chore: add TK-10428 nph measure-fix deploy scripts (HTTP-01 cert), v0.1.1 (session close)

b672493a7a58cc4e84ddd55e41fca84a13521033 · 2026-08-10 16:27:39 -0700 · steve
Files touched

A deploy-measure-TK10428.sh
A deploy-nph-cert-TK10428.sh
M package.json
Diff

commit b672493a7a58cc4e84ddd55e41fca84a13521033
Author: steve <steve@designerwallcoverings.com>
Date:   Mon Aug 10 16:27:39 2026 -0700

    chore: add TK-10428 nph measure-fix deploy scripts (HTTP-01 cert), v0.1.1 (session close)
---
 deploy-measure-TK10428.sh  | 68 ++++++++++++++++++++++++++++++++++++++++++++++
 deploy-nph-cert-TK10428.sh | 49 +++++++++++++++++++++++++++++++++
 package.json               |  2 +-
 3 files changed, 118 insertions(+), 1 deletion(-)

diff --git a/deploy-measure-TK10428.sh b/deploy-measure-TK10428.sh
new file mode 100755
index 0000000..f19462c
--- /dev/null
+++ b/deploy-measure-TK10428.sh
@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# TK-10428 — Fix the store-wide "How many rolls do I need?" button.
+# Two prod actions on Kamatera (Steve-approved: "Fix-forward now"):
+#   (A) ship the /measure route + assets to the live NPH app (additive-only, verified)
+#   (B) stand up nph.designerwallcoverings.com HTTPS vhost (IP-bound :443) + LE cert
+# Idempotent + safe: backup, node -c, nginx -t, x2 reload, live verify. Run from Mac2.
+set -euo pipefail
+
+K=root@45.61.58.125
+IP=45.61.58.125
+KDIR=/root/Projects/NationalPaperHangers
+NPHM="$HOME/Projects/NationalPaperHangers"
+DOMAIN=nph.designerwallcoverings.com
+PORT=9765
+STAMP=$(date +%s)
+BTN_URL="w=55.0&sku=DWLA-435111-Sample&mode=width"   # the exact live PDP button params
+
+echo "== [1/6] Backup live routes/public.js on Kamatera =="
+ssh "$K" "cd $KDIR && cp routes/public.js routes/public.js.bak-TK10428-$STAMP && echo '  backed up -> routes/public.js.bak-TK10428-$STAMP'"
+
+echo "== [2/6] Ship measure-feature files (additive) Mac2 -> Kamatera =="
+scp "$NPHM/routes/public.js"          "$K:$KDIR/routes/public.js"
+scp "$NPHM/views/public/measure.ejs"  "$K:$KDIR/views/public/measure.ejs"
+scp "$NPHM/public/js/measure-kit.js"  "$K:$KDIR/public/js/measure-kit.js"
+scp "$NPHM/public/js/room-measure.js" "$K:$KDIR/public/js/room-measure.js"
+
+echo "== [3/6] Syntax-check + pm2 restart NPH (aborts if node -c fails) =="
+ssh "$K" "cd $KDIR \
+  && node -c routes/public.js \
+  && pm2 restart national-paper-hangers --update-env \
+  && sleep 2 \
+  && curl -s -o /dev/null -w '  localhost:$PORT/measure -> HTTP %{http_code}\n' 'http://127.0.0.1:$PORT/measure?$BTN_URL'"
+
+echo "== [4/6] Issue LE cert for $DOMAIN via HTTP-01 webroot (DW CF zone is AT its 200-record cap → DNS-01 fails 'Record quota exceeded') =="
+ssh "$K" "certbot certonly --webroot -w /var/www/certbot \
+  -d $DOMAIN --non-interactive --agree-tos \
+  -m steve@designerwallcoverings.com --keep-until-expiring"
+
+echo "== [5/6] Write IP-bound vhost + reload nginx (guarded by nginx -t) =="
+ssh "$K" "cat > /etc/nginx/sites-available/$DOMAIN.conf <<'NGINX'
+server {
+    server_name $DOMAIN;
+    location / {
+        proxy_pass http://127.0.0.1:$PORT;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+    }
+    listen $IP:443 ssl http2;
+    ssl_certificate /etc/letsencrypt/live/$DOMAIN/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/$DOMAIN/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+}
+server {
+    listen $IP:80;
+    server_name $DOMAIN;
+    return 301 https://\$host\$request_uri;
+}
+NGINX
+ln -sf /etc/nginx/sites-available/$DOMAIN.conf /etc/nginx/sites-enabled/$DOMAIN.conf
+nginx -t && systemctl reload nginx && sleep 2 && systemctl reload nginx && echo '  nginx reloaded (x2)'"
