yolo: harden go-live scripts per contrarian (self-signed origin TLS + CF Full, admin origin-only, default_server preflight, rollback capture)

013b8284a09c8e95a22765e2d607d855b0d16699 · 2026-07-22 12:59:49 -0700 · Steve Abrams

Files touched

M deploy-kamatera.sh

Diff

commit 013b8284a09c8e95a22765e2d607d855b0d16699
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed Jul 22 12:59:49 2026 -0700

    yolo: harden go-live scripts per contrarian (self-signed origin TLS + CF Full, admin origin-only, default_server preflight, rollback capture)
---
 deploy-kamatera.sh | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

diff --git a/deploy-kamatera.sh b/deploy-kamatera.sh
index ea8d3b5..78fea5e 100755
--- a/deploy-kamatera.sh
+++ b/deploy-kamatera.sh
@@ -59,11 +59,23 @@ sleep 6
 echo -n '  web  '; curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:$WEB_PORT/
 echo -n '  admin(401 expected) '; curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:$ADMIN_PORT/"
 
-echo "──────── 6/6  nginx vhosts (HTTP; CF edge TLS) ────────"
-ssh $KH "cat > /etc/nginx/sites-available/spechomes.com <<'NGINX'
+echo "──────── 6/6  nginx vhosts + origin TLS (self-signed; CF SSL=Full encrypts the hop) ────────"
+ssh $KH "
+# pre-flight: warn on a wildcard default_server that could hijack direct-IP hits (contrarian #3)
+DSRV=\$(grep -rl 'default_server' /etc/nginx/sites-enabled/ 2>/dev/null | grep -v spechomes || true)
+[ -n \"\$DSRV\" ] && echo \"  ⚠ default_server present in: \$DSRV — spechomes uses IP-bound listen so named requests match, but note it.\" || echo '  ✓ no competing default_server'
+# self-signed origin cert (CF→origin encryption; upgrade to CF Origin CA / LE later)
+mkdir -p /etc/nginx/ssl
+[ -f /etc/nginx/ssl/spechomes.crt ] || openssl req -x509 -nodes -newkey rsa:2048 -days 3650 \
+  -keyout /etc/nginx/ssl/spechomes.key -out /etc/nginx/ssl/spechomes.crt \
+  -subj '/CN=spechomes.com' 2>/dev/null
+cat > /etc/nginx/sites-available/spechomes.com <<'NGINX'
 server {
     listen 45.61.58.125:80;
+    listen 45.61.58.125:443 ssl;
     server_name spechomes.com www.spechomes.com;
+    ssl_certificate     /etc/nginx/ssl/spechomes.crt;
+    ssl_certificate_key /etc/nginx/ssl/spechomes.key;
     location / {
         proxy_pass http://127.0.0.1:$WEB_PORT;
         proxy_set_header Host \$host;
@@ -72,9 +84,13 @@ server {
         proxy_set_header X-Forwarded-Proto \$scheme;
     }
 }
+# admin: origin-only, NOT in public DNS (contrarian #6 — never publicly brute-forceable)
 server {
     listen 45.61.58.125:80;
+    listen 45.61.58.125:443 ssl;
     server_name admin.spechomes.com;
+    ssl_certificate     /etc/nginx/ssl/spechomes.crt;
+    ssl_certificate_key /etc/nginx/ssl/spechomes.key;
     location / {
         proxy_pass http://127.0.0.1:$ADMIN_PORT;
         proxy_set_header Host \$host;
@@ -86,7 +102,8 @@ server {
 NGINX
 ln -sf /etc/nginx/sites-available/spechomes.com /etc/nginx/sites-enabled/spechomes.com
 nginx -t && systemctl reload nginx
-echo -n '  origin via Host header: '; curl -s -o /dev/null -w '%{http_code}\n' -H 'Host: spechomes.com' http://127.0.0.1/"
+echo -n '  origin via Host header (HTTP): '; curl -s -o /dev/null -w '%{http_code}\n' -H 'Host: spechomes.com' http://127.0.0.1/
+echo -n '  extension check: '; sudo -u postgres psql -d spechomes -tAc \"SELECT extname FROM pg_extension WHERE extname='pg_trgm'\""
 
 echo ""
-echo "✅  Kamatera origin is live. Tell Claude 'origin ready' and it will do Cloudflare + GoDaddy."
+echo "✅  Kamatera origin is live (HTTP+HTTPS, admin origin-only). Tell Claude 'origin ready' → Cloudflare + GoDaddy."

← 030753f go-live scripts (Kamatera deploy + CF/GoDaddy cutover), giti · back to Homesonspec · fix: relative import for parse-search (the @/ alias mis-reso 6e35e39 →