Document VPS production deployment in README.

Add copy-paste deploy steps matching the NullCart guide, including TLS bootstrap, Let's Encrypt, Tor onion, and updates.

.env.example

@@ -0,0 +1,2 @@
+COMPOSE_PROJECT_NAME=nullcart_promo_prod
+CLEARNET_DOMAIN=nullcart.net

.gitignore

@@ -0,0 +1,3 @@
+.env.prod
+/deploy/certs
+/deploy/certbot/www

README.md

@@ -1,3 +1,129 @@
 # NullCart Promo Website
 
-Static promo landing page for [NullCart](https://git.nobswebdev.com/nobswebdev/nullcart) — HTML and CSS only, zero JavaScript.
+Static promo landing page for [NullCart](https://git.nobswebdev.com/nobswebdev/nullcart) - HTML and CSS only, zero JavaScript.
+
+## Development
+
+No Docker required locally. Open `index.html` in your browser.
+
+## Production
+
+### 1. Requirements
+
+- Ubuntu 22.04+ or similar Linux with Docker Engine and the Compose plugin — follow [Install Docker Engine on Ubuntu](https://docs.docker.com/engine/install/ubuntu/#install-using-the-repository)
+- A domain name pointing at your server (A records for apex and `www`)
+
+### 2. Server setup
+
+Deploy as **root** on the VPS.
+
+Verify:
+
+```bash
+docker compose version
+```
+
+### 3. Clone the repository
+
+```bash
+cd /root
+git clone https://git.nobswebdev.com/nobswebdev/nullcart_promo_website.git nullcart_promo_website
+cd nullcart_promo_website
+```
+
+### 4. Configure environment
+
+```bash
+cd /root/nullcart_promo_website
+cp .env.example .env.prod
+chmod 600 .env.prod
+```
+
+Edit `.env.prod`:
+
+| Variable               | Production value               |
+| ---------------------- | ------------------------------ |
+| `COMPOSE_PROJECT_NAME` | `nullcart_promo_prod`          |
+| `CLEARNET_DOMAIN`      | apex only, e.g. `nullcart.net` |
+
+### 5. Bootstrap TLS certificates
+
+Nginx needs certificate files before it can start on port 443. For the **first** deploy, create a temporary self-signed pair (replaced after Let's Encrypt):
+
+```bash
+./deploy/scripts/bootstrap-certs.sh
+```
+
+After the stack is running, obtain real certificates (step 7).
+
+### 6. Start the stack
+
+```bash
+./deploy/scripts/deploy.sh
+```
+
+Check containers:
+
+```bash
+docker compose --env-file .env.prod -f docker-compose.prod.yml ps
+```
+
+### 7. Issue Let's Encrypt certificates
+
+Remove the temporary bootstrap certificates under `deploy/certs/live/` (Certbot cannot issue into the layout created by `bootstrap-certs.sh`):
+
+```bash
+rm -rf deploy/certs/live/*
+```
+
+Request the real certificate (apex + www):
+
+```bash
+./deploy/scripts/issue-certs.sh --email you@example.com
+```
+
+Reload nginx:
+
+```bash
+docker compose --env-file .env.prod -f docker-compose.prod.yml exec nginx nginx -s reload
+```
+
+#### Automatic renewal
+
+Open root's crontab:
+
+```bash
+crontab -e
+```
+
+Add a weekly job (`/root/nullcart_promo_website` is the standard deploy path):
+
+```cron
+0 3 * * 0 /root/nullcart_promo_website/deploy/scripts/renew-certs.sh >> /var/log/nullcart-promo-cert-renew.log 2>&1
+```
+
+Save and exit the editor. Optional — run once manually to verify:
+
+```bash
+/root/nullcart_promo_website/deploy/scripts/renew-certs.sh
+```
+
+### 8. Tor onion address
+
+```bash
+./deploy/scripts/show-onion.sh
+```
+
+Update onion links in `index.html` if needed, then redeploy:
+
+```bash
+./deploy/scripts/deploy.sh
+```
+
+### 9. Updates
+
+```bash
+./deploy/scripts/update.sh
+```
+
+This pulls the latest code and rebuilds the stack (`deploy.sh`).

