`deploy/CUTOVER.md`

72 lines
# DW Marketing consolidation — CUTOVER runbook (DTD verdict A, 2026-07-15)

> ## 🔴 CURRENT STATE (2026-07-15): the DW domain is 401-ing all public paths
> `marketing.designerwallcoverings.com` is already being served by the MCC
> (realm "Marketing Command Center") but **without** the public passthroughs, so
> the reel media (`/reels/*.mp4`), `/privacy`, and `/terms` all return 401 —
> which **breaks Meta media-fetch + the Meta-app legal pages**.
>
> **FIX (run the "Cutover" block below):** it installs the corrected vhost that
> keeps the MCC as the front door **and** proxies `/reels/*.mp4`, `/privacy`,
> `/terms` publicly to the reels app (:9848). After `nginx -t && reload`, all
> three public checks go back to 200.
>
> **OR REVERT** to the pre-session state (reels app owns the domain) — see the
> "Revert to reels app" block at the bottom.


**Goal:** `marketing.designerwallcoverings.com` becomes the single canonical DW
marketing home (serving the Marketing Command Center, :9662).
`marketing.agentabrams.com` 301-redirects to it. The reels app keeps running on
:9848 behind the MCC's reels module; raw reel MP4s stay publicly fetchable.

**Why it's low-risk:** both hosts already have valid Let's Encrypt certs and live
nginx vhosts. This is a `proxy_pass` swap + a redirect — **no new cert, no DNS
change** (both A-records already point at Kamatera 45.61.58.125).

---

## ⚠️ GATED — Steve runs these on Kamatera (live nginx). Nothing here is auto-applied.

```sh
# 0. SSH to Kamatera, back up the current live vhosts first
ssh root@45.61.58.125
cd /etc/nginx
mkdir -p /root/nginx-backup-$(date +%F)
cp sites-available/marketing.designerwallcoverings.com* /root/nginx-backup-$(date +%F)/ 2>/dev/null || true
cp sites-available/marketing.agentabrams.com*           /root/nginx-backup-$(date +%F)/ 2>/dev/null || true
# (path may be conf.d/ instead of sites-available/ — confirm with: nginx -T | grep -n marketing)

# 1. Drop in the staged configs (rsync'd to the project's deploy/nginx/ by /deploy)
cp /root/DW-Agents/marketing-command-center/deploy/nginx/marketing.designerwallcoverings.com.conf \
   /etc/nginx/sites-available/marketing.designerwallcoverings.com.conf
cp /root/DW-Agents/marketing-command-center/deploy/nginx/marketing.agentabrams.com.conf \
   /etc/nginx/sites-available/marketing.agentabrams.com.conf

# 2. Test + reload
nginx -t && systemctl reload nginx
```

## Verify after cutover
```sh
# MCC now on the DW domain (401 = healthy auth gate)
curl -s -o /dev/null -w "dw root -> %{http_code}\n" https://marketing.designerwallcoverings.com/
curl -s -o /dev/null -w "dw root (auth) -> %{http_code}\n" -u admin:$MCC_PASS https://marketing.designerwallcoverings.com/
# reel MP4 still public (Meta can fetch) — expect 200
curl -s -o /dev/null -w "reel mp4 -> %{http_code}\n" https://marketing.designerwallcoverings.com/reels/<latest>.mp4
# agentabrams now redirects — expect 301 -> designerwallcoverings
curl -s -o /dev/null -w "agentabrams -> %{http_code} -> %{redirect_url}\n" https://marketing.agentabrams.com/
```

## Revert (if anything looks wrong)
```sh
cp /root/nginx-backup-<DATE>/* /etc/nginx/sites-available/   # restore originals
nginx -t && systemctl reload nginx
```

## Follow-ups (non-gated, after cutover confirmed)
- Point `dw-marketing-reels/.deploy.conf` note + README at the new front-door URL.
- Confirm `REELS_BASE` (MCC .env) = `http://127.0.0.1:9848` (default — already correct).
- `publish-ig.mjs` PUBLIC_BASE stays `https://marketing.designerwallcoverings.com`
  (the /reels/*.mp4 public location keeps it fetchable).