amadan
Move to fichas.oficina.works
The custom hostname is attached to the fichas.bds.oncarlos.com route, its certificate issued, and FICHAS_ORIGIN now names it. The platform hostname still answers as the route underneath, but sign-in links and keymail's client_id carry the canonical name, so sessions land there. Recorded in the README because both waits were longer and quieter than expected: the certificate took about 45 minutes with `carlos domains list` saying issuing-cert and giving no guidance, and the list still said issuing-cert after HTTPS was serving. The origin must not move until HTTPS actually answers on the new name, and the way to know is curl, not the list.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+18
−9
README.md+18 −9
CI passed — run details
CI log
=== vet === go vet ./... === fmt === === test === go test ./... ? amadan.net/oficina/fichas/cmd/fichas [no test files] ok amadan.net/oficina/fichas/internal/fichas (cached) ? amadan.net/oficina/fichas/internal/fichas/icons [no test files] ok amadan.net/oficina/fichas/internal/fichas/seal (cached) ok amadan.net/oficina/fichas/internal/fichastest (cached) === migration-check === go run github.com/carlosframework/rastrillo/cmd/rastrillo migration check rastrillo migration check: models and migrations agree
diff --git a/README.md b/README.md| index 2ac497f..afceb40 100644 |
| --- a/README.md |
| +++ b/README.md |
| @@ -149,12 +149,21 @@ origin. |
| ## Live |
| -**https://fichas.bds.oncarlos.com** — account `bds`, channel `edge`. |
| -Sign in with an address in `FICHAS_OWNERS`. |
| - |
| -`FICHAS_ORIGIN` is that platform hostname, not `fichas.oficina.works`. It |
| -is the CSRF yardstick and the base of every emailed sign-in link, so it has |
| -to be the host the browser is actually on — pointing it at a name that does |
| -not resolve yet would send every link into the void. memoria made the same |
| -move in the other direction once its certificate issued, and its README |
| -records why being precise about this matters. |
| +**https://fichas.oficina.works** — account `bds`, channel `edge`. Sign in |
| +with an address in `FICHAS_OWNERS`. |
| + |
| +`fichas.bds.oncarlos.com` still answers. It is the platform route the |
| +custom hostname sits in front of, not a second deployment, and signing in |
| +there still *starts* — but `FICHAS_ORIGIN` is the base of every sign-in |
| +link and the `client_id` keymail validates against, so the flow lands you |
| +on `oficina.works` and the session is set for that host. Use the canonical |
| +name. memoria made the same move, and its README says why being precise |
| +about it matters. |
| + |
| +The hostname was attached on 2026-09-27 and the certificate took about 45 |
| +minutes to issue, with `carlos domains list` reporting `issuing-cert` and |
| +no guidance throughout. **Do not switch `FICHAS_ORIGIN` until HTTPS |
| +actually answers on the new name**: until then every emailed link points at |
| +a host that fails the TLS handshake. The list's STATE column also lags — |
| +it still said `issuing-cert` after HTTPS was serving — so check with curl, |
| +not with the list. |