`ACCESS.md`

32 lines
# Access — dw-photo-capture

**LIVE on Kamatera** at **https://photo.designerwallcoverings.com** (deployed 2026-07-06).

The app runs in two places:
- **Kamatera (public, production)** — Linux, so it uses the **Gemini** vision engine (the macOS
  Vision binary + local Ollama don't exist there). This is what photo.designerwallcoverings.com serves.
- **This Mac (local dev)** — full macOS Vision + local Ollama at $0/scan; local/LAN only.

## Public production (Kamatera)
- **URL:** https://photo.designerwallcoverings.com  (Cloudflare-proxied, real LE cert via DNS-01)
- **App:** pm2 `dwphoto` on **port 9912** (`/root/public-projects/dwphoto/server.js`), env in `.env`
  (OCR_ENGINE=gemini, GEMINI_API_KEY, AUTH_USER/PASS, PSQL, DW_UNIFIED_DB). pm2 save'd → survives reboot.
- **nginx:** `/etc/nginx/sites-available/photo.designerwallcoverings.com` — MUST use IP-specific
  `listen 45.61.58.125:80/:443` (the box has other vhosts bound to that specific IP; a generic
  `listen 80` gets shadowed and 404s). Proxies to 127.0.0.1:9912.
- **DNS:** Cloudflare A `photo → 45.61.58.125` (proxied/orange). Zone edits use the master
  `CLOUDFLARE_API_TOKEN` (the box's `/root/.secrets/cloudflare.ini` can't see this zone; a working
  copy is at `/root/.secrets/cloudflare-dw.ini` for cert renewal).
- **Vision engines:** `engine=all` selectable per request; on Kamatera only **gemini** is available
  (macvision is Mac-only). Per-scan cost ≈ $0.0006 (Gemini) / $0.0015 (GCV, if keyed).

## Local dev (this Mac)
- **App:** launchd `com.steve.dwphoto`, HTTP :9890 + self-signed HTTPS :9891, macvision default.
- LAN: https://192.168.1.151:9891 · Tailscale: https://100.82.17.107:9891 · local: http://localhost:9890
- The old Mac Cloudflare Tunnel (photo.* → Mac) was **retired** on cutover to Kamatera.

## Ops
- Deploy: `~/Projects/_shared/scripts/deploy.sh` (uses `.deploy.conf`).
- Auth: HTTP Basic (admin / DW2024! default; override via AUTH_USER/AUTH_PASS).
- Cert renewal: certbot on the box (dns-cloudflare, `/root/.secrets/cloudflare-dw.ini`).