`DEPLOY.md`

82 lines
# VenturaClaw — Go-Live Deployment

**Target:** `venturaclaw.com` → Kamatera (45.61.58.125) → port 9788, fronted by nginx + Cloudflare proxy.

## ✅ Done locally
- Express server live on `127.0.0.1:9788` (pm2 id varies; name `ventura-claw`)
- Admin/user login working: `admin@venturaclaw.com / admin` and `demo@venturaclaw.com / demo`
- 67 connectors served, audit log + approval queue functional
- pm2 dump saved (will resurrect on reboot)

## 🚧 Remote steps (require your explicit go-ahead)

### 1. Cloudflare DNS — A record (proxied)
Run in your CF MCP / dashboard:
- Zone: `agentabrams.com`
- Type: `A`
- Name: `venturaclaw`
- Value: `45.61.58.125`
- Proxy: ON (orange cloud)
- TTL: Auto

### 2. Push the app to Kamatera
From this Mac:
```bash
rsync -av --delete --exclude node_modules --exclude data \
  ~/Projects/business-claw/server/ \
  root@45.61.58.125:/root/public-projects/ventura-claw/

ssh root@45.61.58.125 'cd /root/public-projects/ventura-claw && \
  npm install --omit=dev --silent && \
  CC_SECRET=$(openssl rand -hex 32) PORT=9788 PUBLIC_DOMAIN=venturaclaw.com \
  pm2 start server.js --name ventura-claw --update-env --time && \
  pm2 save'
```

### 3. nginx site (Kamatera)
```bash
ssh root@45.61.58.125 'cat > /etc/nginx/sites-available/venturaclaw.com <<NGINX
server {
  listen 80;
  server_name venturaclaw.com;
  location / {
    proxy_pass http://127.0.0.1:9788;
    proxy_http_version 1.1;
    proxy_set_header Host \$host;
    proxy_set_header X-Real-IP \$remote_addr;
    proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto \$scheme;
    proxy_read_timeout 60s;
  }
}
NGINX
ln -sf /etc/nginx/sites-available/venturaclaw.com /etc/nginx/sites-enabled/
nginx -t && systemctl reload nginx'
```

### 4. SSL — Cloudflare proxy = origin doesn't need a real cert (Flexible mode acceptable for v1).
For Full(Strict) later:
```bash
ssh root@45.61.58.125 'certbot --nginx -d venturaclaw.com -n --agree-tos -m info@agentabrams.com'
```

### 5. Smoke test
```bash
curl -sI https://venturaclaw.com/healthz
curl -s  https://venturaclaw.com/login | grep -o '<title>.*</title>'
```

### 6. Per Steve's standing rule: dedupe sites-enabled
```bash
ssh root@45.61.58.125 'ls -la /etc/nginx/sites-enabled/ | grep -E "\.(bak|old)$"'
# remove any *.bak / *.old to avoid silent routing collisions
```

## Production checklist (Steve's rules)
- [x] info@<domain> surfaced — footer says `info@agentabrams.com` (umbrella). Add MX/forwarder for `info@venturaclaw.com` if you want a dedicated mailbox.
- [ ] Verify nginx proxy_pass port 9788 matches pm2 PORT after deploy
- [ ] Test admin + user login + a chat-triggered approval flow end-to-end
- [ ] Add to `~/cncp-starter/cncp-config.json` domains[]
- [x] CC_SECRET = openssl-random per env (NOT the dev default)
- [ ] Rotate `admin@venturaclaw.com` password to a real one before public traffic