriteRule ^([^/]+)$ $1.html [L]
+
+ErrorDocument 404 /pdf-tools/404.html
+```
+
+## Troubleshooting
+
+### WASM Files Not Loading
+
+Ensure the MIME types are correctly set in `.htaccess`:
+
+```apache
+AddType application/wasm .wasm
+```
+
+### LibreOffice Tools Not Working
+
+The security headers are critical for SharedArrayBuffer:
+
+```apache
+Header always set Cross-Origin-Opener-Policy "same-origin"
+Header always set Cross-Origin-Embedder-Policy "require-corp"
+```
+
+If headers aren't being applied, contact Hostinger support to enable `mod_headers`.
+
+### 404 Errors on Page Refresh
+
+Make sure the `.html` extension rule and language routes are correctly configured. BentoPDF uses static HTML files, not SPA routing:
+
+```apache
+# Language routes serve actual files from language directories
+RewriteCond %{DOCUMENT_ROOT}/$1/$2.html -f
+RewriteRule ^(de|es|zh|zh-TW|vi|it|id|tr|fr|pt)/([^/]+)/?$ /$1/$2.html [L]
+
+# Root level pages
+RewriteCond %{REQUEST_FILENAME}.html -f
+RewriteRule ^([^/]+)$ $1.html [L]
+```
+
+### File Upload Limits
+
+Hostinger may have file size limits. Upload WASM files separately if bulk upload fails.

docs/self-hosting/index.md

@@ -0,0 +1,346 @@
+# Self-Hosting Guide
+
+BentoPDF can be self-hosted on your own infrastructure. This guide covers various deployment options.
+
+## Quick Start with Docker / Podman
+
+The fastest way to self-host BentoPDF:
+
+```bash
+# Docker
+docker run -d -p 3000:8080 ghcr.io/alam00000/bentopdf:latest
+
+# Podman
+podman run -d -p 3000:8080 ghcr.io/alam00000/bentopdf:latest
+```
+
+Or with Docker Compose / Podman Compose:
+
+```yaml
+# docker-compose.yml
+services:
+  bentopdf:
+    image: ghcr.io/alam00000/bentopdf:latest
+    ports:
+      - '3000:8080'
+    restart: unless-stopped
+```
+
+```bash
+# Docker Compose
+docker compose up -d
+
+# Podman Compose
+podman-compose up -d
+```
+
+## Podman Quadlet (Linux Systemd)
+
+Run BentoPDF as a systemd service. Create `~/.config/containers/systemd/bentopdf.container`:
+
+```ini
+[Container]
+Image=ghcr.io/alam00000/bentopdf:latest
+ContainerName=bentopdf
+PublishPort=3000:8080
+AutoUpdate=registry
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=default.target
+```
+
+```bash
+systemctl --user daemon-reload
+systemctl --user enable --now bentopdf
+```
+
+See [Docker deployment guide](/self-hosting/docker) for full Quadlet documentation.
+
+## Building from Source
+
+```bash
+# Clone and build
+git clone https://github.com/alam00000/bentopdf.git
+cd bentopdf
+npm install
+npm run build
+
+# The built files are in the `dist` folder
+```
+
+## Configuration Options
+
+### Simple Mode
+
+Simple Mode is designed for internal organizational use where you want to hide all branding and marketing content, showing only the essential PDF tools.
+
+**What Simple Mode hides:**
+
+- Navigation bar
+- Hero section with marketing content
+- Features, FAQ, testimonials sections
+- Footer
+- Updates page title to "PDF Tools"
+
+```bash
+# Build with Simple Mode
+SIMPLE_MODE=true npm run build
+
+# Or use the pre-built Docker image
+docker run -p 3000:8080 bentopdfteam/bentopdf-simple:latest
+```
+
+See [SIMPLE_MODE.md](https://github.com/alam00000/bentopdf/blob/main/SIMPLE_MODE.md) for full details.
