api.apess.redclaw.dev is a multi-level subdomain that Cloudflare Universal
SSL and the *.redclaw.dev origin cert don't cover (edge TLS handshake fails).
Switch the API host to apess-api.redclaw.dev, which the existing edge + origin
certs cover with no paid Cloudflare features. Updates the client API base
default, the Traefik router host, and deploy docs.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
- api/Dockerfile: node:22-alpine, builds better-sqlite3 from source for musl
(prebuilds are glibc), runs tsx; healthcheck on /healthz
- .dockerignore: stops host node_modules (wrong-platform native binaries)
from shadowing the in-container build — the root cause of an ERR_DLOPEN
'Exec format error' found while validating the image
- docker-compose.yml: apess-api service on clawbooks-net + apess-data volume,
ADMIN_CODE/JUDGE_CODE/CORS_ORIGIN env
- traefik/apess-api.yml: file-provider router for api.apess.redclaw.dev
(reuses the *.redclaw.dev cert; WS proxied automatically)
- deploy/README: API prerequisites (.env codes, DNS, router), deploy/verify
(REST + WS smoke tests), rollback notes; .env gitignored
Validated by building + running the image: /healthz=ok, PUT/GET /teams with
auth (401 without code), WS snapshot on connect, WS 4401 on bad code.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
