# Browser Pre-Alpha Deployment

The browser build is served at `https://doctor.ranaze.com`. Gitea builds and
deploys the Web image to the `step3-web` Kubernetes namespace on every push to
`main`. The service is exposed on NodePort `30089`.

## Cloudflare

Create a proxied `doctor` DNS record that targets the same public endpoint as
the existing `s3q` and `pauth` records. Keep SSL/TLS mode consistent with those
working services and redirect HTTP to HTTPS.

## Traefik

Create one `websecure` router with a host rule for `doctor.ranaze.com` and route
it to the Kubernetes nodes on port `30089`, the Web game NodePort. Reuse the existing
certificate resolver, load-balancing node list, and HTTP-to-HTTPS middleware.

The Web container proxies `/api/Auth/*` to `pauth.ranaze.com` and all other
`/api/*` requests to `s3q.ranaze.com`, so Traefik does not need separate API
routers or prefix middleware for this hostname.

## Verification

After DNS and Traefik are configured:

```bash
curl -fsS https://doctor.ranaze.com/healthz
curl -i -X OPTIONS https://doctor.ranaze.com/api/Auth/login
curl -i -X OPTIONS https://doctor.ranaze.com/api/questions/search
```

The health endpoint must return `ok`. Open the site in a desktop browser and
verify registration or login, question loading, images, answer submission,
ratings, and question reporting. Browser requests must remain on
`doctor.ranaze.com`; requests to `pauth.ranaze.com` or `s3q.ranaze.com` indicate
that the Web origin resolver did not run.