chore: photocapture LIVE on Kamatera at photo.designerwallcoverings.com (pm2 dwphoto :9912, gemini engine, CF-proxied + LE cert); retire Mac tunnel

b7eee40d9ce1c3c2012c5667f77a4e1b9c4b1822 · 2026-07-06 15:10:16 -0700 · Steve Abrams

- .deploy.conf port 9890→9912 (9890 belongs to goldleafwallpaper-website on Kamatera)
- ACCESS.md: document the two-place setup, IP-specific nginx listen gotcha, DNS-01 cert via cloudflare-dw.ini

Files touched

M .deploy.conf
M ACCESS.md

Diff

commit b7eee40d9ce1c3c2012c5667f77a4e1b9c4b1822
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon Jul 6 15:10:16 2026 -0700

    chore: photocapture LIVE on Kamatera at photo.designerwallcoverings.com (pm2 dwphoto :9912, gemini engine, CF-proxied + LE cert); retire Mac tunnel
    
    - .deploy.conf port 9890→9912 (9890 belongs to goldleafwallpaper-website on Kamatera)
    - ACCESS.md: document the two-place setup, IP-specific nginx listen gotcha, DNS-01 cert via cloudflare-dw.ini
---
 .deploy.conf |  6 +++---
 ACCESS.md    | 45 +++++++++++++++++++++++++--------------------
 2 files changed, 28 insertions(+), 23 deletions(-)

diff --git a/.deploy.conf b/.deploy.conf
index 5a1403d..59c6137 100644
--- a/.deploy.conf
+++ b/.deploy.conf
@@ -1,11 +1,11 @@
 # dw-photo-capture deploy config — consumed by ~/Projects/_shared/scripts/deploy.sh
-# Customer-facing scanner at photo.designerwallcoverings.com (Cloudflare → Kamatera nginx → :9890).
+# Customer-facing scanner at photo.designerwallcoverings.com (Cloudflare → Kamatera nginx → :9912).
 # On Linux the macOS Vision binary + local Ollama are absent, so OCR_ENGINE=gemini is REQUIRED.
 PROJECT_NAME=dwphoto
 DEPLOY_HOST=45.61.58.125
 DEPLOY_PATH=/root/public-projects/dwphoto
-HEALTH_URL=http://localhost:9890/healthz
-PORT=9890
+HEALTH_URL=http://localhost:9912/healthz
+PORT=9912
 INSTALL_CMD="npm ci --omit=dev"
 BUILD_CMD=""
 # deploy aborts unless the remote pm2 process already has these env vars set (see .env.example):
diff --git a/ACCESS.md b/ACCESS.md
index dc62e7c..6dfd432 100644
--- a/ACCESS.md
+++ b/ACCESS.md
@@ -1,26 +1,31 @@
 # Access — dw-photo-capture
 
-This app is **Mac-bound by design** (macOS Vision OCR binary `bin/ocr` + local Ollama VLM +
-Homebrew psql), so it runs on this Mac (macstudio3), NOT on Kamatera. It is exposed publicly
-via a **Cloudflare Tunnel** — the Mac stays the compute; Cloudflare's edge provides the real
-TLS the live camera (`getUserMedia`) needs.
+**LIVE on Kamatera** at **https://photo.designerwallcoverings.com** (deployed 2026-07-06).
 
-## URLs
-- **Public:** https://photo.designerwallcoverings.com  (Cloudflare edge TLS; basic-auth gated)
-- **LAN:** https://192.168.1.151:9891  (self-signed)
-- **Tailscale:** https://100.82.17.107:9891
-- **Local:** http://localhost:9890
+The app runs in two places:
+- **Kamatera (public, production)** — Linux, so it uses the **Gemini** vision engine (the macOS
+  Vision binary + local Ollama don't exist there). This is what photo.designerwallcoverings.com serves.
+- **This Mac (local dev)** — full macOS Vision + local Ollama at $0/scan; local/LAN only.
 
-## Serving stack
-- **App:** launchd `com.steve.dwphoto` (PID varies) — `server.js`, HTTP :9890 + self-signed HTTPS :9891.
-- **Tunnel:** launchd `com.steve.dwphoto-tunnel` → cloudflared, config `~/.cloudflared/dwphoto-config.yml`,
-  tunnel id `ba44dc91-81cf-4c89-ae3e-fa5fc347eb1b`, ingress `photo.designerwallcoverings.com → http://localhost:9890`.
-  (Origin is plain HTTP :9890 on purpose — CF terminates TLS at the edge, avoiding the app's self-signed cert.)
-- **Auth:** HTTP Basic (admin / DW2024! by default; override via AUTH_USER/AUTH_PASS env).
+## Public production (Kamatera)
+- **URL:** https://photo.designerwallcoverings.com  (Cloudflare-proxied, real LE cert via DNS-01)
+- **App:** pm2 `dwphoto` on **port 9912** (`/root/public-projects/dwphoto/server.js`), env in `.env`
+  (OCR_ENGINE=gemini, GEMINI_API_KEY, AUTH_USER/PASS, PSQL, DW_UNIFIED_DB). pm2 save'd → survives reboot.
+- **nginx:** `/etc/nginx/sites-available/photo.designerwallcoverings.com` — MUST use IP-specific
+  `listen 45.61.58.125:80/:443` (the box has other vhosts bound to that specific IP; a generic
+  `listen 80` gets shadowed and 404s). Proxies to 127.0.0.1:9912.
+- **DNS:** Cloudflare A `photo → 45.61.58.125` (proxied/orange). Zone edits use the master
+  `CLOUDFLARE_API_TOKEN` (the box's `/root/.secrets/cloudflare.ini` can't see this zone; a working
+  copy is at `/root/.secrets/cloudflare-dw.ini` for cert renewal).
+- **Vision engines:** `engine=all` selectable per request; on Kamatera only **gemini** is available
+  (macvision is Mac-only). Per-scan cost ≈ $0.0006 (Gemini) / $0.0015 (GCV, if keyed).
+
+## Local dev (this Mac)
+- **App:** launchd `com.steve.dwphoto`, HTTP :9890 + self-signed HTTPS :9891, macvision default.
+- LAN: https://192.168.1.151:9891 · Tailscale: https://100.82.17.107:9891 · local: http://localhost:9890
+- The old Mac Cloudflare Tunnel (photo.* → Mac) was **retired** on cutover to Kamatera.
 
 ## Ops
-- Tunnel logs: `tunnel.out.log` / `tunnel.err.log` (repo root, gitignored).
-- Restart tunnel: `launchctl kickstart -k gui/$(id -u)/com.steve.dwphoto-tunnel`
-- Remove tunnel: `launchctl bootout gui/$(id -u)/com.steve.dwphoto-tunnel` + `cloudflared tunnel delete dwphoto`
-- **A true Kamatera (Linux) deploy is NOT possible without re-architecting** OCR → cloud API
-  (Google Vision/Gemini, metered) and Ollama → a remote host.
+- Deploy: `~/Projects/_shared/scripts/deploy.sh` (uses `.deploy.conf`).
+- Auth: HTTP Basic (admin / DW2024! default; override via AUTH_USER/AUTH_PASS).
+- Cert renewal: certbot on the box (dns-cloudflare, `/root/.secrets/cloudflare-dw.ini`).

← d3b12d1 chore: Kamatera deploy artifacts — .deploy.conf (gemini engi · back to Dw Photo Capture · feat: auto front/back side detection on scan — analyzeOcr cl 9192328 →