# Deploying podsteadr-player on podsteadr

Two ways in, one container:

| URL | How .fips feeds load | Installable / offline |
|---|---|---|
| `https://player.atobitcoin.io` | via the host's `/fips/` gateway (`player-domain.conf`) | yes |
| `http://<node-npub>.fips:8097/` | directly, over the device's own FIPS connection | no (plain http) |

## Container

Source lives at `/var/lib/archipelago/podsteadr-player-src` (the path
`restore-podsteadr.sh` restores from at boot):

```sh
cd /var/lib/archipelago/podsteadr-player-src
podman-compose build && podman-compose up -d     # serves :8097
```

## Mesh access

Allow the container's port through the fips0 default-deny baseline, in the
hand-maintained `/etc/fips/fips.d/90-podsteadr.nft`, then reload:

```
tcp dport 8097 accept
```
```sh
sudo nft -f /etc/fips/fips.nft
```

## HTTPS domain + gateway

1. Install only the port-80 server block from `player-domain.conf` as
   `/etc/nginx/sites-available/player-domain`, symlink it into `sites-enabled`,
   `nginx -t && systemctl reload nginx`.
2. `sudo certbot certonly --nginx -d player.atobitcoin.io`
3. Install the full `player-domain.conf`, `nginx -t`, reload.