+
+### Base URL
+
+Deploy to a subdirectory:
+
+```bash
+BASE_URL=/pdf-tools/ npm run build
+```
+
+### Custom Branding
+
+Replace the default BentoPDF logo, name, and footer text with your own at build time:
+
+| Variable           | Description                           | Default                                 |
+| ------------------ | ------------------------------------- | --------------------------------------- |
+| `VITE_BRAND_NAME`  | Brand name shown in header and footer | `BentoPDF`                              |
+| `VITE_BRAND_LOGO`  | Logo path relative to `public/`       | `images/favicon-no-bg.svg`              |
+| `VITE_FOOTER_TEXT` | Custom footer/copyright text          | `© 2026 BentoPDF. All rights reserved.` |
+
+```bash
+# Place your logo in public/, then build
+VITE_BRAND_NAME="AcmePDF" \
+VITE_BRAND_LOGO="images/acme-logo.svg" \
+VITE_FOOTER_TEXT="© 2026 Acme Corp. Internal use only." \
+npm run build
+```
+
+Or via Docker:
+
+```bash
+docker build \
+  --build-arg VITE_BRAND_NAME="AcmePDF" \
+  --build-arg VITE_BRAND_LOGO="images/acme-logo.svg" \
+  --build-arg VITE_FOOTER_TEXT="© 2026 Acme Corp. Internal use only." \
+  -t acmepdf .
+```
+
+Branding works in both full mode and Simple Mode, and can be combined with all other build-time options (`BASE_URL`, `SIMPLE_MODE`, `VITE_DEFAULT_LANGUAGE`).
+
+## Deployment Guides
+
+Choose your platform:
+
+- [Vercel](/self-hosting/vercel)
+- [Netlify](/self-hosting/netlify)
+- [Cloudflare Pages](/self-hosting/cloudflare)
+- [AWS S3 + CloudFront](/self-hosting/aws)
+- [Hostinger](/self-hosting/hostinger)
+- [Nginx](/self-hosting/nginx)
+- [Apache](/self-hosting/apache)
+- [Docker](/self-hosting/docker)
+- [Kubernetes](/self-hosting/kubernetes)
+- [CORS Proxy](/self-hosting/cors-proxy) - Required for digital signatures
+
+## WASM Configuration (AGPL Components)
+
+BentoPDF **does not bundle** AGPL-licensed processing libraries in its source code, but **pre-configures CDN URLs** so all features work out of the box — no manual setup needed.
+
+::: tip Zero-Config by Default
+As of v2.0.0, WASM modules are pre-configured to load from jsDelivr CDN via environment variables. All advanced features work immediately without any user configuration.
+:::
+
+| Component       | License  | Features                                                         |
+| --------------- | -------- | ---------------------------------------------------------------- |
+| **PyMuPDF**     | AGPL-3.0 | EPUB/MOBI/FB2/XPS conversion, image extraction, table extraction |
+| **Ghostscript** | AGPL-3.0 | PDF/A conversion, compression, deskewing, rasterization          |
+| **CoherentPDF** | AGPL-3.0 | Table of contents, attachments, PDF merge with bookmarks         |
+
+### Default Environment Variables
+
+These are set in `.env.production` and baked into the build:
+
+```bash
+VITE_WASM_PYMUPDF_URL=https://cdn.jsdelivr.net/npm/@bentopdf/pymupdf-wasm@0.11.16/
+VITE_WASM_GS_URL=https://cdn.jsdelivr.net/npm/@bentopdf/gs-wasm/assets/
+VITE_WASM_CPDF_URL=https://cdn.jsdelivr.net/npm/coherentpdf/dist/
+```
+
+### Overriding WASM URLs
+
+You can override the defaults at build time for custom deployments:
+
+```bash
+# Via Docker build args
+docker build \
+  --build-arg VITE_WASM_PYMUPDF_URL=https://your-server.com/pymupdf/ \
+  --build-arg VITE_WASM_GS_URL=https://your-server.com/gs/ \
+  --build-arg VITE_WASM_CPDF_URL=https://your-server.com/cpdf/ \
+  -t bentopdf .
+
+# Or via .env.production before building from source
+VITE_WASM_PYMUPDF_URL=https://your-server.com/pymupdf/ npm run build
+```
+
+To disable a module entirely (require manual user config via Advanced Settings), set its variable to an empty string.
+
+Users can also override these defaults at any time via **Advanced Settings** in the UI — user overrides stored in the browser take priority over environment defaults.
+
+### Air-Gapped / Offline Deployment
+
+For networks with no internet access (government, healthcare, financial, etc.). The WASM URLs are baked into the JavaScript at **build time** — the actual WASM files are downloaded by the **user's browser** at runtime. So you need to prepare everything on a machine with internet, then transfer it into the isolated network.
