`DEPLOY.md`

47 lines
# Deploy — dw-photo-capture → Kamatera (photo.designerwallcoverings.com)

Runs the Node app on Kamatera (Linux) using **Gemini** as the vision engine (the macOS Vision
binary + local Ollama don't exist there). Cloudflare fronts it → real TLS for the camera.

## 0. Prereqs (once)
- Kamatera has node + pm2, nginx, certbot, and local Postgres `dw_unified`.
- Gemini key in the secrets registry as `GEMINI_API_KEY` (verified).

## 1. Provision server env (secrets skill — never hand-paste keys)
```sh
# routes GEMINI_API_KEY (+ SHOPIFY_ADMIN_TOKEN) into the server .env for this project
# then create /root/public-projects/dwphoto/.env from .env.example with:
#   OCR_ENGINE=gemini, GEMINI_API_KEY=…, AUTH_USER/AUTH_PASS, PSQL=/usr/bin/psql, DW_UNIFIED_DB=dw_unified
```

## 2. Deploy code (from this repo)
```sh
cd ~/Projects/dw-photo-capture && ~/Projects/_shared/scripts/deploy.sh
# rsync (excludes photos/bin/certs/logs) → npm ci --omit=dev → pm2 reload dwphoto → smoke /healthz 200
```
First time on the box: `pm2 start server.js --name dwphoto && pm2 save`.

## 3. nginx vhost + SSL
```nginx
server {
  server_name photo.designerwallcoverings.com;
  location / { proxy_pass http://127.0.0.1:9890; proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $remote_addr; client_max_body_size 20m; }
}
# certbot --nginx -d photo.designerwallcoverings.com   (or rely on Cloudflare edge TLS + CF origin cert)
```

## 4. Repoint DNS photo.* → Kamatera, tear down the Mac tunnel
The domain currently CNAMEs to the Mac Cloudflare Tunnel. To move it to Kamatera:
```sh
# In Cloudflare DNS: delete the tunnel CNAME for photo, add  A  photo → 45.61.58.125  (proxied).
# Then retire the Mac tunnel:
launchctl bootout gui/$(id -u)/com.steve.dwphoto-tunnel
cloudflared tunnel delete dwphoto
```

## Notes
- macvision engine is unavailable on Linux (by design); `engine=all` just runs gemini (+gcv if keyed).
- Per-scan cost ≈ $0.0006 (Gemini) / $0.0015 (GCV). macvision would be $0 but is Mac-only.
- GATED steps (Steve sign-off): secrets→prod, nginx/SSL, DNS repoint, tunnel teardown.