637ac5dfbf
serve.py binds loopback, so prod mirrors godstrument.pro: systemd runs serve.py,
nginx reverse-proxies the domain to 127.0.0.1:8147, certbot for TLS. Adds
deploy/{solargod.service, nginx-solargod.conf, deploy.sh, HERALD.md}. BLOCKED on
the user: domain/DNS + VPS access (Part ω.2). Nothing deployed — artifacts only.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
29 lines
1.5 KiB
Markdown
29 lines
1.5 KiB
Markdown
# HERALD — deploying SOLARGOD
|
|
|
|
SOLARGOD is a static site + a stdlib `serve.py` that also proxies JPL
|
|
(Horizons/SBDB/CAD) and disk-caches responses. `serve.py` binds **127.0.0.1 only**,
|
|
so production is the same shape as godstrument.pro: **systemd runs serve.py on the
|
|
loopback, nginx reverse-proxies the public domain to it, certbot adds TLS.**
|
|
|
|
## What this directory gives you
|
|
- `solargod.service` — systemd unit (`python3 serve.py 8147` in `/opt/solargod`).
|
|
- `nginx-solargod.conf` — nginx server block → `127.0.0.1:8147` (replace `SOLARGOD_DOMAIN`).
|
|
- `deploy.sh` — one-shot rsync + install + enable + reload (idempotent; re-run to update).
|
|
|
|
## One-time
|
|
```sh
|
|
DOMAIN=orrery.example.com VPS=user@vps-host ./deploy/deploy.sh
|
|
ssh $VPS 'sudo certbot --nginx -d orrery.example.com'
|
|
```
|
|
|
|
## ⚠ Blocked on you (cannot be done from the dev box)
|
|
1. **Domain / DNS** — pick the hostname and point an A record at the VPS. (I don't
|
|
have your DNS or a chosen name — the whole lane waited on this per Part ω.2.)
|
|
2. **VPS access** — the `VPS=user@host` with sudo, on the same box that serves
|
|
godstrument.pro (so the reverse-proxy pattern matches).
|
|
3. Confirm Python 3 + nginx + certbot are present on the VPS (they are for godstrument).
|
|
|
|
Give me the domain + VPS target and I'll run `deploy.sh` and verify the live site
|
|
(orrery loads, planets move, `/verify.html` green, `/proxy/*` reaches JPL). Until
|
|
then these artifacts are prepared but **not applied** — nothing has been deployed.
|