deploy/scripts/bootstrap-certs.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ENV_FILE="${ROOT_DIR}/.env.prod"
+
+cd "$ROOT_DIR"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+    echo "Missing ${ENV_FILE}. Copy .env.example to .env.prod and configure it." >&2
+    exit 1
+fi
+
+# shellcheck disable=SC1090
+set -a
+source "$ENV_FILE"
+set +a
+
+if [[ -z "${CLEARNET_DOMAIN:-}" ]]; then
+    echo "CLEARNET_DOMAIN is not set in .env.prod" >&2
+    exit 1
+fi
+
+LIVE_DIR="${ROOT_DIR}/deploy/certs/live/${CLEARNET_DOMAIN}"
+
+if [[ -f "${LIVE_DIR}/fullchain.pem" ]]; then
+    echo "Certificates already exist at deploy/certs/live/${CLEARNET_DOMAIN}" >&2
+    exit 1
+fi
+
+mkdir -p "$LIVE_DIR"
+
+openssl req -x509 -nodes -newkey rsa:2048 -days 1 \
+    -keyout "${LIVE_DIR}/privkey.pem" \
+    -out "${LIVE_DIR}/fullchain.pem" \
+    -subj "/CN=${CLEARNET_DOMAIN}"
+
+echo "Temporary self-signed certificates created at deploy/certs/live/${CLEARNET_DOMAIN}"

deploy/scripts/deploy.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ENV_FILE="${ROOT_DIR}/.env.prod"
+
+cd "$ROOT_DIR"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+    echo "Missing ${ENV_FILE}. Copy .env.example to .env.prod and configure it." >&2
+    exit 1
+fi
+
+docker compose --env-file "$ENV_FILE" -f docker-compose.prod.yml up -d --build
+
+echo "Pruning unused Docker data older than 24h..."
+docker system prune -af --filter "until=24h"

deploy/scripts/issue-certs.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ENV_FILE="${ROOT_DIR}/.env.prod"
+CERTBOT_EMAIL=""
+
+usage() {
+    cat <<EOF
+Usage: $(basename "$0") --email you@example.com
+
+Obtain Let's Encrypt certificates for CLEARNET_DOMAIN and www.CLEARNET_DOMAIN using
+the webroot challenge. Nginx must be running and serving /.well-known/acme-challenge/
+from deploy/certbot/www.
+
+Environment is read from .env.prod (CLEARNET_DOMAIN).
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --email)
+            CERTBOT_EMAIL="$2"
+            shift 2
+            ;;
+        -h | --help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown option: $1" >&2
+            usage >&2
+            exit 1
+            ;;
+    esac
+done
+
+if [[ ! -f "$ENV_FILE" ]]; then
+    echo "Missing ${ENV_FILE}" >&2
+    exit 1
+fi
+
+# shellcheck disable=SC1090
+set -a
+source "$ENV_FILE"
+set +a
+
+if [[ -z "${CLEARNET_DOMAIN:-}" ]]; then
+    echo "CLEARNET_DOMAIN is not set in .env.prod" >&2
+    exit 1
+fi
+
+if [[ -z "$CERTBOT_EMAIL" ]]; then
+    echo "Pass --email for Let's Encrypt registration." >&2
+    usage >&2
+    exit 1
+fi
+
+mkdir -p "${ROOT_DIR}/deploy/certbot/www" "${ROOT_DIR}/deploy/certs"
+
+docker run --rm \
+    -v "${ROOT_DIR}/deploy/certbot/www:/var/www/certbot" \
+    -v "${ROOT_DIR}/deploy/certs:/etc/letsencrypt" \
+    certbot/certbot certonly \
+    --webroot \
+    -w /var/www/certbot \
+    -d "$CLEARNET_DOMAIN" \
+    -d "www.${CLEARNET_DOMAIN}" \
+    --email "$CERTBOT_EMAIL" \
+    --agree-tos \
+    --non-interactive
+
+if [[ ! -f "${ROOT_DIR}/deploy/certs/live/${CLEARNET_DOMAIN}/fullchain.pem" ]]; then
+    echo "Expected certificates at deploy/certs/live/${CLEARNET_DOMAIN}" >&2
+    exit 1
+fi
+
+echo "Certificates issued at deploy/certs/live/${CLEARNET_DOMAIN}"
+echo "Reload nginx: docker compose --env-file .env.prod -f docker-compose.prod.yml exec nginx nginx -s reload"

deploy/scripts/renew-certs.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ENV_FILE="${ROOT_DIR}/.env.prod"
+
+cd "$ROOT_DIR"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+    echo "Missing ${ENV_FILE}" >&2
+    exit 1
+fi
+
+mkdir -p "${ROOT_DIR}/deploy/certbot/www" "${ROOT_DIR}/deploy/certs"
+
+docker run --rm \
+    -v "${ROOT_DIR}/deploy/certbot/www:/var/www/certbot" \
+    -v "${ROOT_DIR}/deploy/certs:/etc/letsencrypt" \
+    certbot/certbot renew \
+    --webroot \
+    -w /var/www/certbot
+
+docker compose --env-file "$ENV_FILE" -f docker-compose.prod.yml exec nginx nginx -s reload
+
+echo "Certificate renewal complete; nginx reloaded."

