blackroad-operating-system/ops/WEBSITE_GO_LIVE_RUNBOOK.md

Website Go-Live Runbook Across All Domains

This runbook provides a step-by-step checklist to bring every BlackRoad-owned domain online with the correct website and SSL settings. Use it when activating or restoring service availability.

Prerequisites

• Cloudflare access with permissions to manage DNS and SSL settings for all zones.
• Railway and Vercel access for service URLs listed in CLOUDFLARE_DNS_BLUEPRINT.md.
• Latest deployments of relevant repositories (e.g., blackroad.io, blackroad-prism-console, blackroad-os-core).
• Health checks for each Railway service are green.

Global Activation Steps

1. Confirm DNS Zones

   • Verify each domain is present in Cloudflare and nameservers are set to Cloudflare at the registrar.
   • Confirm SSL mode is Full (strict) and Universal SSL is enabled.

2. Verify Origin Targets

   • For Vercel sites, ensure the production deployment is healthy and the domain is added in Vercel.
   • For Railway services, ensure the *-production.up.railway.app endpoints are reachable and returning HTTP 200 on their health check paths.

3. Apply DNS Records (per domain below)

   • Create/verify CNAME records pointing to the correct Vercel or Railway target.
   • Enable the Cloudflare orange-cloud proxy unless a record is marked as ❌ (grey-cloud/off for internal services).
   • Set TTL to Auto unless otherwise noted.

4. Propagation & Validation

   • Use dig +short <record> to confirm resolution to the expected target.
   • Test HTTPS for each hostname; confirm valid certificates and no redirect loops.
   • Validate content matches the intended site (corporate, OS, docs, console, etc.).

5. Post-Go-Live Monitoring

   • Enable Cloudflare Analytics and set uptime checks per hostname.
   • Set status alerts for 4xx/5xx spikes and SSL errors.

Domain Checklists

Follow these per-domain checklists to bring sites up.

Primary Domains (Phase 1)

• blackroad.systems

  • @ → cname.vercel-dns.com (proxy ✅) — corporate site (repo blackroad.io).
  • www → blackroad.systems (proxy ✅) — www redirect.
  • os → blackroad-os-production.up.railway.app (proxy ✅) — OS interface (repo blackroad-os-core).
  • api → blackroad-api-production.up.railway.app (proxy ✅) — API gateway.
  • console → blackroad-prism-console.vercel.app (proxy ✅) — Prism Console frontend (public UI).
  • prism → blackroad-prism-console.vercel.app (proxy ✅) — Prism Console (repo blackroad-prism-console).
  • operator → blackroad-operator.up.railway.app (proxy ❌) — internal operator (no proxy).
  • lucidia → lucidia-api.up.railway.app (proxy ✅) — Lucidia API.
  • docs → blackboxprogramming.github.io (proxy ✅) — developer docs.
  • Verify MX/TXT records for email remain unchanged.

• blackroad.ai

  • CNAME @ → blackroad.systems (proxy ✅) — primary alias to OS.

• blackroad.network

  • CNAME @ → blackroad.systems (proxy ✅) — developer docs alias.

• blackroad.me

  • CNAME @ → blackroad.systems (proxy ✅) — personal identity alias.

Secondary Domains (Phase 2)

• aliceqi.com — point to lucidia-api.up.railway.app (or current ALICE QI target) with proxy ✅ once service is live.
• blackroadqi.com — point to blackroad-api-production.up.railway.app (proxy ✅) when QI module ships.
• lucidia.earth — point to lucidia-api.up.railway.app (proxy ✅) for narrative experiences.
• blackroadquantum.com — point to the quantum hub service when ready; keep placeholder 301 to blackroad.systems until then.

Tertiary Domains (Phase 3)

• roadwallet.com, aliceos.io — CNAME to blackroad.systems (proxy ✅) as aliases until dedicated services exist.
• blackroadquantum.net, blackroadquantum.info, blackroadquantum.store — hold with 301 to blackroad.systems until respective services launch; set proxy ✅.
• lucidia.studio — CNAME to lucidia-api.up.railway.app (proxy ✅) once creative stack is live.
• blackroad.store — configure to e-commerce service when defined; until then, 301 to blackroad.systems with proxy ✅.

Validation Commands

Use these commands during rollout:

• dig +short os.blackroad.systems
• curl -I https://os.blackroad.systems/health
• curl -I https://prism.blackroad.systems
• curl -I https://docs.blackroad.systems
• Replace hostnames per domain/record to confirm 200s and TLS.

Rollback

• Disable proxy or revert CNAMEs to previous targets in Cloudflare.
• If SSL issues arise, temporarily set SSL mode to Full (not strict) while renewing origin certificates, then restore Full (strict).
• Document any rollback actions in the deployment log.