Run 72 failed with "Bad owner or permissions on /root/.ssh/config" (a
loose umask or a reused HOME on the runner). Same fix as thaiai b59230e:
umask 077, a fresh config, chmod 600 on config and known_hosts.
cnxvinyl.lol moves from s1 to bkk01 (cnx-network-clan, TODO section 18,
docs/src/s1-migration.md). After the rsync to s1 the job uploads
site/dist as site.tar.gz, generic package B4L/cnxvinyl.lol, version
<UTC time>-<commit>, as b4l-ci (organization secrets REGISTRY_USER and
REGISTRY_TOKEN); the package event makes bkk01 fetch it. s1 stays the
live server until DNS moves; then the SSH steps and VPS_* secrets go.
cnxvinyl.lol's zone now lives in cnx-network-clan (ns1/ns2.cnx.network),
pointing straight at s1; mail is on mx1. Live once the nameservers at
Porkbun are switched.
- site/Caddyfile mirrors what s1 runs (checked 2026-10-23): no
cloudflare_only or security_headers imports; Caddy gets its own certs.
- deploy-site.yml: drop the Cloudflare cache purge step and its secrets.
- site/README.md and digital-factory.md: DNS and certificate notes.
User, 19 Oct 2026: build a high-end investor pitch deck; the whole
plant, web slides on the test site with presenter mode plus a PDF,
12 to 15 slides, both plans, for a BOI / bank / institutional reader.
- docs/pitch/index.html (site /pitch/): title, opportunity, the chain
under one roof, how a record is made (9 stages, 3 gates, traceability,
ERPNext), platform, site and building, sustainability and region,
investment A vs B by block with the six levers (no contingency in
either price), operating picture with the adverse case, ten-year cash
and returns (calculator presets), BOI promotion and the 3:1
debt-to-equity condition (financing structure to be agreed), schedule,
risks, team and vendors, the ask (phase 0 then tranches).
- Every figure carries a source line (business plans draft 0.3 and the
owning docs); speaker notes per slide; P opens a synced presenter
window, O the overview, F fullscreen, #n deep links.
- img/: six WebP pictures (calculator renders, order tool, fan funding,
record passport); CNX-Vinyl-Investor-Deck.pdf, 15 pages 16:9, images
re-encoded to 1.5 MB.
- site/build.sh copies docs/pitch/ to /pitch/ (new DIRS list); the
deploy also triggers on docs/pitch/**; landing page and README entries.
- Checks: 15 slides at 1920/1440/1280/390 px without overflow, navigation,
presenter sync both ways, PDF pages and text, no em dashes.
A first run failed with "Permission denied (publickey)": s1 accepts only
the blog key (deploy@s1.b4l.co.th, SHA256:o4w7HL...) for the deploy user,
and the secret held a different key. The SSH step now strips CR, refuses
a secret that is not an unencrypted private key, and logs the key's
fingerprint for comparison with authorized_keys. The ssh host alias is
renamed so the masked VPS_USER value no longer hides it in the log.
site/ builds the internal test site: public/ served as is (landing page,
robots.txt, static sites) plus demo pages copied out of docs/ (the plant
operation page at /demos/plant-operation/). build.sh fails on dead
internal links and stamps version.txt.
.gitea/workflows/deploy-site.yml rsyncs site/dist to the buildfor.life
web server with the blog's two-directory rename swap, checks version.txt
on the server, purges Cloudflare when a token is set, and checks the
public URL. Secret names match the blog's workflow.
site/Caddyfile is the virtual host to append on s1 (noindex everywhere,
Cloudflare-only like the blog apex, www redirect). site/README.md has the
one-time setup: DNS, Caddy, web root, secrets, runner.
grabowski