← back to Marketing Command Center
Stage DW-marketing consolidation (DTD verdict A): nginx vhost swap → MCC on DW domain + agentabrams 301 + CUTOVER runbook (staged, not applied)
eb09669bf1622294409b17f8054b554dae944a45 · 2026-07-15 13:58:44 -0700 · Steve Abrams
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Files touched
A deploy/CUTOVER.mdA deploy/nginx/marketing.agentabrams.com.confA deploy/nginx/marketing.designerwallcoverings.com.conf
Diff
commit eb09669bf1622294409b17f8054b554dae944a45
Author: Steve Abrams <steve@designerwallcoverings.com>
Date: Wed Jul 15 13:58:44 2026 -0700
Stage DW-marketing consolidation (DTD verdict A): nginx vhost swap → MCC on DW domain + agentabrams 301 + CUTOVER runbook (staged, not applied)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
deploy/CUTOVER.md | 56 ++++++++++++++++++++++
deploy/nginx/marketing.agentabrams.com.conf | 25 ++++++++++
.../nginx/marketing.designerwallcoverings.com.conf | 49 +++++++++++++++++++
3 files changed, 130 insertions(+)
diff --git a/deploy/CUTOVER.md b/deploy/CUTOVER.md
new file mode 100644
index 0000000..7b51654
--- /dev/null
+++ b/deploy/CUTOVER.md
@@ -0,0 +1,56 @@
+# DW Marketing consolidation — CUTOVER runbook (DTD verdict A, 2026-07-15)
+
+**Goal:** `marketing.designerwallcoverings.com` becomes the single canonical DW
+marketing home (serving the Marketing Command Center, :9662).
+`marketing.agentabrams.com` 301-redirects to it. The reels app keeps running on
+:9848 behind the MCC's reels module; raw reel MP4s stay publicly fetchable.
+
+**Why it's low-risk:** both hosts already have valid Let's Encrypt certs and live
+nginx vhosts. This is a `proxy_pass` swap + a redirect — **no new cert, no DNS
+change** (both A-records already point at Kamatera 45.61.58.125).
+
+---
+
+## ⚠️ GATED — Steve runs these on Kamatera (live nginx). Nothing here is auto-applied.
+
+```sh
+# 0. SSH to Kamatera, back up the current live vhosts first
+ssh root@45.61.58.125
+cd /etc/nginx
+mkdir -p /root/nginx-backup-$(date +%F)
+cp sites-available/marketing.designerwallcoverings.com* /root/nginx-backup-$(date +%F)/ 2>/dev/null || true
+cp sites-available/marketing.agentabrams.com* /root/nginx-backup-$(date +%F)/ 2>/dev/null || true
+# (path may be conf.d/ instead of sites-available/ — confirm with: nginx -T | grep -n marketing)
+
+# 1. Drop in the staged configs (rsync'd to the project's deploy/nginx/ by /deploy)
+cp /root/DW-Agents/marketing-command-center/deploy/nginx/marketing.designerwallcoverings.com.conf \
+ /etc/nginx/sites-available/marketing.designerwallcoverings.com.conf
+cp /root/DW-Agents/marketing-command-center/deploy/nginx/marketing.agentabrams.com.conf \
+ /etc/nginx/sites-available/marketing.agentabrams.com.conf
+
+# 2. Test + reload
+nginx -t && systemctl reload nginx
+```
+
+## Verify after cutover
+```sh
+# MCC now on the DW domain (401 = healthy auth gate)
+curl -s -o /dev/null -w "dw root -> %{http_code}\n" https://marketing.designerwallcoverings.com/
+curl -s -o /dev/null -w "dw root (auth) -> %{http_code}\n" -u admin:$MCC_PASS https://marketing.designerwallcoverings.com/
+# reel MP4 still public (Meta can fetch) — expect 200
+curl -s -o /dev/null -w "reel mp4 -> %{http_code}\n" https://marketing.designerwallcoverings.com/reels/<latest>.mp4
+# agentabrams now redirects — expect 301 -> designerwallcoverings
+curl -s -o /dev/null -w "agentabrams -> %{http_code} -> %{redirect_url}\n" https://marketing.agentabrams.com/
+```
+
+## Revert (if anything looks wrong)
+```sh
+cp /root/nginx-backup-<DATE>/* /etc/nginx/sites-available/ # restore originals
+nginx -t && systemctl reload nginx
+```
+
+## Follow-ups (non-gated, after cutover confirmed)
+- Point `dw-marketing-reels/.deploy.conf` note + README at the new front-door URL.
