celebsignatures.com go-live runbook (nginx vhost IP-bound per fleet rule + LE cert + smoke) — awaits domain purchase + DNS

934e1119d3f6885e6a1e99472f9d37895c2e98a9 · 2026-08-03 13:15:45 -0700 · Steve Abrams

Files touched

A scripts/golive-celebsignatures.sh

Diff

commit 934e1119d3f6885e6a1e99472f9d37895c2e98a9
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon Aug 3 13:15:45 2026 -0700

    celebsignatures.com go-live runbook (nginx vhost IP-bound per fleet rule + LE cert + smoke) — awaits domain purchase + DNS
---
 scripts/golive-celebsignatures.sh | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/scripts/golive-celebsignatures.sh b/scripts/golive-celebsignatures.sh
new file mode 100755
index 0000000..c6b2fb8
--- /dev/null
+++ b/scripts/golive-celebsignatures.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+# celebsignatures.com go-live — run AFTER (1) the domain is purchased and
+# (2) its DNS A records point at 45.61.58.125 (@ and www, DNS-only/grey first).
+# Steve pastes:  bash scripts/golive-celebsignatures.sh
+set -euo pipefail
+H=root@45.61.58.125
+
+ssh $H 'cat > /etc/nginx/sites-available/celebsignatures.com <<NGINX
+server {
+    listen 80;
+    server_name celebsignatures.com www.celebsignatures.com;
+    location / {
+        proxy_pass http://127.0.0.1:9956;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+    }
+}
+NGINX
+ln -sf /etc/nginx/sites-available/celebsignatures.com /etc/nginx/sites-enabled/
+nginx -t && systemctl reload nginx'
+
+# Let's Encrypt (HTTP-01 — works once DNS resolves to the box). Certbot rewrites
+# the vhost for 443; we then pin the fleet rule: IP-BOUND listener (never generic
+# 443, else the default cert/redirect swallows the site — see fleet memory).
+ssh $H 'certbot --nginx -d celebsignatures.com -d www.celebsignatures.com \
+  --non-interactive --agree-tos -m steve@designerwallcoverings.com --redirect'
+ssh $H 'sed -i "s/listen 443 ssl/listen 45.61.58.125:443 ssl/" /etc/nginx/sites-available/celebsignatures.com
+nginx -t && systemctl reload nginx && sleep 2 && systemctl reload nginx'
+
+echo "── smoke ──"
+curl -s -o /dev/null -w "https://celebsignatures.com → %{http_code}\n" https://celebsignatures.com/
+curl -s -o /dev/null -w "grid API → %{http_code}\n" https://celebsignatures.com/api/signatures

← aeefcc5 Elegant front page: Photoshop Snell-Roundhand script logo (t · back to CelebritySignatures · celebsignatures.com LIVE: elegant front page (Photoshop Snel 647ee5c →