+
+#### Automated Script (Recommended)
+
+The included `prepare-airgap.sh` script automates the entire process — downloading WASM packages, building the Docker image, and producing a self-contained bundle with a setup script.
+
+```bash
+git clone https://github.com/alam00000/bentopdf.git
+cd bentopdf
+
+# Interactive mode — prompts for all options
+bash scripts/prepare-airgap.sh
+
+# Or fully automated
+bash scripts/prepare-airgap.sh --wasm-base-url https://internal.example.com/wasm
+```
+
+This produces a bundle directory:
+
+```
+bentopdf-airgap-bundle/
+  bentopdf.tar              # Docker image
+  *.tgz                     # WASM packages (PyMuPDF, Ghostscript, CoherentPDF)
+  setup.sh                  # Setup script for the air-gapped side
+  README.md                 # Instructions
+```
+
+Transfer the bundle into the air-gapped network via USB, internal artifact repo, or approved method. Then run the included setup script:
+
+```bash
+cd bentopdf-airgap-bundle
+bash setup.sh
+```
+
+The setup script loads the Docker image, extracts WASM files, and optionally starts the container.
+
+**Script options:**
+
+| Flag                    | Description                                      | Default                           |
+| ----------------------- | ------------------------------------------------ | --------------------------------- |
+| `--wasm-base-url <url>` | Where WASMs will be hosted internally            | _(required, prompted if missing)_ |
+| `--image-name <name>`   | Docker image tag                                 | `bentopdf`                        |
+| `--output-dir <path>`   | Output bundle directory                          | `./bentopdf-airgap-bundle`        |
+| `--simple-mode`         | Enable Simple Mode                               | off                               |
+| `--base-url <path>`     | Subdirectory base URL (e.g. `/pdf/`)             | `/`                               |
+| `--language <code>`     | Default UI language (e.g. `fr`, `de`)            | _(none)_                          |
+| `--brand-name <name>`   | Custom brand name                                | _(none)_                          |
+| `--brand-logo <path>`   | Logo path relative to `public/`                  | _(none)_                          |
+| `--footer-text <text>`  | Custom footer text                               | _(none)_                          |
+| `--dockerfile <path>`   | Dockerfile to use                                | `Dockerfile`                      |
+| `--skip-docker`         | Skip Docker build and export                     | off                               |
+| `--skip-wasm`           | Skip WASM download (reuse existing `.tgz` files) | off                               |
+
+::: warning Same-Origin Requirement
+WASM files must be served from the **same origin** as the BentoPDF app. Web Workers use `importScripts()` which cannot load scripts cross-origin. For example, if BentoPDF runs at `https://internal.example.com`, the WASM base URL should also be `https://internal.example.com/wasm`.
+:::
+
+#### Manual Steps
+
+<details>
+<summary>If you prefer to do it manually without the script</summary>
+
+**Step 1: Download the WASM packages** (on a machine with internet)
+
+```bash
+npm pack @bentopdf/pymupdf-wasm@0.11.14
+npm pack @bentopdf/gs-wasm
+npm pack coherentpdf
+```
+
+**Step 2: Build the Docker image with internal URLs**
+
+```bash
+git clone https://github.com/alam00000/bentopdf.git
+cd bentopdf
+
+docker build \
+  --build-arg VITE_WASM_PYMUPDF_URL=https://internal-server.example.com/wasm/pymupdf/ \
+  --build-arg VITE_WASM_GS_URL=https://internal-server.example.com/wasm/gs/ \
+  --build-arg VITE_WASM_CPDF_URL=https://internal-server.example.com/wasm/cpdf/ \
+  -t bentopdf .
