Fix Art Auctions HTTPS routing on dev2

bin/install.sh

@@ -526,6 +526,51 @@ write_pit_proxy() {
   fi
 }
 
+# Caddy terminates HTTPS on dev2 before requests reach pit.world. Its edge routes
+# are normally generated by cli-tools/dev2-edge, but this site deploy also installs
+# the exact route so the hosts work on their first release. Once dev2-edge carries
+# the route, its generated Caddyfile already contains these hosts and this is a no-op.
+write_pit_caddy() {
+  local source_route="$SCRIPT_DIR/../deploy/auctions.caddy"
+  [ -f "$source_route" ] || return 0
+  local conf=/etc/caddy/Caddyfile backup_dir=/var/backups/pit-world stamp tmp has_root has_art
+  $SUDO test -f "$conf" || return 0
+  need_root "pit.world Art Auctions Caddy route"
+
+  if $SUDO grep -qF 'https://auctions.pit.world, https://art.auctions.pit.world {' "$conf"; then
+    return 0
+  fi
+  has_root=0; has_art=0
+  $SUDO grep -qF 'auctions.pit.world' "$conf" && has_root=1 || true
+  $SUDO grep -qF 'art.auctions.pit.world' "$conf" && has_art=1 || true
+  if [ "$has_root" = 1 ] || [ "$has_art" = 1 ]; then
+    die "$conf already has a partial or differently grouped Art Auctions route"
+  fi
+  $SUDO grep -qF '(edge_tls) {' "$conf" || die "$conf has no edge_tls snippet for the Art Auctions route"
+  $SUDO grep -qF '(edge_proxy) {' "$conf" || die "$conf has no edge_proxy snippet for the Art Auctions route"
+
+  backup_dir=/var/backups/pit-world
+  stamp="$(date -u +%Y%m%dT%H%M%SZ)"
+  tmp="$(mktemp)"
+  cat "$conf" > "$tmp"
+  cat "$source_route" >> "$tmp"
+  $SUDO install -d -m 0700 "$backup_dir"
+  $SUDO cp -a "$conf" "$backup_dir/Caddyfile.$stamp"
+  $SUDO install -m 0644 "$tmp" "$conf"
+  rm -f "$tmp"
+
+  if ! $SUDO /usr/local/bin/caddy validate --config "$conf" --adapter caddyfile >/dev/null 2>&1; then
+    $SUDO cp -a "$backup_dir/Caddyfile.$stamp" "$conf"
+    die "Caddy rejected the Art Auctions route; restored the previous $conf"
+  fi
+  if ! $SUDO systemctl reload caddy; then
+    $SUDO cp -a "$backup_dir/Caddyfile.$stamp" "$conf"
+    $SUDO systemctl reload caddy || true
+    die "Caddy reload failed; restored the previous $conf"
+  fi
+  log "caddy: Art Auctions route loaded for auctions.pit.world and art.auctions.pit.world"
+}
+
 health() {
   local deadline=$(( $(date +%s) + HEALTH_TIMEOUT )) url="http://127.0.0.1:$PORT$HEALTH_PATH"
   log "health: waiting for $url (up to ${HEALTH_TIMEOUT}s)"
@@ -550,6 +595,7 @@ phase_activate() {
   fi
   systemd_mode
   write_pit_proxy
+  write_pit_caddy
   if [ "$SYSTEMD_MODE" = user ] && [ "$(loginctl show-user "$(id -un)" -p Linger --value 2>/dev/null)" != yes ]; then
     loginctl enable-linger "$(id -un)" 2>/dev/null \
       || warn "could not enable linger: $UNIT stops when $(id -un) logs out (run: sudo loginctl enable-linger $(id -un))"

deploy/auctions.caddy

@@ -0,0 +1,9 @@
+# Art Auctions House: both public hostnames are served by the pit.world app.
+https://auctions.pit.world, https://art.auctions.pit.world {
+	import edge_tls
+	request_body {
+		max_size 30MiB
+	}
+	encode gzip
+	import edge_proxy 8787
+}