the place: bikoret.ch — Ingress hosts, TLS, and the .org redirect

bikoret.ch and www.bikoret.ch served with a Let's Encrypt certificate
through cert-manager (letsencrypt-prod, HTTP-01), ssl-redirect on;
bikoret.org and www redirect permanently to https://bikoret.ch; the
no-host catch-all stays; shorashim.ch still answers over plain HTTP
until its callers have moved. KOHEN Day 8 gives the order: A records,
wait for the name to resolve, then apply — never before. Tamid's names
table updated. Doorpost re-pinned.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

KOHEN.md

@@ -463,7 +463,7 @@ kubectl logs -n shorashim deploy/bikoret -c vav-pipeline -f
 
 If the seven days passed without halt events, without Shabbat violations, without manna exhaustion, without any pod restarts:
 
-1. **Point DNS** — `shorashim.ch` A record to the ingress IP (`kubectl get svc -n ingress-nginx ingress-nginx-controller`; `185.19.28.170`). Then add the TLS block noted in `deploy/k8s/service.yaml` — until then `<host>` is that IP over plain HTTP
+1. **Point DNS** — at the registrar, A records to the ingress IP (`kubectl get svc -n ingress-nginx ingress-nginx-controller`; `185.19.28.170`): `bikoret.ch`, `www.bikoret.ch`, and for the redirect `bikoret.org`, `www.bikoret.org`. Wait until `dig +short A bikoret.ch` answers the IP — only then `kubectl apply -f deploy/k8s/service.yaml`: it carries the TLS blocks (cert-manager, `letsencrypt-prod`, HTTP-01), and a certificate asked for before the name resolves burns Let's Encrypt's failed-validation limit. Then `kubectl -n shorashim get certificate` until both are Ready, and callers use `https://bikoret.ch`; `shorashim.ch` still answers over plain HTTP until its callers have moved
 2. **Open the pe'ah endpoint to the world** — the stranger approaches first
 3. **Observe the first real interaction** — a question from outside
 4. If *ki tov*: open courtyard and chatzer endpoints. The system is consecrated.

deploy/k8s/service.yaml

@@ -37,18 +37,14 @@ spec:
 # controller sees the caller and hands it on in X-Real-IP; the pipeline
 # believes that header only from TRUSTED_PROXIES (configmap.yaml).
 #
-# Two rules, one backend:
+# Hosts (2026-10-13, the name): bikoret.ch is the place; www.bikoret.ch
-#   - no host  → the catch-all: http://<ingress-ip>/... works with no DNS
+# and the old shorashim.ch are served too; bikoret.org (second Ingress
-#   - shorashim.ch → ready for the A record (KOHEN.md Day 8). TLS is NOT
+# below) only redirects. TLS from Let's Encrypt through cert-manager's
-#     requested here: asking cert-manager for a certificate before the
+# letsencrypt-prod ClusterIssuer, HTTP-01 — so apply this ONLY after
-#     name resolves only burns Let's Encrypt's failed-validation limit.
+# `dig +short A bikoret.ch` answers 185.19.28.170: a certificate asked
-#     When the record exists add:
+# for before the name resolves only burns the failed-validation limit.
-#       metadata.annotations:
+# The no-host catch-all stays, so http://<ingress-ip>/... keeps working
-#         cert-manager.io/cluster-issuer: letsencrypt-prod
+# with no DNS; with ssl-redirect on, named hosts go to https.
-#         nginx.ingress.kubernetes.io/ssl-redirect: "true"
-#       spec.tls: [{hosts: [shorashim.ch], secretName: shorashim-tls}]
-#     and point callers at https://shorashim.ch — until then the
-#     courtyard keys travel over plain HTTP.
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -57,15 +53,21 @@ metadata:
   labels:
     app.kubernetes.io/name: shorashim
   annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
     # A 71-judge Sanhedrin may deliberate for ten minutes (Construction §2.2).
     nginx.ingress.kubernetes.io/proxy-read-timeout: "620"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "620"
     # The bedikah accepts 65,536 bytes of output and 1 MiB of sources;
     # leave room for the envelope.
     nginx.ingress.kubernetes.io/proxy-body-size: "2m"
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
 spec:
   ingressClassName: nginx
+  tls:
+    - hosts:
+        - bikoret.ch
+        - www.bikoret.ch
+      secretName: bikoret-tls
   rules:
     - http:
         paths:
@@ -76,6 +78,27 @@ spec:
                 name: shorashim
                 port:
                   number: 80
+    - host: bikoret.ch
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: shorashim
+                port:
+                  number: 80
+    - host: www.bikoret.ch
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: shorashim
+                port:
+                  number: 80
+    # The old name, kept until its callers have moved; no certificate asked for it.
     - host: shorashim.ch
       http:
         paths:
@@ -86,3 +109,44 @@ spec:
                 name: shorashim
                 port:
                   number: 80
+---
+# bikoret.org: the stranger's guess, redirected to the place. No service
+# of its own; nginx answers the redirect itself. Add its A records too.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: bikoret-org
+  namespace: shorashim
+  labels:
+    app.kubernetes.io/name: shorashim
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/permanent-redirect: https://bikoret.ch$request_uri
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - bikoret.org
+        - www.bikoret.org
+      secretName: bikoret-org-tls
+  rules:
+    - host: bikoret.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: shorashim
+                port:
+                  number: 80
+    - host: www.bikoret.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: shorashim
+                port:
+                  number: 80

