[object Object]

← back to Emoji Agentabrams

emoji.aa live: DNS + nginx (post-certbot SSL vhost) + repeatable deploy script

d5258a2ef162dc4546a874847b262047b19dd142 · 2026-07-24 23:40:46 -0700 · Steve Abrams

Files touched

Diff

commit d5258a2ef162dc4546a874847b262047b19dd142
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Fri Jul 24 23:40:46 2026 -0700

    emoji.aa live: DNS + nginx (post-certbot SSL vhost) + repeatable deploy script
---
 deploy/emoji.agentabrams.com.deploy.sh | 43 ++++++++++++++++++++++++++++++++++
 deploy/emoji.agentabrams.com.nginx     | 21 ++++++++++++++++-
 2 files changed, 63 insertions(+), 1 deletion(-)

diff --git a/deploy/emoji.agentabrams.com.deploy.sh b/deploy/emoji.agentabrams.com.deploy.sh
new file mode 100755
index 0000000..0656f45
--- /dev/null
+++ b/deploy/emoji.agentabrams.com.deploy.sh
@@ -0,0 +1,43 @@
+#!/bin/bash
+# emoji.agentabrams.com — full first deploy (DNS + rsync + nginx + SSL).
+# Idempotent: re-running after go-live just re-rsyncs content. Steve-gated.
+set -euo pipefail
+KAMATERA=root@45.61.58.125
+SITE=emoji.agentabrams.com
+HERE="$(cd "$(dirname "$0")/.." && pwd)"
+
+# 1. DNS: A record emoji -> Kamatera (DNS-only, matches fleet pattern)
+export $(grep -E "^CLOUDFLARE_API_TOKEN=" ~/Projects/secrets-manager/.env)
+ZONE=$(curl -s -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
+  "https://api.cloudflare.com/client/v4/zones?name=agentabrams.com" \
+  | python3 -c "import sys,json; print(json.load(sys.stdin)['result'][0]['id'])")
+EXISTS=$(curl -s -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
+  "https://api.cloudflare.com/client/v4/zones/$ZONE/dns_records?name=$SITE" \
+  | python3 -c "import sys,json; print(len(json.load(sys.stdin)['result']))")
+if [ "$EXISTS" = "0" ]; then
+  curl -s -X POST -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" -H "Content-Type: application/json" \
+    "https://api.cloudflare.com/client/v4/zones/$ZONE/dns_records" \
+    -d "{\"type\":\"A\",\"name\":\"emoji\",\"content\":\"45.61.58.125\",\"ttl\":300,\"proxied\":false}" \
+    | python3 -c "import sys,json; r=json.load(sys.stdin); assert r['success'], r['errors']; print('DNS record created')"
+else
+  echo "DNS record already exists"
+fi
+
+# 2. Content
+ssh $KAMATERA "mkdir -p /var/www/$SITE"
+rsync -az --exclude .git --exclude deploy "$HERE/" $KAMATERA:/var/www/$SITE/
+echo "content rsynced"
+
+# 3. nginx (this conf is the post-certbot state; on a fresh box strip the :443 block first
+#    so nginx -t passes before the cert exists, then let certbot re-add it).
+scp -q "$HERE/deploy/$SITE.nginx" $KAMATERA:/etc/nginx/sites-available/$SITE
+ssh $KAMATERA "ln -sf /etc/nginx/sites-available/$SITE /etc/nginx/sites-enabled/$SITE && nginx -t && systemctl reload nginx"
+echo "nginx staged"
+
+# 4. Wait for DNS, then SSL
+for i in $(seq 1 30); do
+  [ -n "$(dig +short $SITE @1.1.1.1)" ] && break
+  sleep 10
+done
+ssh $KAMATERA "certbot --nginx -d $SITE --non-interactive --agree-tos -m steve@designerwallcoverings.com --redirect && systemctl reload nginx"
+echo "SSL live — https://$SITE"
diff --git a/deploy/emoji.agentabrams.com.nginx b/deploy/emoji.agentabrams.com.nginx
index b17187a..de5e1fb 100644
--- a/deploy/emoji.agentabrams.com.nginx
+++ b/deploy/emoji.agentabrams.com.nginx
@@ -3,7 +3,6 @@
 # IP-bound listen (45.61.58.125) is REQUIRED — a plain `listen 80` vhost loses to the
 # wildcard default_server and 301s to 1890swallpaper.com (agentabrams fleet gotcha).
 server {
-    listen 45.61.58.125:80;
     server_name emoji.agentabrams.com;
 
     access_log /var/log/nginx/emoji.agentabrams.com.access.log;
@@ -19,4 +18,24 @@ server {
     location / {
         try_files $uri $uri/ $uri.html =404;
     }
+
+    listen 45.61.58.125:443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/emoji.agentabrams.com/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/emoji.agentabrams.com/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
 }
+
+server {
+    if ($host = emoji.agentabrams.com) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 45.61.58.125:80;
+    server_name emoji.agentabrams.com;
+    return 404; # managed by Certbot
+
+
+}
\ No newline at end of file

← 7b25631 initial scaffold — emoji.agentabrams.com single-page Emoji M  ·  back to Emoji Agentabrams  ·  (newest)