+- Confirm `REELS_BASE` (MCC .env) = `http://127.0.0.1:9848` (default — already correct).
+- `publish-ig.mjs` PUBLIC_BASE stays `https://marketing.designerwallcoverings.com`
+ (the /reels/*.mp4 public location keeps it fetchable).
diff --git a/deploy/nginx/marketing.agentabrams.com.conf b/deploy/nginx/marketing.agentabrams.com.conf
new file mode 100644
index 0000000..27ce846
--- /dev/null
+++ b/deploy/nginx/marketing.agentabrams.com.conf
@@ -0,0 +1,25 @@
+# RETIRE the agentabrams marketing surface (DTD verdict A, 2026-07-15).
+# marketing.agentabrams.com now 301-redirects to the canonical DW marketing
+# home. The MCC keeps running on :9662; only its public front door moves to the
+# designerwallcoverings.com brand domain.
+#
+# STAGED — not yet applied. See deploy/CUTOVER.md.
+# TLS cert for this host already exists (it served the MCC over HTTPS).
+
+server {
+ listen 80;
+ listen [::]:80;
+ server_name marketing.agentabrams.com;
+ return 301 https://marketing.designerwallcoverings.com$request_uri;
+}
+
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ server_name marketing.agentabrams.com;
+
+ ssl_certificate /etc/letsencrypt/live/marketing.agentabrams.com/fullchain.pem;
+ ssl_certificate_key /etc/letsencrypt/live/marketing.agentabrams.com/privkey.pem;
+
+ return 301 https://marketing.designerwallcoverings.com$request_uri;
+}
diff --git a/deploy/nginx/marketing.designerwallcoverings.com.conf b/deploy/nginx/marketing.designerwallcoverings.com.conf
new file mode 100644
index 0000000..7e3e19e
--- /dev/null
+++ b/deploy/nginx/marketing.designerwallcoverings.com.conf
@@ -0,0 +1,49 @@
+# DW Marketing — canonical home (DTD verdict A, 2026-07-15).
+# marketing.designerwallcoverings.com now serves the Marketing Command Center
+# (:9662). The reels app keeps running as its own pm2 process on :9848; the
+# MCC's reels module proxies /api/reels/ui/* to it, and the raw reel MP4s are
+# served publicly (no auth) via the /reels/ location below so Meta/TikTok can
+# fetch the media for publishing.
+#
+# STAGED — not yet applied. See deploy/CUTOVER.md for the gated apply steps.
+# The TLS cert for this host already exists (the reels app served HTTPS here),
+# so the cutover is a proxy_pass swap, not a new cert.
+
+server {
+ listen 80;
+ listen [::]:80;
+ server_name marketing.designerwallcoverings.com;
+ return 301 https://$host$request_uri;
+}
+
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ server_name marketing.designerwallcoverings.com;
+
+ ssl_certificate /etc/letsencrypt/live/marketing.designerwallcoverings.com/fullchain.pem;
+ ssl_certificate_key /etc/letsencrypt/live/marketing.designerwallcoverings.com/privkey.pem;
+
+ client_max_body_size 32m;
+
+ # PUBLIC media passthrough — raw reel MP4s, NO auth, so Meta/TikTok can pull
+ # the video for content publishing. Served straight from the reels app.
+ location ~ ^/reels/[^/]+\.mp4$ {
+ proxy_pass http://127.0.0.1:9848;
+ proxy_set_header Host $host;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto $scheme;
+ }
+
+ # Everything else → the Marketing Command Center (it enforces its own Basic auth).
+ location / {
+ proxy_pass http://127.0.0.1:9662;
+ proxy_http_version 1.1;
+ proxy_set_header Host $host;
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_set_header Connection "upgrade";
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto $scheme;
+ proxy_read_timeout 120s;
+ }
+}
← 98f32bf PR naturals v3 design: uniform 620x620 tiles (grasscloth sou
·
back to Marketing Command Center
·
chore: v1.0.2 (session close — PR naturals draft iterations) 49dbc5c →