3 Commits

Include renames

Author	SHA1	Message	Date
grabowski	f6829417a0	Test site: DNS moves to the fleet nameservers, no Cloudflare proxy ... cnxvinyl.lol's zone now lives in cnx-network-clan (ns1/ns2.cnx.network), pointing straight at s1; mail is on mx1. Live once the nameservers at Porkbun are switched. - site/Caddyfile mirrors what s1 runs (checked 2026-10-23): no cloudflare_only or security_headers imports; Caddy gets its own certs. - deploy-site.yml: drop the Cloudflare cache purge step and its secrets. - site/README.md and digital-factory.md: DNS and certificate notes.	2026-10-23 11:01:55 +07:00
grabowski	52bf35f183	Deploy workflow: check the SSH key and log its fingerprint ... A first run failed with "Permission denied (publickey)": s1 accepts only the blog key (deploy@s1.b4l.co.th, SHA256:o4w7HL...) for the deploy user, and the secret held a different key. The SSH step now strips CR, refuses a secret that is not an unencrypted private key, and logs the key's fingerprint for comparison with authorized_keys. The ssh host alias is renamed so the masked VPS_USER value no longer hides it in the log.	2026-10-02 21:14:33 +02:00
grabowski	560d073019	Add the cnxvinyl.lol test site with a Gitea deploy workflow ... site/ builds the internal test site: public/ served as is (landing page, robots.txt, static sites) plus demo pages copied out of docs/ (the plant operation page at /demos/plant-operation/). build.sh fails on dead internal links and stamps version.txt. .gitea/workflows/deploy-site.yml rsyncs site/dist to the buildfor.life web server with the blog's two-directory rename swap, checks version.txt on the server, purges Cloudflare when a token is set, and checks the public URL. Secret names match the blog's workflow. site/Caddyfile is the virtual host to append on s1 (noindex everywhere, Cloudflare-only like the blog apex, www redirect). site/README.md has the one-time setup: DNS, Caddy, web root, secrets, runner.	2026-10-02 20:59:38 +02:00