# Deploying podsteadr-player on podsteadr

Two ways in, one container:

| URL | How .fips feeds load | Installable / offline |
|---|---|---|
| `https://player.atobitcoin.io` | via the host's `/fips/` gateway (`player-domain.conf`) | yes |
| `http://<node-npub>.fips:8097/` | directly, over the device's own FIPS connection | no (plain http) |

The image also carries its own `/fips/` gateway (`nginx.conf`, `njs/fips.js`), used
when the player is opened by LAN address or through a proxy that forwards `/fips/`
to it. It computes each `npub….fips` host's mesh address from the key instead of
using DNS, so it only needs IPv6 egress to the mesh: run the container with podman
`pasta` networking (an IPv4-only bridge network can't reach FIPS). Archipelago's
app manifest does this. Test the address code with:

```sh
podman run --rm -v ./njs:/t:ro --entrypoint njs <image> -p /t /t/fips.test.js
```

## Container

Source lives at `/var/lib/archipelago/podsteadr-player-src` (the path
`restore-podsteadr.sh` restores from at boot):

```sh
cd /var/lib/archipelago/podsteadr-player-src
podman-compose build && podman-compose up -d     # serves :8097
```

## Mesh access

Allow the container's port through the fips0 default-deny baseline, in the
hand-maintained `/etc/fips/fips.d/90-podsteadr.nft`, then reload:

```
tcp dport 8097 accept
```
```sh
sudo nft -f /etc/fips/fips.nft
```

## HTTPS domain + gateway

1. Install only the port-80 server block from `player-domain.conf` as
   `/etc/nginx/sites-available/player-domain`, symlink it into `sites-enabled`,
   `nginx -t && systemctl reload nginx`.
2. `sudo certbot certonly --nginx -d player.atobitcoin.io`
3. Install the full `player-domain.conf`, `nginx -t`, reload.