+```
+
+**Step 3: Export the Docker image**
+
+```bash
+docker save bentopdf -o bentopdf.tar
+```
+
+**Step 4: Transfer into the air-gapped network**
+
+Copy via USB, internal artifact repo, or approved transfer method:
+
+- `bentopdf.tar` — the Docker image
+- The three `.tgz` WASM packages from Step 1
+
+**Step 5: Set up inside the air-gapped network**
+
+```bash
+# Load the Docker image
+docker load -i bentopdf.tar
+
+# Extract WASM packages
+mkdir -p ./wasm/pymupdf ./wasm/gs ./wasm/cpdf
+tar xzf bentopdf-pymupdf-wasm-0.11.14.tgz -C ./wasm/pymupdf --strip-components=1
+tar xzf bentopdf-gs-wasm-*.tgz -C ./wasm/gs --strip-components=1
+tar xzf coherentpdf-*.tgz -C ./wasm/cpdf --strip-components=1
+
+# Run BentoPDF
+docker run -d -p 3000:8080 --restart unless-stopped bentopdf
+```
+
+Make sure the WASM files are accessible at the URLs you configured in Step 2.
+
+</details>
+
+::: info Building from source instead of Docker?
+Set the variables in `.env.production` before running `npm run build`:
+
+```bash
+VITE_WASM_PYMUPDF_URL=https://internal-server.example.com/wasm/pymupdf/
+VITE_WASM_GS_URL=https://internal-server.example.com/wasm/gs/
+VITE_WASM_CPDF_URL=https://internal-server.example.com/wasm/cpdf/
+```
+
+:::
+
+### Hosting Your Own WASM Proxy
+
+If you need to serve AGPL WASM files with proper CORS headers, you can deploy a simple proxy. See the [Cloudflare WASM Proxy guide](https://github.com/alam00000/bentopdf/blob/main/cloudflare/WASM-PROXY.md) for an example implementation.
+
+::: tip Why Separate?
+This separation ensures:
+
+- Clear legal compliance for commercial users
+- BentoPDF's core remains under its dual-license (AGPL-3.0 / Commercial)
+- WASM files are loaded at runtime, not bundled in the source
+  :::
+
+## System Requirements
+
+| Requirement | Minimum                             |
+| ----------- | ----------------------------------- |
+| Storage     | ~100 MB (core without AGPL modules) |
+| RAM         | 512 MB                              |
+| CPU         | Any modern processor                |
+
+::: tip
+BentoPDF is a static site—there's no database or backend server required!
+:::

docs/self-hosting/kubernetes.md

@@ -0,0 +1,157 @@
+# Deploy with Kubernetes
+
+Kubernetes may be overkill for a static site, but it can be a great fit if you already standardize on Helm + GitOps.
+
+> [!IMPORTANT]
+> **Required Headers for Office File Conversion**
+> 
+> LibreOffice-based tools (Word, Excel, PowerPoint conversion) require these HTTP headers for `SharedArrayBuffer` support:
+> - `Cross-Origin-Opener-Policy: same-origin`
+> - `Cross-Origin-Embedder-Policy: require-corp`
+> 
+> The official BentoPDF nginx images include these headers. In Kubernetes, **Ingress/Gateway controllers are also reverse proxies**, so ensure these headers are preserved (or add them at the edge).
+
+## Prereqs
+
+- Kubernetes cluster
+- Helm v3
+- A BentoPDF nginx image (e.g. `ghcr.io/alam00000/bentopdf:<tag>`) that serves on **port 8080**
+
+## Deploy with Helm
+
+### Install from this repo (local chart)
+
+```bash
+kubectl create namespace bentopdf
+
+helm upgrade --install bentopdf /path/to/bentopdf/chart \
+  --namespace bentopdf \
+  --set image.repository=ghcr.io/alam00000/bentopdf \
+  --set image.tag=latest
+```
+
+### Install from GHCR (OCI chart)
+
+If the chart is published to GHCR as an OCI artifact:
+
+```bash
+export GHCR_USERNAME="<github-org-or-user>"
+
+helm upgrade --install bentopdf oci://ghcr.io/$GHCR_USERNAME/charts/bentopdf \
+  --namespace bentopdf \
+  --create-namespace \
+  --version 0.1.0 \
+  --set image.repository=ghcr.io/alam00000/bentopdf \
+  --set image.tag=latest
+```
+
+## Expose it
+
+### Port-forward (quick test)
+
+```bash
+kubectl -n bentopdf port-forward deploy/bentopdf 8080:8080
+```
+
+### Ingress (optional)
+
+Enable Ingress (example for nginx-ingress):
+
+```yaml
+ingress:
+  enabled: true
+  className: nginx
+  hosts:
+    - host: pdf.example.com
+      paths:
+        - path: /
+          pathType: Prefix
+```
+
+### Gateway API (optional)
+
+This chart supports Gateway API `Gateway` + `HTTPRoute`.
