Add Steve-gated deploy runbook (vhost + certbot, no DNS change)

e866b8e2fc78af1b3f5ad6b0f711b7ee5f8a655b · 2026-09-09 11:15:46 -0700 · Steve
Files touched

A DEPLOY-RUNBOOK.md
Diff

commit e866b8e2fc78af1b3f5ad6b0f711b7ee5f8a655b
Author: Steve <steve@designerwallcoverings.com>
Date:   Wed Sep 9 11:15:46 2026 -0700

    Add Steve-gated deploy runbook (vhost + certbot, no DNS change)
---
 DEPLOY-RUNBOOK.md | 72 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)

diff --git a/DEPLOY-RUNBOOK.md b/DEPLOY-RUNBOOK.md
new file mode 100644
index 0000000..17d63aa
--- /dev/null
+++ b/DEPLOY-RUNBOOK.md
@@ -0,0 +1,72 @@
+# Deploy runbook — 8 parked-domain landers (Steve-gated)
+
+**Status:** DRAFT — awaiting Steve's go. Mac2 is classifier-blocked from unattended prod SSH, so Steve fires each `!` command in his own session (his `!` prefix runs it and returns output).
+
+## Scope (exactly these 8 — the thin/broken-cert set)
+protectyourspec.com · cannabisofthemonthclub.com · hempofthemonthclub.com · marijuanaofthemonthclub.com · potofthemonthclub.com · weedofthemonthclub.com · mymemosamples.com · hospitalitysalesrepresentatives.com
+
+**EXCLUDED (do NOT touch — they already have real content + valid certs):** commercialdesignreps.com · hospitalitydesignreps.com · designerrepresentatives.com · designtradelive.com · wallpapercontractor.com
+**SEPARATE (Cloudflare, later):** designerssalesreps.com
+
+## Key facts (verified live 2026-09-09)
+- All 8 already resolve `A → 45.61.58.125` (Kamatera) on GoDaddy NS → **NO DNS CHANGE NEEDED.**
+- All 8 currently serve a thin page under a **mismatched SSL cert** (e.g. inflationfears.com, 90210rentals.com) → browsers show "Not Secure". `certbot --nginx` per domain **fixes that** as a side effect.
+- ⚠️ **No-clobber cert caution** (memory `deploy-fleet-clobbers-certbot-443-blocks`): do NOT push an `:80`-only conf over an existing certbot `:443` block. Let `certbot --nginx` own the 443 server block. This runbook creates a fresh `:80` vhost then lets certbot add 443 — safe.
+
+## Step 1 — upload (run from Mac2)
+```
+! rsync -az ~/Projects/parked-landers/sites/ root@45.61.58.125:/var/www/parked-landers/
+```
+
+## Step 2 — vhost + cert + reload (run on Kamatera, one paste)
+```
+! ssh root@45.61.58.125 'bash -s' <<'EOF'
+set -e
+DOMS="protectyourspec.com cannabisofthemonthclub.com hempofthemonthclub.com marijuanaofthemonthclub.com potofthemonthclub.com weedofthemonthclub.com mymemosamples.com hospitalitysalesrepresentatives.com"
+for d in $DOMS; do
+  root="/var/www/parked-landers/$d"
+  [ -f "$root/index.html" ] || { echo "SKIP $d (no index.html uploaded)"; continue; }
+  conf="/etc/nginx/sites-available/$d.conf"
+  if [ ! -f "$conf" ]; then
+    cat > "$conf" <<CONF
+server {
+    listen 80;
+    listen [::]:80;
+    server_name $d www.$d;
+    root $root;
+    index index.html;
+    location / { try_files \$uri \$uri/ /index.html; }
+}
+CONF
+    ln -sf "$conf" "/etc/nginx/sites-enabled/$d.conf"
+    echo "created vhost: $d"
+  else
+    echo "vhost exists (left as-is): $d"
+  fi
+done
+nginx -t && systemctl reload nginx
+# TLS (fixes the wrong-cert state). --nginx manages the :443 block safely.
+for d in $DOMS; do
+  certbot --nginx --non-interactive --agree-tos -m info@designerwallcoverings.com \
+    --redirect -d "$d" -d "www.$d" || echo "certbot FAILED for $d (check www DNS / rate limit)"
+done
+nginx -t && systemctl reload nginx
+EOF
+```
+
+## Step 3 — verify (run from Mac2)
+```
+! for d in protectyourspec.com cannabisofthemonthclub.com hempofthemonthclub.com marijuanaofthemonthclub.com potofthemonthclub.com weedofthemonthclub.com mymemosamples.com hospitalitysalesrepresentatives.com; do printf "%-38s " "$d"; curl -sSI "https://$d/" -o /dev/null -w "%{http_code}\n"; echo | openssl s_client -servername "$d" -connect "$d":443 2>/dev/null | openssl x509 -noout -subject 2>/dev/null; done
+```
+Expect: `200` + cert `subject=CN=<the domain itself>` (not inflationfears.com etc.).
+
+## UNDO (per domain, reversible)
+```
+! ssh root@45.61.58.125 'd=<domain>; rm -f /etc/nginx/sites-enabled/$d.conf /etc/nginx/sites-available/$d.conf; nginx -t && systemctl reload nginx'
+```
+(Uploaded files in `/var/www/parked-landers/$d` and the issued cert are harmless to leave; `certbot delete --cert-name $d` if you want it gone.)
+
+## Assumptions to confirm before firing
+1. Kamatera nginx uses `sites-available` + `sites-enabled` (Debian/Ubuntu default). If it uses `conf.d`, adjust paths.
+2. `www.<domain>` also resolves to Kamatera (needed for the `-d www.$d` cert SAN). If any `www` doesn't resolve, drop the `-d www.$d` for that domain or certbot will fail it.
+3. Placeholders ship as-is; swap real images later by replacing tiles in each `sites/<domain>/index.html` and re-running Step 1.
← 0d82403 8 noindex for-sale landers for thin/broken-cert parked domai · back to Parked Landers · auto-data-snapshot: 2026-09-09T11:42:56 (1 data files) — .gi f83f71c →