Current Nginx Shape

Relevant relik server block:

server {
    listen 80;
    server_name relik.africa www.relik.africa;
    root /mnt/relik-site;
    index index.html;
    location / {
        try_files $uri $uri/ =404;
    }
}

Relevant slates / CryptPad listener:

server {
    listen 127.0.0.1:80;
    server_name slates.relik.africa slates-sandbox.relik.africa;
    ...
    location / {
        proxy_pass http://127.0.0.1:3000;
    }
}

Historical routing caveat, fixed on 2026-05-20:

• Cloudflare tunnel routes relik.africa / www.relik.africa to http://localhost:80.
• Before the fix, localhost resolved into the more-specific 127.0.0.1:80 listener, whose default behavior was the slates/CryptPad server block.
• Fix applied: /etc/nginx/sites-available/relik now includes listen 127.0.0.1:80; in addition to listen 80;.
• Backup created before the fix: /etc/nginx/sites-available/relik.bak-20260520T210526Z.
• Verified after the fix:
  • curl -H 'Host: relik.africa' http://127.0.0.1 returned the static /mnt/relik-site page.
  • curl -H 'Host: relik.africa' http://100.121.185.70 returned the static /mnt/relik-site page.
  • curl -I https://relik.africa and curl -I https://www.relik.africa returned static RELiK HTML through Cloudflare.
  • curl -H 'Host: slates.relik.africa' http://127.0.0.1 still returned CryptPad/slates headers.

Deployment implication:

• The current static RELiK site routing is no longer blocked.
• A future TSUKIMI live deploy still needs a deliberate deployment step: choose whether to replace /mnt/relik-site, switch Nginx root to a new web root, or serve a dedicated app port and adjust Cloudflare tunnel ingress.
• Test future changes with:
  • curl -H 'Host: relik.africa' http://127.0.0.1
  • curl -H 'Host: relik.africa' http://100.121.185.70
  • curl -I https://relik.africa