yolo: nginx conf → HTTP-only bootstrap (fix certbot first-deploy deadlock: nginx -t was failing on nonexistent certs before certbot runs)

e21e204614b073f19451ed14a4b37eceaf7d3b75 · 2026-07-25 11:29:24 -0700 · Steve

Files touched

M deploy/sound.agentabrams.com.nginx

Diff

commit e21e204614b073f19451ed14a4b37eceaf7d3b75
Author: Steve <steve@designerwallcoverings.com>
Date:   Sat Jul 25 11:29:24 2026 -0700

    yolo: nginx conf → HTTP-only bootstrap (fix certbot first-deploy deadlock: nginx -t was failing on nonexistent certs before certbot runs)
---
 deploy/sound.agentabrams.com.nginx | 27 +++++++--------------------
 1 file changed, 7 insertions(+), 20 deletions(-)

diff --git a/deploy/sound.agentabrams.com.nginx b/deploy/sound.agentabrams.com.nginx
index 4280b3b..2711a5e 100644
--- a/deploy/sound.agentabrams.com.nginx
+++ b/deploy/sound.agentabrams.com.nginx
@@ -1,5 +1,12 @@
 # sound.agentabrams.com — Agent Abrams SoundLab (public static sound hub)
+# HTTP-only BOOTSTRAP conf: nginx -t must pass on a first deploy BEFORE any cert
+# exists so certbot's HTTP-01 challenge can complete. `certbot --nginx` (deploy.sh
+# step 4) then injects the `listen 443 ssl` block, the ssl_certificate lines, and
+# the 80->443 redirect itself. Do NOT hardcode ssl_certificate paths here — that
+# reintroduces the bootstrap deadlock (nginx -t fails on the missing cert before
+# certbot ever runs, and set -euo pipefail aborts the whole deploy).
 server {
+    listen 45.61.58.125:80;
     server_name sound.agentabrams.com;
 
     access_log /var/log/nginx/sound.agentabrams.com.access.log;
@@ -15,24 +22,4 @@ server {
     location / {
         try_files $uri $uri/ $uri.html =404;
     }
-
-    listen 45.61.58.125:443 ssl; # managed by Certbot
-    ssl_certificate /etc/letsencrypt/live/sound.agentabrams.com/fullchain.pem; # managed by Certbot
-    ssl_certificate_key /etc/letsencrypt/live/sound.agentabrams.com/privkey.pem; # managed by Certbot
-    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
-    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
-
 }
-
-server {
-    if ($host = sound.agentabrams.com) {
-        return 301 https://$host$request_uri;
-    } # managed by Certbot
-
-
-    listen 45.61.58.125:80;
-    server_name sound.agentabrams.com;
-    return 404; # managed by Certbot
-
-
-}
\ No newline at end of file

← 1de5558 5x: hub report — clean twice (core 6-way, sweeps 2-3); favic · back to Sound Agentabrams · Remove synthwave-visualizer (Outrun) build — killed per Stev 91269ba →