step3/WEB_DEPLOYMENT.md

Browser Pre-Alpha Deployment

The browser build is served at https://doctor.ranaze.com. Gitea builds and deploys the Web image to the step3-web Kubernetes namespace on every push to main. The service is exposed on NodePort 30089.

Cloudflare

Create a proxied doctor DNS record that targets the same public endpoint as the existing s3q and pauth records. Keep SSL/TLS mode consistent with those working services and redirect HTTP to HTTPS.

Traefik

Create three routers for doctor.ranaze.com, ordered by priority:

1. Host(doctor.ranaze.com) && PathPrefix(/api/Auth) routes to the same backend service used by pauth.ranaze.com.
2. Host(doctor.ranaze.com) && PathPrefix(/api) routes to the Kubernetes nodes on port 30088, the Questions API NodePort.
3. Host(doctor.ranaze.com) routes to the Kubernetes nodes on port 30089, the Web game NodePort.

Do not strip any prefixes. Give the auth router the highest priority, the general API router the next-highest priority, and the Web router the lowest. Reuse the existing HTTPS entrypoint, certificate resolver, load-balancing node list, and HTTP-to-HTTPS middleware.

Verification

After DNS and Traefik are configured:

curl -fsS https://doctor.ranaze.com/healthz
curl -i -X OPTIONS https://doctor.ranaze.com/api/Auth/login
curl -i -X OPTIONS https://doctor.ranaze.com/api/questions/search

The health endpoint must return ok. Open the site in a desktop browser and verify registration or login, question loading, images, answer submission, ratings, and question reporting. Browser requests must remain on doctor.ranaze.com; requests to pauth.ranaze.com or s3q.ranaze.com indicate that the Web origin resolver did not run.