Wine2You Platform Setup — Deploy Plan & Sequencing

Platform Setup — Deploy Plan & Sequencing

Context

Three infrastructure deliverables requested by Kris (2026-10-12), assessed against the existing build plan (docs/plans/2026-10-07_core-product-database-buildup.md) and the live Kaneo board:

(a) API endpoint — edge ready, origin pending

Already specified & deployed (no new work):

• ZITADEL (auth) + OpenFGA (authz) + Unkey Cloud (api_wCXvOV7tt) — deployed on contabo1
• Key minting: POST /api/keys via user-mgmt with OpenFGA can_mint_key gate, plaintext once
• Public path design: CF edge → api.wine2you.shop → CF Access service token → Unkey verify

Completed this session:

• ✅ DNS CNAME api.wine2you.shop → wine2you-docs.pages.dev (proxied, CF edge)
  • Resolves to 172.67.190.86 / 104.21.76.62 (CF anycast)
  • Currently placeholder — serves the docs-site 404 until Phase B wires the real origin
  • Comment: W2Y API edge hostname; real origin wired in Phase B

Deferred to Phase B: the origin server (Oracle wine2you-dev-zrh) doesn't exist yet — Payload/Medusa schemas are prerequisites. Once deployed, create a Cloudflare Tunnel on the Oracle box targeting api.wine2you.shop, swap the CNAME to the tunnel UUID, and attach CF Access (service token) + Unkey verify middleware.

Decision (Kris 2026-10-12): spec/DNS now; live endpoint after Phase A.

(b) Docs site — LIVE

Stack: repo Markdown → docs-site/scripts/build.mjs (Node, marked) → static HTML → CF Pages project wine2you-docs → docs.wine2you.shop

Anti-drift anchor: every page links to its GitHub source file (blob/main/docs/...). Content that is not on GitHub cannot ship — CI builds only from main.

What's deployed:

• ✅ CF Pages project wine2you-docs (id b4878216…, wine2you-docs.pages.dev)
• ✅ DNS CNAME docs.wine2you.shop → wine2you-docs.pages.dev (proxied)
• ✅ Custom domain attached, status active, validation active
• ✅ CI workflow .github/workflows/docs-site.yml — builds + deploys on push to main (paths: docs/**, docs-site/**)
• ✅ GitHub repo secrets: CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID
• ✅ Verified live: https://docs.wine2you.shop/ returns 200, nav tree renders, PIM taxonomy page has tables + GitHub source links + seller_price content
• ✅ 11 pages built from 9 markdown sources (index, identity-auth plan, core-product plan, 3 supplier onboarding handouts, notes)

Access gate (pending):

• ❌ Cloudflare Zero Trust Access not enabled on Wine2You account (access.api.error.not_enabled — cannot be enabled via API; needs dashboard "Enable Access")
• ❌ Wine2You CF token (cfat_…) has DNS + Pages only, no Zero Trust scope
• Action required (Kris, one-time): log into Cloudflare dashboard → Wine2You account (be29e8ac…) → Zero Trust → "Enable Access" → create an Access application for docs.wine2you.shop → policy: allow email domains / specific emails / service tokens

Until Access is enabled, the site is publicly reachable (no gate). This matches Kris's requirement: "not public for now, if not CF?" — CF Access is the intended gate.

(c) Deploy-plan analysis

Hosting split (from identity-auth-architecture-deployed.md §5)

Sequence alignment with core DB build plan

The core-product plan defines Phase A step 1 as "author the OpenAPI 3.2 contracts" — the two taxonomy handouts (Wine2You-PIM-Product-API-Taxonomy.md, Wine2You-Order-API-Taxonomy.md) already serve as that spec (committed 75bfb51).

Recommended sequencing:

1. Phase A (now): finalize OpenAPI 3.2 contracts from the taxonomy handouts → Kaneo card blocks create-estate-product-workflow (Kaneo #9)
2. Phase A/B (parallel): docs site stays live and self-updating via CI (already running)
3. Phase B (after schema exists): deploy Payload + Medusa on Oracle → wire CF Tunnel for api.wine2you.shop origin → attach CF Access + Unkey middleware
4. Phase C+: CF Access enabled on docs.wine2you.shop (once Kris clicks "Enable Access")

Risks & blockers

Kaneo cards added

Three cards created on the Wine2You board (ixb5s851kyozzjxvvxmr5x18) as requested:

(Cards created after this doc is written — see session log.)