specs/bikoret_tamid.md

@@ -377,7 +377,7 @@ and why, until the kohen moves it:
 |---|---|---|
 | Kubernetes | namespace `shorashim`; Deployment/Service/Ingress `shorashim`; labels `app.kubernetes.io/name: shorashim`; Secrets `shorashim-secrets`, `shorashim-migrate-secrets`, `shorashim-api-keys`, `shorashim-registry`; ConfigMap `shorashim-config` | A Deployment's selector is immutable and a namespace cannot be renamed: moving them is a delete-and-recreate with the secrets re-issued by the kohen (the builder cannot copy secrets). Do it as one cut-over, at a quiet hour, with the manna written first |
 | PostgreSQL | role `shorashim_app`; databases `shorashim` | An existing role in the managed database; renaming it is the kohen's DDL (`ALTER ROLE … RENAME`) and a rotation of `DATABASE_URL` in both secrets |
-| DNS | `shorashim.ch`, `mcp.shorashim.ch`, the issuer mail | The transmitter's domain; whether `bikoret.ch` is taken, bought and pointed is his decision — the Ingress host rule follows it |
+| DNS | `shorashim.ch` (still served, no certificate), `mcp.shorashim.ch`, the issuer mail | `bikoret.ch` and `bikoret.org` were registered 2026-10-13; the Ingress serves `bikoret.ch` + `www` with TLS and redirects `.org` to it (`deploy/k8s/service.yaml`, KOHEN Day 8). The old host stays until its callers have moved |
 | Builder's machine | `~/shorashim` (symlink to `~/bikoret`), `~/shorashim-source-data`, `~/shorashim-operator-notes`, `~/.local/bin/shorashim-rollout` (its name is in a permission rule) | Local paths; the symlink keeps every script and memory pointer working |
 | Gitea | `heaviness510/bikoret` (renamed; the old URL redirects) | — |
 

vav_pipeline/lib/vav_pipeline/doorpost.ex

@@ -180,7 +180,7 @@ defmodule VavPipeline.Doorpost do
   # changes; the update is a deliberate operator commit. A bare
   # hash-update commit (without a corresponding spec change in the
   # same commit) is itself a drift signal.
-  @expected_hash "c963c4fe5076ec713ae12f07618e2606788b1a6b706a426800fab6a0fdd1bcfa"
+  @expected_hash "10735ab4e4280bf35d19d6ed79804c31d5ef199a70a289f455e138085e9cba5d"
 
   @doc "Return the list of files that constitute the category-grade specification."
   @spec files() :: [String.t()]