Move to dedicated regress.atobitcoin.io subdomain

DNS now exists for the subdomain, so retired the podsteadr.atobitcoin.io/regress/
path-prefix arrangement in favor of a clean root deployment on its own
domain: real Let's Encrypt cert (certbot certonly --webroot, same method
as podsteadr's own cert), independent nginx server blocks, no more
ROUTE_PREFIX/VITE_BASE needed for the live deploy (though still supported
and tested for future use elsewhere). Removed the now-dead /regress/
location from podsteadr's own nginx config.

README.md

@@ -60,24 +60,37 @@ npm test
 
 ## Deployment
 
-Live at **`https://podsteadr.atobitcoin.io/regress/`** — same public host as
-[podsteadr](http://146.59.87.168:3000/ssmithx/podsteadr), reached via a path
-prefix under the existing domain/cert rather than its own subdomain (no DNS
-access to add one). Migrated here from an earlier `archy-x250-dev3` trial
-deploy (Tailscale-only Archipelago node) — see git history for that phase.
+Live at **`https://regress.atobitcoin.io`** — own subdomain, own Let's
+Encrypt cert (`certbot certonly --webroot`, same box/method as podsteadr's
+cert), same host (`23.182.128.130`) as
+[podsteadr](http://146.59.87.168:3000/ssmithx/podsteadr) but fully
+independent nginx server blocks. Deployed at root (no `ROUTE_PREFIX`/
+`VITE_BASE`) now that it has its own domain — simpler than the path-prefix
+setup below, which was a temporary measure before DNS for the subdomain
+existed. Migrated here from an earlier `archy-x250-dev3` trial deploy
+(Tailscale-only Archipelago node), then briefly lived at
+`podsteadr.atobitcoin.io/regress/` before the subdomain was added — see git
+history for both phases.
 
 - Single container (`Dockerfile`, server + built frontend in one image),
   `podman run --restart unless-stopped`, data bind-mounted at
   `/var/lib/archipelago/regress-data` on the host, internal port **8199**
   (bound to `127.0.0.1` only — nginx is the only way in).
-- `deploy/nginx-podsteadr-regress.conf` — the `location /regress/` block
-  added to podsteadr's existing nginx site.
+- `deploy/nginx-regress-domain.conf` — dedicated nginx site
+  (`/etc/nginx/sites-available/regress-domain` on the host), same structure
+  as podsteadr's own site file (HTTP→HTTPS redirect + ACME webroot
+  challenge on 80, `proxy_pass` to `127.0.0.1:8199` on 443).
+- Cert renewal is certbot's standard cron/systemd timer, already running on
+  this host for podsteadr's cert — no extra setup needed, it picks up the
+  new cert automatically.
 
-### Path-prefix deployment (`ROUTE_PREFIX` / `VITE_BASE`)
+### Path-prefix deployment (`ROUTE_PREFIX` / `VITE_BASE`) — not currently used, but still supported
 
-Since `/` on this domain is already podsteadr, Regress needed to support
-being served from a path prefix — this took two coordinated changes, both
-required together:
+The app still supports being served from a path prefix under someone else's
+domain (that's how it briefly ran at `podsteadr.atobitcoin.io/regress/`) —
+kept working and tested in case it's useful again, e.g. for a future
+deployment that doesn't get its own subdomain. Two coordinated changes are
+required together if you use this:
 
 1. **Frontend build**: `VITE_BASE=/regress/` (Vite's `base` config) so built
    asset URLs and the vendored `nostr-provider.js` script tag/data
@@ -111,16 +124,20 @@ container pointed at the copy. No export/import tooling needed — see git
 history for the exact commands used for the archy-x250-dev3 → podsteadr
 machine move.
 
-To redeploy after a code change: `git pull` in
-`/var/lib/archipelago/regress-src` on the host, then:
+To redeploy after a code change (current setup, root deployment on
+`regress.atobitcoin.io`): `git pull` in `/var/lib/archipelago/regress-src`
+on the host, then:
 
 ```bash
-podman build --build-arg VITE_BASE=/regress/ --build-arg ROUTE_PREFIX=/regress \
-  -t localhost/regress:latest .
+podman build -t localhost/regress:latest .
 podman run -d --name regress-app --replace --restart unless-stopped \
   -p 127.0.0.1:8199:8199 \
   -v /var/lib/archipelago/regress-data:/data \
-  -e ROUTE_PREFIX=/regress \
-  -e PUBLIC_URL=https://podsteadr.atobitcoin.io \
+  -e PUBLIC_URL=https://regress.atobitcoin.io \
   localhost/regress:latest
 ```
+
+(If ever redeploying under a path prefix instead, add back
+`--build-arg VITE_BASE=/prefix/ --build-arg ROUTE_PREFIX=/prefix` to the
+build and `-e ROUTE_PREFIX=/prefix` to the run command — see the
+path-prefix section above.)

deploy/nginx-regress-domain.conf

@@ -0,0 +1,40 @@
+# /etc/nginx/sites-available/regress-domain on 23.182.128.130 (same host as
+# podsteadr, but a fully separate nginx site/server_name — not sharing
+# podsteadr's config file). Symlinked into sites-enabled as regress-domain.
+#
+# Cert obtained via: certbot certonly --webroot -w /var/www/html
+#   -d regress.atobitcoin.io
+# (same webroot/method already used for podsteadr's own cert on this host;
+# renews automatically via the existing certbot timer).
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name regress.atobitcoin.io;
+    location /.well-known/acme-challenge/ {
+        root /var/www/html;
+    }
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name regress.atobitcoin.io;
+
+    ssl_certificate /etc/letsencrypt/live/regress.atobitcoin.io/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/regress.atobitcoin.io/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
+
+    location / {
+        proxy_pass http://127.0.0.1:8199;
+        proxy_http_version 1.1;
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}