`SCOPE-tools-public.md`

64 lines
# SCOPE — Make individual DW tools independently public (TK-10016)

**Status:** scope only, nothing deployed. Each publish is a per-tool gated call for Steve.

## The goal
Today the hub (tools.designerwallcoverings.com) is public, but the tools it links to
run on the Mac Studio (tailnet IP 100.82.17.107). Launch links only work from a
tailnet-connected device. Making a tool "independently public" = deploy it to Kamatera
so its own URL (e.g. `recolor.designerwallcoverings.com`) works from anywhere.

## The crux — publish by WRITE-SURFACE, not blanket
Grep of the tool sources shows they split into three risk tiers. **Do not blanket-deploy
all 20.** A tool that mutates the live Shopify store is a bigger blast radius on a public
URL than a client-side image utility.

### Tier 1 — SAFE to publish (low effort, recommend yes)
Pure utilities: no live-Shopify writes, no/È read-only data. Just need a pm2 process +
basic-auth gate + subdomain (same recipe we just used for the hub).
| Tool | Framework | Notes |
|---|---|---|
| Duplicate & Recolor v1.4 | node | No Shopify mutations, no DB dep. Cleanest candidate. |
| Search by Color Wheel | static/next | No mutations, reads a color API. |
| 150 DPI + Spoonflower flow | node | No Shopify mutations; **reads dw_unified** → point at Kamatera-local PG. |

### Tier 2 — PUBLISH WITH CARE (medium effort, per-tool gate)
Call paid APIs (Gemini) and may write metafields/tags. Publishable behind hard auth, but
each needs: secrets on Kamatera (via /secrets fan-out), a cost guard, and confirm the
write scope before exposing.
- Kravet / Thibaut / Philippe Romano Taggers, DW Style Tag Updater
- Image→Room Setting, Room Setting App (Gemini image gen = metered)

### Tier 3 — KEEP TAILNET-ONLY (do NOT broadly publish)
These **write to the production Shopify store** and/or drive bulk catalog mutations.
Recommend they stay tailnet-only (reachable from the hub on your devices) or, if truly
needed public, add an IP-allowlist on top of basic-auth.
- **ImportNewSkufromURL** — hits `/admin/api/*/products` (creates/updates live products), needs DATABASE_URL + PG. (Also carries a `shpat_REDACTED` placeholder → must wire a real token via /secrets before it runs at all.)
- Schumacher / Architectural / Maya Romanoff updaters, VendorDashboard-V2 — bulk vendor writes.
- pm2-dashboard / system-dashboard — expose infra state; keep internal.

## Shared deploy pattern (per tool, reused from the hub go-live)
1. `/secrets` fan-out → put the tool's real env on Kamatera (never the hardcoded/redacted values).
2. rsync tool → `/root/Projects/<tool>`; `pm2 start` on a fixed Kamatera-local port; `pm2 save`.
3. Next.js tools need `npm run build` on Kamatera first (Tier 1/2 has 3 Next apps).
4. DNS A record (proxied) `<tool>.designerwallcoverings.com` → 45.61.58.125 (**zone now 196/200 — ~4 slots; publishing many tools will hit the 200 cap → free retired records or move to a `/tool-path` reverse-proxy under the hub instead of N subdomains**).
5. nginx IP-bound :443 vhost → `proxy_pass 127.0.0.1:<port>`; LE cert via **grey-cloud → webroot certonly → re-proxy** (the CF-proxy HTTP-01 workaround we already hit).
6. Basic-auth gate on every tool (Tier 1 tools currently have NONE of their own) + open `/healthz`.

## Effort estimate
- Tier 1 (3 tools): ~30–45 min each. **Recommend doing these first as the proof.**
- Tier 2 (6 tools): ~1 hr each (secrets + cost guard + build).
- Tier 3: not recommended public; ~0 (leave as-is) unless Steve wants IP-allowlisted exposure.

## Cap consideration
20 tools × 1 subdomain each would blow the 200-record CF cap. Two paths:
- **A (recommended):** reverse-proxy the safe tools UNDER the hub as paths
  (`tools.designerwallcoverings.com/recolor`, `/colorwheel`, `/150dpi`) — **zero new DNS
  records**, one cert, one auth gate. Needs each app to support a base-path (Next apps: `basePath`).
- **B:** one subdomain per tool — simpler per app, but burns DNS slots fast.

## Recommendation
Start with **Tier 1 via Path-A reverse-proxy** (3 safe tools mounted under the existing
hub, no new DNS, one auth gate). Prove it with **Duplicate & Recolor v1.4** first. Hold
Tier 2 for a per-tool go, and keep Tier 3 tailnet-only.