deploy/scripts/show-onion.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ENV_FILE="${ROOT_DIR}/.env.prod"
+
+cd "$ROOT_DIR"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+    echo "Missing ${ENV_FILE}" >&2
+    exit 1
+fi
+
+docker compose --env-file "$ENV_FILE" -f docker-compose.prod.yml exec tor \
+    cat /var/lib/tor/hs/hostname

deploy/scripts/update.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+
+cd "$ROOT_DIR"
+
+git pull
+
+"${ROOT_DIR}/deploy/scripts/deploy.sh"

deploy/tor/Dockerfile

@@ -0,0 +1,7 @@
+FROM alpine:3.20
+
+RUN apk add --no-cache tor
+
+COPY torrc /etc/tor/torrc
+
+CMD ["tor", "-f", "/etc/tor/torrc"]

deploy/tor/torrc

@@ -0,0 +1,5 @@
+SocksPort 0
+Log notice stdout
+
+HiddenServiceDir /var/lib/tor/hs/
+HiddenServicePort 80 nginx:8080

docker-compose.prod.yml

@@ -0,0 +1,29 @@
+services:
+    nginx:
+        build:
+            context: .
+            dockerfile: nginx/Dockerfile.prod
+        container_name: ${COMPOSE_PROJECT_NAME}_nginx
+        restart: unless-stopped
+        env_file:
+            - .env.prod
+        ports:
+            - '80:80'
+            - '443:443'
+        volumes:
+            - ./deploy/certs:/etc/nginx/certs:ro
+            - ./deploy/certbot/www:/var/www/certbot:ro
+
+    tor:
+        build:
+            context: ./deploy/tor
+        container_name: ${COMPOSE_PROJECT_NAME}_tor
+        restart: unless-stopped
+        volumes:
+            - nullcart_promo.tor.prod.data:/var/lib/tor
+        depends_on:
+            nginx:
+                condition: service_started
+
+volumes:
+    nullcart_promo.tor.prod.data:

nginx/Dockerfile.prod

@@ -0,0 +1,15 @@
+FROM nginx:alpine
+
+RUN apk add --no-cache gettext \
+    && rm /etc/nginx/conf.d/default.conf
+
+COPY index.html /usr/share/nginx/html/
+COPY css/ /usr/share/nginx/html/css/
+COPY assets/ /usr/share/nginx/html/assets/
+
+COPY nginx/conf.d/ /etc/nginx/templates/conf.d/
+COPY nginx/docker-entrypoint.sh /docker-entrypoint.sh
+
+RUN chmod +x /docker-entrypoint.sh
+
+ENTRYPOINT ["/docker-entrypoint.sh"]

nginx/conf.d/clearnet.conf.template

@@ -0,0 +1,27 @@
+server {
+    listen 80;
+    server_name ${CLEARNET_DOMAIN} www.${CLEARNET_DOMAIN};
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name ${CLEARNET_DOMAIN} www.${CLEARNET_DOMAIN};
+
+    ssl_certificate /etc/nginx/certs/live/${CLEARNET_DOMAIN}/fullchain.pem;
+    ssl_certificate_key /etc/nginx/certs/live/${CLEARNET_DOMAIN}/privkey.pem;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+}

nginx/conf.d/onion.conf

@@ -0,0 +1,11 @@
+server {
+    listen 8080;
+    server_name _;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+}

nginx/docker-entrypoint.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+set -eu
+
+export CLEARNET_DOMAIN
+envsubst '${CLEARNET_DOMAIN}' \
+    < /etc/nginx/templates/conf.d/clearnet.conf.template \
+    > /etc/nginx/conf.d/clearnet.conf
+
+cp /etc/nginx/templates/conf.d/onion.conf /etc/nginx/conf.d/onion.conf
+
+exec nginx -g 'daemon off;'