`GO-LIVE-RUNBOOK.md`

71 lines
# prestige.agentabrams.com — go-live runbook

**Config approved by Steve 2026-07-04:** Stripe TEST/inquiry (no live charges) · show everything public (1,682, all vision-screened) · full self-contained Kamatera deploy.

## Already done autonomously (local, $0 + $0.108 vision)
- Vision settlement pass on ALL designs: **1,682 served, 12 blocked & excluded** (birds/butterflies/bananas/grapes) — every public design is settlement-cleared.
- `.deploy.conf` written · DB dumped → `data/patterndesignlab-prod.dump` (168K) · assets ready `public/assets/patterns/` (827M).

## Why the last two steps need your hand
- **GoDaddy DNS API is write-restricted** on this account (`list` works, `create` returns "no method to handle request") — the A record must be added in the GoDaddy UI.
- **Prod DB/nginx/cert execution is classifier-gated** (autonomous prod credential/DB/exec is blocked by design) — run the blocks below on the box, or via `! <cmd>`.

---

### 1. DNS — add in GoDaddy UI (dns.godaddy.com → agentabrams.com)
`Type A · Name prestige · Value 45.61.58.125 · TTL 600`  (matches every sibling subdomain)
Verify: `dig +short prestige.agentabrams.com` → `45.61.58.125`

### 2. Push to Kamatera (run on Mac2)
```sh
cd ~/Projects/patterndesignlab
rsync -az --exclude node_modules --exclude .git --exclude .env --exclude 'data/prod-masters' \
  ./ root@45.61.58.125:/root/public-projects/patterndesignlab/
rsync -az public/assets/patterns/ root@45.61.58.125:/root/public-projects/patterndesignlab/public/assets/patterns/   # 827M, one-time
```

### 3. App + DB on Kamatera (ssh root@45.61.58.125)
```sh
cd /root/public-projects/patterndesignlab && npm install --production
sudo -u postgres createdb -O dw_admin patterndesignlab
pg_restore -U dw_admin -h 127.0.0.1 -d patterndesignlab --no-owner --clean --if-exists data/patterndesignlab-prod.dump
cat > .env <<EOF
PORT=9781
PUBLIC=1
PDL_USER=admin
PDL_PASS=DW2024!
PGHOST=127.0.0.1
PGUSER=dw_admin
PGDATABASE=patterndesignlab
PGPASSWORD=<dw_admin prod password>
# STRIPE_SECRET_KEY intentionally unset = inquiry mode, no live charges
EOF
pm2 start server.js --name patterndesignlab && pm2 save
curl -s localhost:9781/api/healthz    # expect {"public":true,"designs":1694,"stripe":"none"}
```

### 4. Nginx + Let's Encrypt (on Kamatera, after DNS resolves)
```sh
cat > /etc/nginx/sites-available/prestige.agentabrams.com <<'NGINX'
server {
  listen 80; server_name prestige.agentabrams.com; client_max_body_size 20m;
  location / {
    proxy_pass http://127.0.0.1:9781;
    proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme;
  }
}
NGINX
ln -sf /etc/nginx/sites-available/prestige.agentabrams.com /etc/nginx/sites-enabled/
nginx -t && systemctl reload nginx
certbot --nginx -d prestige.agentabrams.com --non-interactive --agree-tos -m steve@designerwallcoverings.com --redirect
```

### 5. Verify live
```sh
curl -sI https://prestige.agentabrams.com                 # 200, no auth (PUBLIC=1)
curl -s  https://prestige.agentabrams.com/api/healthz     # {"public":true,"designs":1694,"stripe":"none"}
```

**Still gated after this:** enabling live Stripe (real charges) — currently inquiry-mode only.