From e743de33c03577fc18c0aadcff430eaedbf5d660 Mon Sep 17 00:00:00 2001
From: jedi <git@m.j3d1.de>
Date: Mon, 17 Aug 2026 03:19:34 +0200
Subject: [PATCH] stash

---
 deploy/prod/README.md    |  7 +++++--
 deploy/prod/playbook.yml | 15 +++++++--------
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/deploy/prod/README.md b/deploy/prod/README.md
index e879ede..3befd7e 100644
--- a/deploy/prod/README.md
+++ b/deploy/prod/README.md
@@ -51,8 +51,11 @@ toolshed:
   in `user@yourtoolshed.tld`) — see [DNS](#3-dns) for how those two relate.
 - `toolshed_handle_domain` — the **handle domain**, only needed when it's
   different from `toolshed_domain`. Omit it when the two are the same (it
-  then defaults to `toolshed_domain`). Set so nginx/Django accept requests
-  for either domain, whichever ends up as the `Host` header.
+  then defaults to `toolshed_domain`). It doesn't affect nginx/Django at all
+  (they only ever accept `toolshed_domain` as the `Host` header) — it's used
+  solely to populate the `/local/domains` registration fixture (see
+  `toolshed_register_domains` below); publishing the SRV record is a
+  separate, manual DNS step either way.
 - `toolshed_repo_url` — the git remote the playbook checks out and builds
   from. Required, no default.
 - `toolshed_version` — the branch, tag or commit to check out and build.
diff --git a/deploy/prod/playbook.yml b/deploy/prod/playbook.yml
index 455d5fd..852fdea 100644
--- a/deploy/prod/playbook.yml
+++ b/deploy/prod/playbook.yml
@@ -73,15 +73,14 @@
     # header instead.
     toolshed_x_forwarded_proto: >-
       {{ '$http_x_forwarded_proto' if (behind_tls_proxy | default(false) | bool) else '$scheme' }}
-    # The web domain (toolshed_domain, mandatory) and the handle domain
-    # (toolshed_handle_domain, optional - defaults to the web domain when
-    # they're the same) both need to be accepted by nginx/Django, since
-    # either may show up as the Host header depending on how the admin set
-    # up DNS for this deployment. Deduplicated so setting them equal
-    # doesn't produce a repeated entry.
+    # Only the web domain (toolshed_domain) - nginx server_name, Django
+    # ALLOWED_HOSTS, and the cert certbot requests. The handle domain
+    # (toolshed_handle_domain) is resolved by clients via its own SRV record
+    # and doesn't necessarily have an A record pointing at this host at all
+    # (see the README's DNS section), so it can't reliably serve an HTTP-01
+    # challenge or ever show up as this nginx's Host header.
     toolshed_hostnames: >-
-      {{ [toolshed_domain | mandatory('toolshed_domain must be set as a host_var for ' ~ inventory_hostname),
-          toolshed_handle_domain | default(toolshed_domain)] | unique }}
+      {{ [toolshed_domain | mandatory('toolshed_domain must be set as a host_var for ' ~ inventory_hostname)] }}
     # Generated once per host on the controller and reused on every
     # subsequent run against that host, keyed by inventory_hostname so
     # separate deployments never end up sharing a Django SECRET_KEY.