Document archy-x250-dev3 deployment

Dedicated nginx server block on :8543 (not proxied under the dashboard's
80/443) because the dashboard sets Permissions-Policy: geolocation=()
server-wide, which would silently break Regress's core claim/link
mechanic. Also documents a found-but-not-fixed gap: the dashboard's
app iframe has no allow="geolocation", so the in-dashboard launch path
won't get location access either until that shared component is patched.

README.md

@@ -57,3 +57,50 @@ Map's public API.
 cd server
 npm test
 ```
+
+## Deployment
+
+Live at **`https://archy-x250-dev3.tail08d8f2.ts.net:8543`** (Tailscale-only —
+this node has no public IP, so it isn't reachable from the open internet like
+podsteadr is; anyone playing needs to be on the same tailnet).
+
+- Single container (`Dockerfile`, server + built frontend in one image),
+  `podman run --restart unless-stopped`, data on a bind-mounted volume at
+  `/var/lib/archipelago/regress-data` on the node.
+- Fronted by a dedicated nginx server block, `deploy/nginx-archy-node.conf`,
+  on its own port (**8543**) rather than being proxied under the node's main
+  dashboard (80/443).
+
+  **Why a dedicated port, not `/app/regress/` like other installed apps:**
+  archipelago's own nginx config sets `Permissions-Policy:
+  geolocation=()` server-wide on its 80/443 blocks — inherited by every
+  `location` under them that doesn't set its own `add_header`s. Regress's
+  entire claim/link mechanic depends on `navigator.geolocation`, so being
+  proxied under those blocks would silently break the core game with no
+  clear error. A separate server block sidesteps this entirely and sets
+  `Permissions-Policy: geolocation=(self)` explicitly.
+
+  **Also found, not yet fixed:** the Archipelago dashboard's own app-iframe
+  element (`neode-ui/src/views/appSession/AppSessionFrame.vue`) has no
+  `allow="geolocation"` attribute, so even a geolocation-permitting app would
+  have geolocation blocked by the browser's default iframe permission
+  delegation if launched *inside* the dashboard iframe. This isn't
+  Regress-specific — it'd affect any app needing geolocation. Until that's
+  patched (a shared-component change, out of scope for this deploy), players
+  should open Regress directly (the URL above, or "open in new tab" from the
+  dashboard) rather than through the in-dashboard iframe.
+
+- Non-standard port gotcha: nginx's `$host` variable strips the port before
+  forwarding, which breaks NIP-98 login (`u` tag URL won't match). Use
+  `proxy_set_header Host $http_host;` (preserves the original port) — already
+  set correctly in `deploy/nginx-archy-node.conf`.
+- `PUBLIC_URL` passed to the container must include the `:8543` for the same
+  reason.
+
+To redeploy after a code change: `git pull` in
+`/var/lib/archipelago/regress-src` on the node, `podman build -t
+localhost/regress:latest .`, then `podman run -d --name regress-app --replace
+--restart unless-stopped -p 127.0.0.1:8199:8199 -v
+/var/lib/archipelago/regress-data:/data -e
+PUBLIC_URL=https://archy-x250-dev3.tail08d8f2.ts.net:8543
+localhost/regress:latest`.

deploy/nginx-archy-node.conf

@@ -0,0 +1,27 @@
+server {
+    listen 8543 ssl;
+    listen [::]:8543 ssl;
+    server_name _;
+
+    ssl_certificate /etc/archipelago/ssl/archipelago.crt;
+    ssl_certificate_key /etc/archipelago/ssl/archipelago.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
+
+    # Regress needs browser geolocation for its core claim/link mechanic — the
+    # main archipelago dashboard's server blocks (80/443) set
+    # Permissions-Policy: geolocation=() globally, which would silently break
+    # this feature if Regress were proxied under those. This is a dedicated
+    # server block on its own port specifically so it isn't subject to that.
+    add_header Permissions-Policy "geolocation=(self)" always;
+    add_header X-Content-Type-Options "nosniff" always;
+
+    location / {
+        proxy_pass http://127.0.0.1:8199;
+        proxy_http_version 1.1;
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+    }
+}