+
+Example (Cloudflare Gateway API operator):
+
+```yaml
+gateway:
+  enabled: true
+  name: bento-tunnel
+  namespace: bentopdf
+  gatewayClassName: cloudflare
+
+httpRoute:
+  enabled: true
+  parentRefs:
+    - name: bento-tunnel
+      namespace: bentopdf
+      sectionName: http
+  hostnames:
+    - pdfs.example.com
+```
+
+## Ensuring the SharedArrayBuffer headers still work (Ingress/Gateway)
+
+### What "should" happen
+
+BentoPDF’s nginx config sets the required response headers. Most Ingress/Gateway controllers **pass upstream response headers through unchanged**.
+
+### What can break it
+
+- A controller/edge policy that **overrides** or **strips** response headers
+- A "security headers" middleware that sets different COOP/COEP values
+
+### How to verify
+
+Run this against your public endpoint:
+
+```bash
+curl -I https://pdf.example.com/ | egrep -i 'cross-origin-opener-policy|cross-origin-embedder-policy'
+```
+
+You should see:
+
+- `Cross-Origin-Opener-Policy: same-origin`
+- `Cross-Origin-Embedder-Policy: require-corp`
+
+### If your Ingress controller does not preserve them
+
+Add the headers at the edge (controller-specific). Example for **nginx-ingress**:
+
+```yaml
+ingress:
+  enabled: true
+  className: nginx
+  annotations:
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      add_header Cross-Origin-Opener-Policy "same-origin" always;
+      add_header Cross-Origin-Embedder-Policy "require-corp" always;
+```
+
+### If you’re using Gateway API and want to force-add headers
+
+Gateway API supports a `ResponseHeaderModifier` filter. You can attach it in `httpRoute.rules[*].filters`:
+
+```yaml
+httpRoute:
+  enabled: true
+  hostnames: [pdf.example.com]
+  parentRefs:
+    - name: bento-tunnel
+      namespace: misc
+      sectionName: http
+  rules:
+    - matches:
+        - path: { type: PathPrefix, value: / }
+      filters:
+        - type: ResponseHeaderModifier
+          responseHeaderModifier:
+            set:
+              - name: Cross-Origin-Opener-Policy
+                value: same-origin
+              - name: Cross-Origin-Embedder-Policy
+                value: require-corp
+```
+
+Support for specific filters depends on your Gateway controller; if a filter is ignored, add headers at the edge/controller layer instead.

docs/self-hosting/netlify.md

@@ -0,0 +1,139 @@
+# Deploy to Netlify
+
+[Netlify](https://netlify.com) provides excellent static site hosting with a generous free tier.
+
+## One-Click Deploy
+
+[![Deploy to Netlify](https://www.netlify.com/img/deploy/button.svg)](https://app.netlify.com/start/deploy?repository=https://github.com/alam00000/bentopdf)
+
+## Manual Deployment
+
+### Step 1: Connect Repository
+
+1. Log in to [Netlify](https://app.netlify.com)
+2. Click "Add new site" → "Import an existing project"
+3. Connect your GitHub account
+4. Select your BentoPDF fork
+
+### Step 2: Configure Build Settings
+
+| Setting           | Value           |
+| ----------------- | --------------- |
+| Build command     | `npm run build` |
+| Publish directory | `dist`          |
+| Node version      | 18+             |
+
+### Step 3: Deploy
+
+Click "Deploy site" and wait for the build.
