Skip to content

Cut over eop.theestablishers.com DNS off Vercel → NAS tunnel + decommission Vercel

Why

Split off from T-073. The app is LIVE on the NAS, and the roofkeeper-nas Cloudflare tunnel has the published-application route eop → http://localhost:3000.

UPDATE 2026-06-20 — the DNS cutover already happened. While resolving the "DNS record already exists" conflict during the Cloudflare step, the eop record got repointed to the tunnel. https://eop.theestablishers.com now serves the NAS app end-to-end (verified: / → 307 → /auth/signin 200, Firebase auth provider, server: cloudflare + cf-ray, no x-vercel-*). So step 1 (repoint) and step 2 (verify) below are DONE. What remains is purely the Vercel-side teardown (steps 3–4). (A stale browser/DNS cache may still show Vercel's old "deployment paused" page — hard refresh / incognito / flush DNS.)

To do

  1. Repoint DNS (Cloudflare → theestablishers.com → DNS → Records): the existing eop record is a CNAME → cname.vercel-dns.com (DNS-only). Either delete it and then re-save the tunnel's Published-application route for eop so Cloudflare auto-creates the proxied CNAME, or edit it to point at the tunnel target <tunnel-uuid>.cfargotunnel.com (same target as the working nas.theestablishers.com CNAME) with Proxied (orange cloud) on.
  2. Verify https://eop.theestablishers.com now serves the NAS app: response has cf-ray, no x-vercel-* headers, and / → /auth/signin (200). /api/auth/providers returns the Firebase credentials provider.
  3. Remove eop.theestablishers.com from the Vercel project's Domains so Vercel stops claiming it.
  4. Decommission Vercel: pause or delete the Vercel project (or leave dormant), and prune any Vercel-only repo config that's now dead (e.g. vercel.json, Vercel-specific env, the Cloud-Run PDF_RENDER_* remote-render path — already excluded from the NAS .env.production). Confirm no preview alias / other domain still depends on the Vercel project before deleting.

Context

  • Tunnel: roofkeeper-nas (the same one fronting nas.theestablishers.com → DSM). See docs/eop-tasks/runbooks/claude-nas-channel.md.
  • NAS deploy details + the live eop-app container: T-073 + docs/deploy/nas-runbook.md.
  • Two other T-073 follow-ups remain separate from this: the wopc/sign pdfjs DOMMatrix SSR error, and the not-yet-deployed bank-login (OCBC) sidecar.

Decision log

2026-06-21 — step 4 (repo-side) done: pruned dead Vercel config

  • ✅ Attestation (Accounting (Diagnostics)): read AGENTS.md (nightly tip 0d04a26a); this is the repo-side half of T-074 step 4 ("prune any Vercel-only repo config that's now dead").
  • Source: Accounting (Diagnostics) · https://claude.ai/code/session_01G58Y71noihrYCDEDMexmea
  • Proposed/approved by: the owner — "Proceed to T-074" (2026-06-21).
  • What changed (repo-side Vercel teardown):
  • Deleted vercel.ts (Vercel config-as-code, read only by the Vercel CLI/build — not imported by app code; grep confirmed zero importers). There is no vercel.json (already absent).
  • Removed the @vercel/config devDependency (its only consumer was vercel.ts); regenerated package-lock.json.
  • Deleted .github/workflows/vercel-cancel-stale.yml (pure Vercel deploy-queue management — moot now that nothing deploys to Vercel).
  • Removed automaticVercelMonitors: true from next.config.ts (Sentry option that only instruments Vercel Cron Monitors; the NAS runs its jobs from GH Actions / DSM, so it was dead config).
  • .env.example: dropped VERCEL_API_TOKEN + the commented VERCEL_ORG_ID/PROJECT_ID/TOKEN; reframed the "VERCEL ENVIRONMENT SETUP" + "Vercel Cron" sections to be host-agnostic (the var lists stay — only the Vercel framing changed). tsc clean; build graph intact.
  • Intentionally left (not mine to touch):
  • .github/workflows/{workspace-auto-match,reconciliation-heartbeat}.yml still mention vercel.ts in comments — those files are owned by the cron-migration task (nightly's T-084, another agent); the stale comment gets cleaned up there. Harmless.
  • services/bank-login-service/* Vercel references (the .vercel.app allowlist + capture artifacts) — that's the separate OCBC sidecar with its own deploy story (T-073 follow-up).
  • Playbook docs (sa-audit-context.md, agent-handover-bookkeeping-reconciliation.md) that mention VERCEL_API_TOKEN as an existing GSM secret — historical/audit context, not runtime config.
  • Still OWNER-ONLY (cannot be done from the repo / this sandbox):
  • Step 3: remove eop.theestablishers.com from the Vercel project's Domains.
  • Step 4 (dashboard): pause/delete the Vercel project. The recurring "Account is blocked" Vercel commit-status on every PR confirms the Vercel↔GitHub integration is still wired (and the account itself is blocked); disconnecting it in the Vercel/GitHub app settings stops that noise.
  • T-074's own caution applies: confirm no preview alias / other domain still depends on the Vercel project before deleting.

2026-06-24 — DONE (owner closed; Vercel-dashboard teardown deemed not concerning)

  • ✅ Attestation (Accounting (Diagnostics)): read AGENTS.md; status close-out.
  • Source: Accounting (Diagnostics) · https://claude.ai/code/session_01G58Y71noihrYCDEDMexmea
  • Verdict: the substantive cutover is done — DNS repointed (steps 1+2, verified: eop.theestablishers.com serves the NAS app, cf-ray, no x-vercel-*), repo-side Vercel teardown done (step 4 repo half, PR #781 / 9c749fce). The only outstanding items were the owner-only Vercel-dashboard actions (step 3: drop the domain from the Vercel project; step 4 dashboard: pause/delete the project).
  • Owner directive (2026-06-24): "Mark T-074 done as the Vercel-dashboard teardown is not concerning for the time being." The Vercel account is already blocked (the recurring "Account is blocked" PR status), so the project is effectively inert; the owner has decided the dashboard cleanup isn't worth tracking. Closing rather than leaving open. If the leftover "Account is blocked" PR noise ever becomes bothersome, disconnecting the Vercel↔GitHub app is the one-click fix (owner-side).