deploy: bootstrap-safe first deploy (stage HTTP-only config until cert exists)

d0e05ece0fa5c182fe8590b37134d5474a9368c6 · 2026-07-23 12:24:14 -0700 · Steve Abrams

Fixes the first-run chicken-and-egg: the committed .nginx references certs
certbot hasn't minted yet. Now live at https://graphics.agentabrams.com.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Files touched

M deploy/deploy.sh

Diff

commit d0e05ece0fa5c182fe8590b37134d5474a9368c6
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Jul 23 12:24:14 2026 -0700

    deploy: bootstrap-safe first deploy (stage HTTP-only config until cert exists)
    
    Fixes the first-run chicken-and-egg: the committed .nginx references certs
    certbot hasn't minted yet. Now live at https://graphics.agentabrams.com.
    
    Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 deploy/deploy.sh | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/deploy/deploy.sh b/deploy/deploy.sh
index b5120d5..0fcbf3c 100755
--- a/deploy/deploy.sh
+++ b/deploy/deploy.sh
@@ -27,17 +27,33 @@ fi
 rsync -az --exclude .git --exclude tests --exclude deploy "$HERE/" $KAMATERA:/var/www/$SITE/
 echo "content rsynced"
 
-# 3. nginx (80 first so certbot HTTP-01 can pass)
-scp -q "$HERE/deploy/$SITE.nginx" $KAMATERA:/etc/nginx/sites-available/$SITE
+# 3. nginx. If the cert already exists, ship the full (SSL) config; otherwise ship an
+#    HTTP-only bootstrap first — the committed .nginx references certs certbot hasn't
+#    minted yet, so loading it pre-cert fails nginx -t (the first-deploy chicken-and-egg).
+HAVE_CERT=$(ssh $KAMATERA "test -f /etc/letsencrypt/live/$SITE/fullchain.pem && echo yes || echo no")
+if [ "$HAVE_CERT" = "yes" ]; then
+  scp -q "$HERE/deploy/$SITE.nginx" $KAMATERA:/etc/nginx/sites-available/$SITE
+else
+  cat > /tmp/$SITE.bootstrap.nginx <<EOF
+server {
+    listen 45.61.58.125:80;
+    server_name $SITE;
+    root /var/www/$SITE;
+    index index.html;
+    location / { try_files \$uri \$uri/ \$uri.html =404; }
+}
+EOF
+  scp -q /tmp/$SITE.bootstrap.nginx $KAMATERA:/etc/nginx/sites-available/$SITE
+fi
 ssh $KAMATERA "ln -sf /etc/nginx/sites-available/$SITE /etc/nginx/sites-enabled/$SITE && nginx -t && systemctl reload nginx"
-echo "nginx staged"
+echo "nginx staged (cert present: $HAVE_CERT)"
 
-# 4. Wait for DNS, then SSL
+# 4. Wait for DNS, then SSL (certbot rewrites the http block to add 443 + redirect)
 for i in $(seq 1 30); do
   [ -n "$(dig +short $SITE @1.1.1.1)" ] && break
   sleep 10
 done
-ssh $KAMATERA "certbot --nginx -d $SITE --non-interactive --agree-tos -m steve@designerwallcoverings.com && systemctl reload nginx"
+ssh $KAMATERA "certbot --nginx -d $SITE --non-interactive --agree-tos -m steve@designerwallcoverings.com --redirect && systemctl reload nginx"
 
 # 5. Smoke test
 sleep 2

← a0e8f7e graphics.agentabrams.com hub + Spirograph.aa (improved from · back to Graphics Agentabrams · auto-save: 2026-07-24T23:30:18 (4 files) — graphics.json tes 3a038a7 →