+
+## Configuration File
+
+Create `netlify.toml` in your project root:
+
+```toml
+[build]
+  command = "npm run build"
+  publish = "dist"
+
+[build.environment]
+  NODE_VERSION = "18"
+
+# Required security headers for SharedArrayBuffer (used by LibreOffice WASM)
+[[headers]]
+  for = "/*"
+  [headers.values]
+    Cross-Origin-Embedder-Policy = "require-corp"
+    Cross-Origin-Opener-Policy = "same-origin"
+    Cross-Origin-Resource-Policy = "cross-origin"
+
+# Pre-compressed LibreOffice WASM binary - must be served with Content-Encoding
+[[headers]]
+  for = "/libreoffice-wasm/soffice.wasm.gz"
+  [headers.values]
+    Content-Type = "application/wasm"
+    Content-Encoding = "gzip"
+    Cache-Control = "public, max-age=31536000, immutable"
+
+# Pre-compressed LibreOffice WASM data - must be served with Content-Encoding
+[[headers]]
+  for = "/libreoffice-wasm/soffice.data.gz"
+  [headers.values]
+    Content-Type = "application/octet-stream"
+    Content-Encoding = "gzip"
+    Cache-Control = "public, max-age=31536000, immutable"
+
+# Cache other WASM files
+[[headers]]
+  for = "*.wasm"
+  [headers.values]
+    Cache-Control = "public, max-age=31536000, immutable"
+    Content-Type = "application/wasm"
+
+# SPA routing
+[[redirects]]
+  from = "/*"
+  to = "/index.html"
+  status = 200
+```
+
+::: warning Important
+The `Cross-Origin-Embedder-Policy` and `Cross-Origin-Opener-Policy` headers are required for Word/ODT/Excel/PowerPoint to PDF conversions. Without them, `SharedArrayBuffer` is unavailable and the LibreOffice WASM engine will fail to initialize.
+
+The `Content-Encoding: gzip` headers on the `.wasm.gz` and `.data.gz` files tell the browser to decompress them automatically. Without these, the browser receives raw gzip bytes and WASM compilation fails.
+:::
+
+## Environment Variables
+
+Set these in Site settings → Environment variables:
+
+| Variable                | Description                                                 |
+| ----------------------- | ----------------------------------------------------------- |
+| `SIMPLE_MODE`           | Set to `true` for minimal build                             |
+| `VITE_BRAND_NAME`       | Custom brand name (replaces "BentoPDF")                     |
+| `VITE_BRAND_LOGO`       | Logo path relative to `public/` (e.g. `images/my-logo.svg`) |
+| `VITE_FOOTER_TEXT`      | Custom footer/copyright text                                |
+| `VITE_DEFAULT_LANGUAGE` | Default UI language (e.g. `fr`, `de`, `es`)                 |
+
+## Custom Domain
+
+1. Go to Site settings → Domain management
+2. Click "Add custom domain"
+3. Follow DNS configuration instructions
+
+## Large Media
+
+For large WASM files, consider enabling [Netlify Large Media](https://docs.netlify.com/large-media/overview/):
+
+```bash
+netlify lm:setup
+git lfs track "*.wasm"
+```
+
+## Troubleshooting
+
+### Word/ODT/Excel to PDF Stuck at 55%
+
+If document conversions hang at 55%, open DevTools Console and check:
+
+```js
+console.log(window.crossOriginIsolated); // should be true
+console.log(typeof SharedArrayBuffer); // should be "function"
+```
+
+If `crossOriginIsolated` is `false`, the COEP/COOP headers from your `netlify.toml` are not being applied. Make sure the file is in your project root and redeploy.
+
+If you see `expected magic word 00 61 73 6d, found 1f 8b 08 08` in the console, the `.wasm.gz` files are missing `Content-Encoding: gzip` headers. Ensure the `[[headers]]` blocks for `soffice.wasm.gz` and `soffice.data.gz` are in your `netlify.toml`.
+
+### Build Fails
+
+Check Node version compatibility:
+
+```toml
+[build.environment]
+  NODE_VERSION = "20"
+```
+
+### Slow Initial Load
+
+Enable asset optimization in Site settings → Build & deploy → Asset optimization.

docs/self-hosting/nginx.md

@@ -0,0 +1,195 @@
+# Deploy with Nginx
+
+Host BentoPDF on your own server using Nginx.