+
+echo "== [6/6] Verify LIVE over HTTPS (the exact PDP button URL) =="
+curl -s -o /dev/null -w "  https://$DOMAIN/measure -> HTTP %{http_code}\n" "https://$DOMAIN/measure?$BTN_URL"
+echo -n "  cert subject: "; echo | openssl s_client -servername "$DOMAIN" -connect "$IP:443" 2>/dev/null | openssl x509 -noout -subject
+echo "== DONE. Expect: localhost 200, HTTPS 200, cert subject CN=$DOMAIN =="
diff --git a/deploy-nph-cert-TK10428.sh b/deploy-nph-cert-TK10428.sh
new file mode 100755
index 0000000..51bcbcf
--- /dev/null
+++ b/deploy-nph-cert-TK10428.sh
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# TK-10428 cert fix. The full deploy landed steps 1-3 (measure route live on :9765);
+# step 4 aborted because DNS-01 hit the DW Cloudflare 200-record cap
+# ("CloudFlareAPIError: Record quota exceeded"). Fix = HTTP-01 webroot instead —
+# creates NO DNS record, so the cap is irrelevant. The box's :80 default server
+# (00-acme-default-80.conf) already serves /.well-known/acme-challenge/ from
+# /var/www/certbot. Idempotent; safe to re-run. Run from Mac2 via: ! bash /tmp/nphcert
+set -euo pipefail
+K=root@45.61.58.125; IP=45.61.58.125; DOMAIN=nph.designerwallcoverings.com; PORT=9765
+BTN="w=55.0&sku=DWLA-435111-Sample&mode=width"
+
+echo "== [0/3] pre-flight: does the :80 webroot serve HTTP-01 for $DOMAIN? =="
+ssh "$K" 'T=preflight-$(date +%s); D=/var/www/certbot/.well-known/acme-challenge
+  mkdir -p "$D"; echo "$T" > "$D/$T"
+  code=$(curl -s -o /dev/null -w "%{http_code}" -H "Host: '"$DOMAIN"'" "http://'"$IP"'/.well-known/acme-challenge/$T")
+  rm -f "$D/$T"
+  echo "  webroot self-test -> HTTP $code (want 200)"
+  [ "$code" = "200" ] || { echo "  ABORT: webroot not serving challenges"; exit 1; }'
+
+echo "== [1/3] issue LE cert via HTTP-01 webroot (bypasses the CF record cap) =="
+ssh "$K" "certbot certonly --webroot -w /var/www/certbot -d $DOMAIN \
+  --non-interactive --agree-tos -m steve@designerwallcoverings.com --keep-until-expiring \
+  && echo '  cert issued:' && ls /etc/letsencrypt/live/$DOMAIN/"
+
+echo "== [2/3] write IP-bound :443 vhost + reload nginx (:80 stays with the central ACME default) =="
+ssh "$K" "cat > /etc/nginx/sites-available/$DOMAIN.conf <<'NGINX'
+server {
+    server_name $DOMAIN;
+    location / {
+        proxy_pass http://127.0.0.1:$PORT;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+    }
+    listen $IP:443 ssl http2;
+    ssl_certificate /etc/letsencrypt/live/$DOMAIN/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/$DOMAIN/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+}
+NGINX
+ln -sf /etc/nginx/sites-available/$DOMAIN.conf /etc/nginx/sites-enabled/$DOMAIN.conf
+nginx -t && systemctl reload nginx && sleep 2 && systemctl reload nginx && echo '  nginx reloaded (x2)'"
+
+echo "== [3/3] verify LIVE over HTTPS (the exact PDP button URL) =="
+curl -s -o /dev/null -w "  https://$DOMAIN/measure -> HTTP %{http_code}\n" "https://$DOMAIN/measure?$BTN"
+echo -n "  cert subject: "; echo | openssl s_client -servername "$DOMAIN" -connect "$IP:443" 2>/dev/null | openssl x509 -noout -subject
+echo "== DONE. Expect: HTTPS 200 + subject CN=$DOMAIN =="
diff --git a/package.json b/package.json
index 83c7aa8..8c24045 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "national-paper-hangers",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "private": true,
   "description": "Luxury wallcovering installer marketplace + scheduling platform",
   "main": "server.js",
← 365532c chore: macstudio3 migration — reconcile from mac2 + repoint · back to NationalPaperHangers · TK-11341: add AdSense Auto-Ads loader + ads.txt (revert to r 15f17c0 →