`DEPLOY-RUNBOOK.md`

73 lines
# Deploy runbook — 8 parked-domain landers (Steve-gated)

**Status:** DRAFT — awaiting Steve's go. Mac2 is classifier-blocked from unattended prod SSH, so Steve fires each `!` command in his own session (his `!` prefix runs it and returns output).

## Scope (exactly these 8 — the thin/broken-cert set)
protectyourspec.com · cannabisofthemonthclub.com · hempofthemonthclub.com · marijuanaofthemonthclub.com · potofthemonthclub.com · weedofthemonthclub.com · mymemosamples.com · hospitalitysalesrepresentatives.com

**EXCLUDED (do NOT touch — they already have real content + valid certs):** commercialdesignreps.com · hospitalitydesignreps.com · designerrepresentatives.com · designtradelive.com · wallpapercontractor.com
**SEPARATE (Cloudflare, later):** designerssalesreps.com

## Key facts (verified live 2026-09-09)
- All 8 already resolve `A → 45.61.58.125` (Kamatera) on GoDaddy NS → **NO DNS CHANGE NEEDED.**
- All 8 currently serve a thin page under a **mismatched SSL cert** (e.g. inflationfears.com, 90210rentals.com) → browsers show "Not Secure". `certbot --nginx` per domain **fixes that** as a side effect.
- ⚠️ **No-clobber cert caution** (memory `deploy-fleet-clobbers-certbot-443-blocks`): do NOT push an `:80`-only conf over an existing certbot `:443` block. Let `certbot --nginx` own the 443 server block. This runbook creates a fresh `:80` vhost then lets certbot add 443 — safe.

## Step 1 — upload (run from Mac2)
```
! rsync -az ~/Projects/parked-landers/sites/ root@45.61.58.125:/var/www/parked-landers/
```

## Step 2 — vhost + cert + reload (run on Kamatera, one paste)
```
! ssh root@45.61.58.125 'bash -s' <<'EOF'
set -e
DOMS="protectyourspec.com cannabisofthemonthclub.com hempofthemonthclub.com marijuanaofthemonthclub.com potofthemonthclub.com weedofthemonthclub.com mymemosamples.com hospitalitysalesrepresentatives.com"
for d in $DOMS; do
  root="/var/www/parked-landers/$d"
  [ -f "$root/index.html" ] || { echo "SKIP $d (no index.html uploaded)"; continue; }
  conf="/etc/nginx/sites-available/$d.conf"
  if [ ! -f "$conf" ]; then
    cat > "$conf" <<CONF
server {
    listen 80;
    listen [::]:80;
    server_name $d www.$d;
    root $root;
    index index.html;
    location / { try_files \$uri \$uri/ /index.html; }
}
CONF
    ln -sf "$conf" "/etc/nginx/sites-enabled/$d.conf"
    echo "created vhost: $d"
  else
    echo "vhost exists (left as-is): $d"
  fi
done
nginx -t && systemctl reload nginx
# TLS (fixes the wrong-cert state). --nginx manages the :443 block safely.
for d in $DOMS; do
  certbot --nginx --non-interactive --agree-tos -m info@designerwallcoverings.com \
    --redirect -d "$d" -d "www.$d" || echo "certbot FAILED for $d (check www DNS / rate limit)"
done
nginx -t && systemctl reload nginx
EOF
```

## Step 3 — verify (run from Mac2)
```
! for d in protectyourspec.com cannabisofthemonthclub.com hempofthemonthclub.com marijuanaofthemonthclub.com potofthemonthclub.com weedofthemonthclub.com mymemosamples.com hospitalitysalesrepresentatives.com; do printf "%-38s " "$d"; curl -sSI "https://$d/" -o /dev/null -w "%{http_code}\n"; echo | openssl s_client -servername "$d" -connect "$d":443 2>/dev/null | openssl x509 -noout -subject 2>/dev/null; done
```
Expect: `200` + cert `subject=CN=<the domain itself>` (not inflationfears.com etc.).

## UNDO (per domain, reversible)
```
! ssh root@45.61.58.125 'd=<domain>; rm -f /etc/nginx/sites-enabled/$d.conf /etc/nginx/sites-available/$d.conf; nginx -t && systemctl reload nginx'
```
(Uploaded files in `/var/www/parked-landers/$d` and the issued cert are harmless to leave; `certbot delete --cert-name $d` if you want it gone.)

## Assumptions to confirm before firing
1. Kamatera nginx uses `sites-available` + `sites-enabled` (Debian/Ubuntu default). If it uses `conf.d`, adjust paths.
2. `www.<domain>` also resolves to Kamatera (needed for the `-d www.$d` cert SAN). If any `www` doesn't resolve, drop the `-d www.$d` for that domain or certbot will fail it.
3. Placeholders ship as-is; swap real images later by replacing tiles in each `sites/<domain>/index.html` and re-running Step 1.