+
+## Prerequisites
+
+- Ubuntu/Debian server
+- Nginx installed
+- SSL certificate (recommended: Let's Encrypt)
+
+## Step 1: Build the Project
+
+```bash
+git clone https://github.com/alam00000/bentopdf.git
+cd bentopdf
+npm install
+npm run build
+```
+
+To customize branding, set environment variables before building:
+
+```bash
+VITE_BRAND_NAME="AcmePDF" VITE_BRAND_LOGO="images/acme-logo.svg" npm run build
+```
+
+## Step 2: Copy Files
+
+```bash
+sudo mkdir -p /var/www/bentopdf
+sudo cp -r dist/* /var/www/bentopdf/
+sudo chown -R www-data:www-data /var/www/bentopdf
+```
+
+## Step 3: Nginx Configuration
+
+Create `/etc/nginx/sites-available/bentopdf`:
+
+```nginx
+server {
+    listen 80;
+    server_name your-domain.com;
+    return 301 https://$server_name$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name your-domain.com;
+
+    # SSL Configuration
+    ssl_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/your-domain.com/privkey.pem;
+
+    root /var/www/bentopdf;
+    index index.html;
+
+    # Gzip compression
+    gzip on;
+    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/wasm;
+    gzip_min_length 1000;
+
+    # WASM MIME type
+    types {
+        application/wasm wasm;
+    }
+
+    # Required headers for SharedArrayBuffer (LibreOffice WASM)
+    # These must be on every response - especially HTML pages
+    add_header Cross-Origin-Embedder-Policy "require-corp" always;
+    add_header Cross-Origin-Opener-Policy "same-origin" always;
+    add_header Cross-Origin-Resource-Policy "cross-origin" always;
+
+    # Security headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+
+    # Pre-compressed LibreOffice WASM binary
+    location ~* /libreoffice-wasm/soffice\.wasm\.gz$ {
+        gzip off;
+        types {} default_type application/wasm;
+        add_header Content-Encoding gzip;
+        add_header Cache-Control "public, immutable";
+        add_header Cross-Origin-Embedder-Policy "require-corp" always;
+        add_header Cross-Origin-Opener-Policy "same-origin" always;
+    }
+
+    # Pre-compressed LibreOffice WASM data
+    location ~* /libreoffice-wasm/soffice\.data\.gz$ {
+        gzip off;
+        types {} default_type application/octet-stream;
+        add_header Content-Encoding gzip;
+        add_header Cache-Control "public, immutable";
+        add_header Cross-Origin-Embedder-Policy "require-corp" always;
+        add_header Cross-Origin-Opener-Policy "same-origin" always;
+    }
+
+    # Cache static assets
+    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|wasm)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        add_header Cross-Origin-Embedder-Policy "require-corp" always;
+        add_header Cross-Origin-Opener-Policy "same-origin" always;
+    }
+
+    # SPA routing - serve index.html for all routes
+    location / {
+        try_files $uri $uri/ /index.html;
+        add_header Cross-Origin-Embedder-Policy "require-corp" always;
+        add_header Cross-Origin-Opener-Policy "same-origin" always;
+    }
+}
+```
+
+## Step 4: Enable the Site
+
+```bash
+sudo ln -s /etc/nginx/sites-available/bentopdf /etc/nginx/sites-enabled/
+sudo nginx -t
+sudo systemctl reload nginx
+```
+
+## Step 5: SSL with Let's Encrypt
+
+```bash
+sudo apt install certbot python3-certbot-nginx
+sudo certbot --nginx -d your-domain.com
+```
+
+## Subdirectory Deployment
+
+To host at `/pdf/`:
+
+```nginx
+location /pdf/ {
+    alias /var/www/bentopdf/;
+    try_files $uri $uri/ /pdf/index.html;
+}
+```
+
+Build with:
+
+```bash
+BASE_URL=/pdf/ npm run build
+```
+
+## Performance Tuning
+
+Add to `nginx.conf`:
+
+```nginx
+http {
+    # Enable sendfile
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+
+    # Increase buffer sizes
+    client_max_body_size 100M;
+
+    # Worker connections
+    worker_connections 2048;
+}
+```
+
+## Troubleshooting
+
+### WASM Not Loading
+
+Ensure MIME type is set:
+
+```nginx
+types {
+    application/wasm wasm;
+}
+```
+
+### Word/ODT/Excel to PDF Not Working
+
+LibreOffice WASM requires `SharedArrayBuffer`, which needs `Cross-Origin-Embedder-Policy` and `Cross-Origin-Opener-Policy` headers. Note that nginx `add_header` directives in a `location` block **override** server-level `add_header` directives — they don't merge. Every `location` block with its own `add_header` must include the COEP/COOP headers.
+
+Verify with:
+
+```bash
+curl -I https://your-domain.com/ | grep -i cross-origin
+```
+
+If using a reverse proxy in front of nginx, ensure it preserves these headers.
