# Browser Pre-Alpha Deployment

The browser build is served at `https://doctor.ranaze.com`. Gitea builds and
deploys the Web image to the `step3-web` Kubernetes namespace on every push to
`main`. The service is exposed on NodePort `30089`.

## Cloudflare

Create a proxied `doctor` DNS record that targets the same public endpoint as
the existing `s3q` and `pauth` records. Keep SSL/TLS mode consistent with those
working services and redirect HTTP to HTTPS.

## Traefik

Create three routers for `doctor.ranaze.com`, ordered by priority:

1. `Host(`doctor.ranaze.com`) && PathPrefix(`/api/Auth`)` routes to the same
   backend service used by `pauth.ranaze.com`.
2. `Host(`doctor.ranaze.com`) && PathPrefix(`/api`)` routes to the Kubernetes
   nodes on port `30088`, the Questions API NodePort.
3. `Host(`doctor.ranaze.com`)` routes to the Kubernetes nodes on port `30089`,
   the Web game NodePort.

Do not strip any prefixes. Give the auth router the highest priority, the
general API router the next-highest priority, and the Web router the lowest.
Reuse the existing HTTPS entrypoint, certificate resolver, load-balancing node
list, and HTTP-to-HTTPS middleware.

## Verification

After DNS and Traefik are configured:

```bash
curl -fsS https://doctor.ranaze.com/healthz
curl -i -X OPTIONS https://doctor.ranaze.com/api/Auth/login
curl -i -X OPTIONS https://doctor.ranaze.com/api/questions/search
```

The health endpoint must return `ok`. Open the site in a desktop browser and
verify registration or login, question loading, images, answer submission,
ratings, and question reporting. Browser requests must remain on
`doctor.ranaze.com`; requests to `pauth.ranaze.com` or `s3q.ranaze.com` indicate
that the Web origin resolver did not run.