karti-ai
ba9d7c874e
The site is demo.primeintellectgrowth.com and nothing else. The Caddy block, the deploy smoke test, the mirrored Caddyfile and the docs all carried the second name; all four no longer do.
Deploying
Static build, rsynced to cloud-2, served by Caddy.
pnpm build && bash deploy/deploy.sh
The pieces
| Hostname | demo.primeintellectgrowth.com — the only one |
| Host | cloud-2, ubuntu@100.92.185.76 (tailnet only) |
| Root | /var/www/demo.primeintellectgrowth.com |
| Snapshots | …-rollbacks/, last 10, hard-linked |
| DNS | OCI zone primeintellectgrowth.com → 170.9.14.61, explicit A record, no wildcard |
| Caddy | one block, mirrored in Caddyfile.demo |
The trap that costs an afternoon
bind 10.0.0.2 is mandatory in the Caddy block, and its absence is silent.
Without it Caddy builds a second server on *:443 that has never heard of this
hostname. Public traffic — which NATs to 10.0.0.2 — falls through to an empty
200 behind a perfectly valid certificate. Worse, a
curl --resolve demo.primeintellectgrowth.com:443:127.0.0.1 from cloud-2 itself
still passes.
deploy.sh therefore smoke-tests the real public hostname from the deploying
machine and fails on a response under 1 kB.
Do not use PIG's deploy/Caddyfile.example as a template — it omits the bind.
Rolling back
ssh ubuntu@100.92.185.76
ls -1dt /var/www/demo.primeintellectgrowth.com-rollbacks/*/
sudo rsync -a --delete <that-dir>/ /var/www/demo.primeintellectgrowth.com/
No Caddy reload needed; the root path does not change.
Editing the live Caddyfile
Scope the edit to this site's block. Several sites on cloud-2 carry
byte-identical header strings, so a naive global replace hits two of them. Slice
between demo.primeintellectgrowth.com { and the next hostname, and assert the
match is unique inside that slice.