+
+### 502 Bad Gateway
+
+Check Nginx error logs:
+
+```bash
+sudo tail -f /var/log/nginx/error.log
+```

docs/self-hosting/vercel.md

@@ -0,0 +1,122 @@
+# Deploy to Vercel
+
+[Vercel](https://vercel.com) offers the easiest deployment experience for static sites.
+
+## One-Click Deploy
+
+[![Deploy with Vercel](https://vercel.com/button)](https://vercel.com/new/clone?repository-url=https://github.com/alam00000/bentopdf)
+
+## Manual Deployment
+
+### Step 1: Fork the Repository
+
+Fork [bentopdf/bentopdf](https://github.com/alam00000/bentopdf) to your GitHub account.
+
+### Step 2: Import to Vercel
+
+1. Go to [vercel.com/new](https://vercel.com/new)
+2. Select your forked repository
+3. Configure the project:
+
+| Setting          | Value           |
+| ---------------- | --------------- |
+| Framework Preset | Vite            |
+| Build Command    | `npm run build` |
+| Output Directory | `dist`          |
+| Install Command  | `npm install`   |
+
+### Step 3: Environment Variables (Optional)
+
+Add these if needed:
+
+| Variable                | Description                                                 |
+| ----------------------- | ----------------------------------------------------------- |
+| `SIMPLE_MODE`           | Set to `true` for minimal UI                                |
+| `VITE_BRAND_NAME`       | Custom brand name (replaces "BentoPDF")                     |
+| `VITE_BRAND_LOGO`       | Logo path relative to `public/` (e.g. `images/my-logo.svg`) |
+| `VITE_FOOTER_TEXT`      | Custom footer/copyright text                                |
+| `VITE_DEFAULT_LANGUAGE` | Default UI language (e.g. `fr`, `de`, `es`)                 |
+
+### Step 4: Deploy
+
+Click "Deploy" and wait for the build to complete.
+
+## Custom Domain
+
+1. Go to your project settings
+2. Navigate to "Domains"
+3. Add your custom domain
+4. Configure DNS as instructed
+
+## Limitations
+
+::: warning Large Files
+Vercel's serverless functions have a 50MB limit. Since BentoPDF is a static site, this shouldn't affect you, but WASM modules are large (~100MB total). Ensure they're served from the `/public` folder.
+:::
+
+## Troubleshooting
+
+### Build Timeout
+
+If builds timeout, try:
+
+```json
+// vercel.json
+{
+  "buildCommand": "npm run build",
+  "outputDirectory": "dist"
+}
+```
+
+### 404 on Refresh
+
+Add a `vercel.json` for SPA routing:
+
+```json
+{
+  "rewrites": [{ "source": "/(.*)", "destination": "/index.html" }]
+}
+```
+
+### Word/ODT/Excel to PDF Not Working
+
+LibreOffice WASM conversions require `SharedArrayBuffer`, which needs these response headers on all pages:
+
+- `Cross-Origin-Embedder-Policy: require-corp`
+- `Cross-Origin-Opener-Policy: same-origin`
+
+The pre-compressed `.wasm.gz` and `.data.gz` files also need `Content-Encoding: gzip` so the browser decompresses them.
+
+Add these to your `vercel.json`:
+
+```json
+{
+  "rewrites": [{ "source": "/(.*)", "destination": "/index.html" }],
+  "headers": [
+    {
+      "source": "/(.*)",
+      "headers": [
+        { "key": "Cross-Origin-Embedder-Policy", "value": "require-corp" },
+        { "key": "Cross-Origin-Opener-Policy", "value": "same-origin" },
+        { "key": "Cross-Origin-Resource-Policy", "value": "cross-origin" }
+      ]
+    },
+    {
+      "source": "/libreoffice-wasm/soffice.wasm.gz",
+      "headers": [
+        { "key": "Content-Type", "value": "application/wasm" },
+        { "key": "Content-Encoding", "value": "gzip" }
+      ]
+    },
+    {
+      "source": "/libreoffice-wasm/soffice.data.gz",
+      "headers": [
+        { "key": "Content-Type", "value": "application/octet-stream" },
+        { "key": "Content-Encoding", "value": "gzip" }
+      ]
+    }
+  ]
+}
+```
+
+To verify, open DevTools Console and run `console.log(window.crossOriginIsolated)` — it should return `true`.