task: deploy the relay to the VPS with real DNS and TLS

[tucktuck101]

Parent PRD

#2

Objective

Bring up the Buzz relay on the cohort VPS at a real hostname with TLS terminated, so that wss://<domain> is reachable from outside the host.

Definition of done

• Docker Engine and Compose v2.24.4 or newer are installed on the VPS, with versions recorded — the VPS inventory shows neither is currently present
• deploy/compose/ is running with BUZZ_COMPOSE_TLS=true and a Let's Encrypt certificate issued by Caddy
• A DNS record for the chosen hostname resolves to the VPS from a network outside it
• https://<domain> returns NIP-11 JSON and /health returns 200, both fetched from a machine that is not the VPS, with raw output pasted
• A plaintext ws:// connection attempt to the public endpoint is shown to fail
• The hostname is seeded in communities following the bootstrap runbook, and the runbook is corrected if reality differed from it
• BUZZ_DOMAIN and BUZZ_MEDIA_SERVER_DOMAIN are set to the real hostname, replacing the buzz.example.com placeholders
• Membership gating is confirmed live by behaviour before the URL is shared with anyone — a non-rostered pubkey is refused against the public endpoint
• BUZZ_IMAGE is pinned to a sha- tag rather than main
• Secrets are generated on the host and appear in no tracked file

Impacted components

deploy/compose/     deployed as-is from the repo
launchpad/deploy/   runbook corrections found during the real deployment
DNS                 one A/AAAA record for the cohort hostname

Out of scope

• Hardening the host. Firewall, SSH policy, unattended upgrades and service confinement are all # prd-03 — reproducible and hardened Buzz deployment: rebuild the cohort server from a bare Ubuntu host #5.
• Configuration management. This deployment may be manual; making it reproducible is # prd-03 — reproducible and hardened Buzz deployment: rebuild the cohort server from a bare Ubuntu host #5.
• Backups, monitoring and capacity planning, per the non-goals in prd 0 - Deploy the relay to a VPS and verify two people can log in #2.
• The two-person verification itself.

---

_{Filed by an AI agent (Claude Opus 5) on behalf of @tucktuck101 as part of a decomposition of #2. Drafted, not executed. The absence of Docker on the target VPS was read from a hardware and system inventory supplied by @tucktuck101, not from the host directly. Environment variable names were read from deploy/compose/.env.example and deploy/compose/compose.yml.}

[tucktuck101]

Done. The relay is deployed and serving at wss://launchpad-buzz.devacademy.nz with real DNS and TLS on 443 — verified 2026-08-21: NIP-11 answers over HTTPS, and a desktop client completed NIP-42 auth over wss:// and loaded 6 channels.

_{Closed by an AI agent (Claude Opus 5) on the explicit instruction of @tucktuck101, who confirmed the stack is up, hardened, and has no work remaining.}