pages: PAGES_HOST (bind address); a private copy on hb-5 serves the maths site

docs/decisions.md

@@ -45,3 +45,4 @@ Format: date · decision · why. Add at the bottom. Never edit an old entry; sup
 - 2026-10-14 · **One tree: lineage is the factory's shape.** The factory, its ventures and their agents are one tree, read three ways at the same path: keys (lineage), context (`AGENTS.md` · `SKILLS.md` · `DESIGN.md`, inherited down the path) and presence (pages; NIP-05/mailr names). Every org runs the same template at every depth, from its own seed (BIP-85 from its parent's root). Edges are *derived* (the parent holds the child's seed) or *adopted* (the child holds its own root and the parent vouches with a birth certificate); graduation flips derived → adopted. Belts are badges, per seat × skill, and `SKILLS.md` now tracks them per seat. Model only: minting a real root is the operator's call. Details and a spec v0.1 proposal in `docs/lineage.md`. Why: the operator saw the meta repo's nesting, lineage's key tree and the yolo portfolio as one shape, liked graduation as an edge flip, and set belts = badges (#8).
 - 2026-10-14 · **supertestnet.lol is back, and every Cloudflare domain is in the portfolio.** Cloudflare has one account with 8 zones; Boring's token and the dashboard list the same ones. All are now accounted for: macmcp.xyz, persimmons.app, phast.app, phly.cloud, supertestnet.lol, teahub.xyz and well-known.online are listed, and yolopreneur.lol is the list itself. Super Testnet, a browser-local Bitcoin lab, moved from the old Gitea with its history to org `supertestnet`, with repos `app` and `inscriboor` (the signing extension). Pages serves `supertestnet/app#pages`, which is the build that was live. Pages now reads a `_headers` file (Cloudflare Pages style), so the site keeps the CSP and frame headers its Node server used to send. The ledger has 26 entries, and the hero no longer says every venture came off the clock. unicorn.ceo is not the operator's domain; it was only an idea. Four records still point at the dead edge (66.241.124.48 / 2a09:8280:1::19c:1dd0:0): `matcha.`, `maths.`, `notplanned.` and `🫖.teahub.xyz`. That's harmless while the suspended `teahub-gitea` app holds those IPs and certs, but the records must go before that app is deleted. Of the four, only maths.teahub.xyz (the zeta-ball pictures) has its own content; its files are in hb-5 `~/sites/maths` and `matcha/maths`. Temporary token 37 (`supertestnet-20261014`, `teahubxyz`) did the org, repos, hooks and pushes, and is deleted by id right after this push; the table is checked. Why: the operator asked that every domain be in the list.
 - 2026-10-14 · **The four dead teahub.xyz names are gone.** At the operator's word, the records for `matcha.`, `maths.`, `notplanned.` and `🫖.teahub.xyz` (A + AAAA to the dead edge) and the `_acme-challenge` CNAMEs for `maths.` and `notplanned.` were deleted, 10 records in all, through the Cloudflare dashboard session on hb-5. Boring's DNS tool can upsert but not delete. teahub.xyz now holds only the apex (`green-tea`), `mcp.` (`green-tea-mcp`) and the apex ACME CNAME. No other zone points at the old edge, so `teahub-gitea` can be deleted without leaving takeover bait. maths.teahub.xyz's files stay on hb-5 (`~/sites/maths`, `matcha/maths`) for whenever it comes back. Token 38 (`dns-receipt-20261014`) was minted only to push this line and is deleted by id right after; the table is checked. Why: nothing should resolve to an address we no longer hold.
+- 2026-10-14 · **Pages also runs privately on hb-5, and the maths site lives there.** At the operator's word, maths.teahub.xyz stays off the internet and is served on hb-5 only. It's the same `pages/server.py`, run from a checkout in `~/local-pages/teahub` under launchd `xyz.teahub.local-pages` and bound to `127.0.0.1:8093` (new `PAGES_HOST`; prod keeps 0.0.0.0). It reads `matcha/maths` straight from the old local Gitea's storage (`file://`, `safe.directory` through `GIT_CONFIG_*`, no token) and pulls every 30 s: `maths.localhost:8093` → `matcha/maths#main/site/public`. The tea-garden page, which existed only in `~/sites/maths`, is now in the repo (maths 08aeaf2). Token 39 (`localpages-20261014`) pushed this and is deleted by id right after; the table is checked. Why: the operator looks at it in the Mac's browser, and a push to the repo should be all it takes.

pages/README.md

@@ -19,3 +19,12 @@ Files without an extension that start with `<!doctype html` or `<html` are serve
 A `_headers` file at a site's root adds response headers, Cloudflare Pages style: a path line (exact, or ending in
 `*` for a prefix), then indented `Name: value` lines; a later matching rule wins for the same header, and it can
 replace the default `cache-control`. `_headers` itself is never served. supertestnet.lol uses it for its CSP.
+
+## A private copy on hb-5
+
+The same `server.py` also runs on hb-5 for sites that stay off the internet (launchd `xyz.teahub.local-pages`,
+`127.0.0.1:8093`, checkout in `~/local-pages/teahub`). There it reads repositories straight from the old local Gitea's
+storage (`GITEA_URL=file:///Users/git/gitea/data/git/repositories`, with `safe.directory` passed through
+`GIT_CONFIG_*` for each repo), binds loopback (`PAGES_HOST=127.0.0.1`) and pulls every 30 s. First site:
+`maths.localhost:8093` → `matcha/maths#main/site/public`. Chrome resolves any `*.localhost` to the machine itself.
+

pages/server.py

@@ -199,4 +199,5 @@ class Handler(http.server.BaseHTTPRequestHandler):
 if __name__ == "__main__":
     DATA.mkdir(parents=True, exist_ok=True)
     threading.Thread(target=loop, daemon=True).start()
-    http.server.ThreadingHTTPServer(("0.0.0.0", int(os.environ.get("PORT") or 8080)), Handler).serve_forever()
+    bind = os.environ.get("PAGES_HOST") or "0.0.0.0"  # 127.0.0.1 for a private copy (hb-5)
+    http.server.ThreadingHTTPServer((bind, int(os.environ.get("PORT") or 8080)), Handler).serve_forever()