[object Object]

← back to 90210 Agentabrams

90210 hub: nginx for Cloudflare-proxied origin (:80+:443, reuse games cert, no certbot)

1785e07b50b51036dd86429beb97d29281978459 · 2026-07-25 09:45:50 -0700 · Steve Abrams

Files touched

Diff

commit 1785e07b50b51036dd86429beb97d29281978459
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat Jul 25 09:45:50 2026 -0700

    90210 hub: nginx for Cloudflare-proxied origin (:80+:443, reuse games cert, no certbot)
---
 README.md                          | 12 ++++++-----
 deploy/90210.agentabrams.com.nginx | 43 +++++++++++++++++++-------------------
 2 files changed, 29 insertions(+), 26 deletions(-)

diff --git a/README.md b/README.md
index 3903286..b026e97 100644
--- a/README.md
+++ b/README.md
@@ -23,10 +23,12 @@ maps each id to its canonical source; `./sync.sh` keeps this hub in step.
 node tests/e2e.mjs   # headless: 4 games render, iframe playable, deep links
 ```
 
-## Deploy (Steve-gated — new subdomain)
+## Deploy (Cloudflare-PROXIED — no DNS change, no certbot)
 
-Standing up `90210.agentabrams.com` needs DNS + nginx + SSL on Kamatera:
+`90210.agentabrams.com` already exists in Cloudflare as a **proxied** (orange-cloud)
+A record → `45.61.58.125`, so there is **no DNS change and no SSL issuance** to do —
+the CF edge terminates TLS and the origin reuses the games cert (Full, non-strict).
 
-1. DNS: A record `90210.agentabrams.com` → `45.61.58.125`
-2. `rsync -az --delete --exclude .git --exclude tests ./ root@45.61.58.125:/var/www/90210.agentabrams.com/`
-3. Install `deploy/90210.agentabrams.com.nginx`, then `certbot --nginx -d 90210.agentabrams.com`
+1. `rsync -az --delete --exclude .git --exclude tests ./ root@45.61.58.125:/var/www/90210.agentabrams.com/`
+2. `scp deploy/90210.agentabrams.com.nginx root@45.61.58.125:/etc/nginx/sites-available/90210.agentabrams.com`
+3. `ssh root@45.61.58.125 'ln -sf /etc/nginx/sites-available/90210.agentabrams.com /etc/nginx/sites-enabled/ && nginx -t && systemctl reload nginx'`
diff --git a/deploy/90210.agentabrams.com.nginx b/deploy/90210.agentabrams.com.nginx
index 9703bb0..59a17af 100644
--- a/deploy/90210.agentabrams.com.nginx
+++ b/deploy/90210.agentabrams.com.nginx
@@ -1,9 +1,20 @@
-# 90210.agentabrams.com — Beverly Hills 90210 Arcade (public static games hub)
+# 90210.agentabrams.com — Beverly Hills 90210 Arcade (Cloudflare-PROXIED origin)
+#
+# 90210.agentabrams.com stays orange-cloud (proxied) in Cloudflare — the edge
+# terminates TLS for the browser. This origin block serves the hub on BOTH :80
+# and :443 so it works whether Cloudflare connects over Full (:443) or Flexible
+# (:80). No certbot / Let's Encrypt issuance is needed for this host: it REUSES
+# the existing games.agentabrams.com certificate, which Cloudflare's proxy
+# (Full, non-strict) accepts without hostname validation.
+#
+# Install:
+#   scp deploy/90210.agentabrams.com.nginx root@45.61.58.125:/etc/nginx/sites-available/90210.agentabrams.com
+#   ssh root@45.61.58.125 'ln -sf /etc/nginx/sites-available/90210.agentabrams.com /etc/nginx/sites-enabled/ && nginx -t && systemctl reload nginx'
 server {
     server_name 90210.agentabrams.com;
 
     access_log /var/log/nginx/90210.agentabrams.com.access.log;
-    error_log /var/log/nginx/90210.agentabrams.com.error.log;
+    error_log  /var/log/nginx/90210.agentabrams.com.error.log;
 
     add_header X-Content-Type-Options "nosniff" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
@@ -16,23 +27,13 @@ server {
         try_files $uri $uri/ $uri.html =404;
     }
 
-    listen 45.61.58.125:443 ssl; # managed by Certbot
-    ssl_certificate /etc/letsencrypt/live/90210.agentabrams.com/fullchain.pem; # managed by Certbot
-    ssl_certificate_key /etc/letsencrypt/live/90210.agentabrams.com/privkey.pem; # managed by Certbot
-    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
-    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
-
-}
-
-server {
-    if ($host = 90210.agentabrams.com) {
-        return 301 https://$host$request_uri;
-    } # managed by Certbot
-
-
     listen 45.61.58.125:80;
-    server_name 90210.agentabrams.com;
-    return 404; # managed by Certbot
-
-
-}
\ No newline at end of file
+    listen 45.61.58.125:443 ssl;
+
+    # Reused from the sibling games hub — CF proxy (Full, non-strict) does not
+    # validate the origin cert's hostname, so this is accepted for 90210 too.
+    ssl_certificate     /etc/letsencrypt/live/games.agentabrams.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/games.agentabrams.com/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+}

← 9af7358 90210-agentabrams topic hub — Beverly Hills 90210 arcade (4  ·  back to 90210 Agentabrams  ·  Cross-link 90210 hub -> main Agent Abrams Arcade ee94d51 →