Approved plan (operator Approve, 2026-09-07) for Surmount Server.
Contract
/domains must list every Namecheap-updated Host from the same config lists the edge already uses (static_vhosts, primary/mail/services hostnames, extra mail hostnames). cryptoquick.com HTTPS must use the same Let's Encrypt certificate and Host functions that already work for surmount.systems. Code function reuse. One certificate, not a second issuance.
Status at issue open (2026-09-08)
- Inventory union is in the tree. Live guest
/domains still needs the operator just deploy-host switch (agents dry-run only unless overridden). Dry-run already ran.
- Laptop Let's Encrypt
--issue ran from this laptop (Namecheap env already present). The certificate this host presents now includes cryptoquick.com, www.cryptoquick.com, exophiles.org, and www.exophiles.org (20 names). Live HTTPS 200 without -k for those names.
Approved plan text
See the session plan titled "Namecheap zones on /domains and one production leaf for cryptoquick web" (title uses old wording; say names on the Let's Encrypt certificate this host presents).
Reuse Host lists. Keep source: "config". Union primary trio, derived www and mta-sts, every static_vhosts key, extra mail hostnames (mail.cryptoquick.com). Nix emits SURMOUNT_EXTRA_MAIL_HOSTNAMES. Do not query Namecheap or Stalwart from the VPS UI.
Git-flow branch for remaining UI deploy work: feature/domains-inventory-union. Agents never sign and never push. After the operator signs and pushes, the agent opens the PR.
No secrets, IPs, tokens, or PEM material in this issue.
Approved plan (operator Approve, 2026-09-07) for Surmount Server.
Contract
/domainsmust list every Namecheap-updated Host from the same config lists the edge already uses (static_vhosts, primary/mail/services hostnames, extra mail hostnames).cryptoquick.comHTTPS must use the same Let's Encrypt certificate and Host functions that already work forsurmount.systems. Code function reuse. One certificate, not a second issuance.Status at issue open (2026-09-08)
/domainsstill needs the operatorjust deploy-hostswitch (agents dry-run only unless overridden). Dry-run already ran.--issueran from this laptop (Namecheap env already present). The certificate this host presents now includescryptoquick.com,www.cryptoquick.com,exophiles.org, andwww.exophiles.org(20 names). Live HTTPS 200 without-kfor those names.Approved plan text
See the session plan titled "Namecheap zones on /domains and one production leaf for cryptoquick web" (title uses old wording; say names on the Let's Encrypt certificate this host presents).
Reuse Host lists. Keep
source: "config". Union primary trio, derived www and mta-sts, everystatic_vhostskey, extra mail hostnames (mail.cryptoquick.com). Nix emitsSURMOUNT_EXTRA_MAIL_HOSTNAMES. Do not query Namecheap or Stalwart from the VPS UI.Git-flow branch for remaining UI deploy work:
feature/domains-inventory-union. Agents never sign and never push. After the operator signs and pushes, the agent opens the PR.No secrets, IPs, tokens, or PEM material in this issue.