deploy: cert-safe nginx script to add public /reels/*.mp4 passthrough to the live marketing.dw vhost (enables Meta media-fetch for IG publishing)

55e44f8e1909ba45c8fb1556d8ac766c7d1cbfb2 · 2026-07-17 09:07:23 -0700 · Steve Abrams

Files touched

A deploy/add-reels-passthrough.sh

Diff

commit 55e44f8e1909ba45c8fb1556d8ac766c7d1cbfb2
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Fri Jul 17 09:07:23 2026 -0700

    deploy: cert-safe nginx script to add public /reels/*.mp4 passthrough to the live marketing.dw vhost (enables Meta media-fetch for IG publishing)
---
 deploy/add-reels-passthrough.sh | 45 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/deploy/add-reels-passthrough.sh b/deploy/add-reels-passthrough.sh
new file mode 100755
index 0000000..f830d7d
--- /dev/null
+++ b/deploy/add-reels-passthrough.sh
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# add-reels-passthrough.sh — run AS ROOT on Kamatera.
+# Adds a PUBLIC /reels/*.mp4 passthrough to the LIVE marketing.designerwallcoverings.com
+# nginx vhost so Meta can fetch reel media for Instagram publishing. It ONLY inserts a
+# `location` block into the already-working vhost — it reuses that vhost's existing TLS
+# cert (no cert reference, no cert change), which sidesteps the missing-cert issue that
+# stalled the earlier full cutover. Idempotent + safe: aborts on `nginx -t` failure.
+set -euo pipefail
+
+echo "→ finding the reels app port (public /privacy probe, no auth)…"
+PORT=""
+for p in 9848 9600 9662 9846; do
+  if [ "$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:$p/privacy" 2>/dev/null)" = "200" ]; then PORT=$p; break; fi
+done
+[ -z "$PORT" ] && { echo "✗ could not find the reels app (tried :9848/9600/9662/9846). Is pm2 dw-marketing-reels up?"; exit 1; }
+echo "  reels app on 127.0.0.1:$PORT"
+
+echo "→ locating live vhost for marketing.designerwallcoverings.com…"
+V=$(grep -rl "server_name marketing.designerwallcoverings.com" /etc/nginx/sites-available /etc/nginx/conf.d 2>/dev/null | head -1)
+[ -z "$V" ] && { echo "✗ no vhost found for marketing.designerwallcoverings.com"; exit 1; }
+echo "  vhost: $V"
+
+if grep -qE 'location[^{]*/reels/' "$V"; then
+  echo "  /reels/ passthrough already present — nothing to insert."
+else
+  cp "$V" "$V.bak-$(date +%s)" && echo "  backed up vhost"
+  # Insert a public reels location immediately after each server_name line (lands it
+  # inside the server block that owns the cert). awk is used so no fragile brace-matching.
+  awk -v port="$PORT" '
+    { print }
+    /server_name[[:space:]]+marketing\.designerwallcoverings\.com/ {
+      print "    location ~ ^/reels/[^/]+\\.mp4$ { proxy_pass http://127.0.0.1:" port "; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; }"
+    }
+  ' "$V" > "$V.new" && mv "$V.new" "$V"
+  echo "  inserted:  location ~ ^/reels/[^/]+\\.mp4\$  →  http://127.0.0.1:$PORT"
+fi
+
+echo "→ nginx -t"
+nginx -t
+echo "→ reload"
+systemctl reload nginx
+echo "✓ RELOADED"
+echo "→ verify (expect 200):"
+f=$(ls -t /root/public-projects/dw-marketing-reels/reels/*.mp4 2>/dev/null | head -1 | xargs -r basename)
+[ -n "$f" ] && curl -s -o /dev/null -w "  https://marketing.designerwallcoverings.com/reels/$f -> %{http_code}\n" "https://marketing.designerwallcoverings.com/reels/$f" || echo "  (no reel file found to test — check manually)"

← 878597b fix .deploy.conf health-check port 9848→9600 (reels app real · back to Dw Marketing Reels · 5x sweep 2: gallery videos preload=none — kills the 21-video eba4f19 →