From 267bd1009577a56d537a4c449e868f806e333ca4 Mon Sep 17 00:00:00 2001
From: Ivan Malison <IvanMalison@gmail.com>
Date: Tue, 9 Jun 2026 02:00:29 -0700
Subject: [PATCH] org-agenda-api: point production at railbird-sf

---
 .../agents/skills/org-agenda-api-production/SKILL.md |  2 +-
 dotfiles/agents/skills/org-agenda-api/SKILL.md       |  6 +++---
 nixos/flake/per-system.nix                           |  5 +++--
 nixos/machines/railbird-sf.nix                       |  2 +-
 org-agenda-api/deploy.sh                             | 12 +++++++++++-
 org-agenda-api/justfile                              |  2 +-
 6 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/dotfiles/agents/skills/org-agenda-api-production/SKILL.md b/dotfiles/agents/skills/org-agenda-api-production/SKILL.md
index c396de86..c28dd24b 100644
--- a/dotfiles/agents/skills/org-agenda-api-production/SKILL.md
+++ b/dotfiles/agents/skills/org-agenda-api-production/SKILL.md
@@ -7,7 +7,7 @@ description: Use when investigating production org-agenda-api state, testing end
 
 ## Overview
 
-Access the production org-agenda-api instance at https://colonelpanic-org-agenda.fly.dev/ for debugging, testing, or verification.
+Access the production org-agenda-api instance at https://org-agenda-api.rocket-sense.duckdns.org/ for debugging, testing, or verification.
 
 ## Credentials
 
diff --git a/dotfiles/agents/skills/org-agenda-api/SKILL.md b/dotfiles/agents/skills/org-agenda-api/SKILL.md
index 16387213..45bb7ee5 100644
--- a/dotfiles/agents/skills/org-agenda-api/SKILL.md
+++ b/dotfiles/agents/skills/org-agenda-api/SKILL.md
@@ -11,16 +11,16 @@ HTTP API for org-mode agenda data. Use this skill when you need to query or modi
 
 Get credentials from pass:
 ```bash
-pass show colonelpanic-org-agenda.fly.dev
+pass show org-agenda-api-imalison
 ```
 
-Returns: password on first line, then `user:` and `url:` fields.
+Returns: password on first line. The username is currently `imalison`.
 
 **Note:** The `url` field in pass may be outdated. Use the base URL below.
 
 ## Base URL
 
-`https://colonelpanic-org-agenda.fly.dev`
+`https://org-agenda-api.rocket-sense.duckdns.org`
 
 All requests use Basic Auth with the credentials from pass.
 
diff --git a/nixos/flake/per-system.nix b/nixos/flake/per-system.nix
index 15a9fdae..951a998c 100644
--- a/nixos/flake/per-system.nix
+++ b/nixos/flake/per-system.nix
@@ -85,8 +85,9 @@ in {
       echo ""
       echo "Commands:"
       echo "  just --list             - Show available API commands"
-      echo "  ./deploy.sh <instance>  - Deploy to Fly.io (colonelpanic or kat)"
-      echo "  flyctl                  - Fly.io CLI"
+      echo "  railbird-sf hosts production at https://org-agenda-api.rocket-sense.duckdns.org"
+      echo "  ./deploy.sh <instance>  - Legacy Fly.io deploy; requires explicit opt-in"
+      echo "  flyctl                  - Fly.io CLI for auditing suspended legacy apps"
       echo "  agenix -e <file>        - Edit encrypted secrets"
       echo ""
     '';
diff --git a/nixos/machines/railbird-sf.nix b/nixos/machines/railbird-sf.nix
index d220ad49..21665aa7 100644
--- a/nixos/machines/railbird-sf.nix
+++ b/nixos/machines/railbird-sf.nix
@@ -33,7 +33,7 @@
 
   services.org-agenda-api-host = {
     enable = true;
-    domain = "colonelpanic8.duckdns.org";
+    domain = "rocket-sense.duckdns.org";
     containerImage = orgAgendaApiImageName;
     containerImageFile = orgAgendaApiContainer;
     secretsFile = config.age.secrets.org-api-auth-password.path;
diff --git a/org-agenda-api/deploy.sh b/org-agenda-api/deploy.sh
index 9246fa18..b58931b7 100755
--- a/org-agenda-api/deploy.sh
+++ b/org-agenda-api/deploy.sh
@@ -1,10 +1,20 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# Deploy customized org-agenda-api container to Fly.io
+# Legacy Fly.io deployment for customized org-agenda-api containers.
 # Usage: ./deploy.sh <instance> [flyctl deploy args...]
 # Example: ./deploy.sh colonelpanic
 #          ./deploy.sh kat
+#
+# Production is hosted on railbird-sf via nixos/org-agenda-api-host.nix. Keep
+# this script available for historical recovery, but require an explicit opt-in
+# so normal maintenance cannot accidentally recreate Fly machines.
+if [[ "${ORG_AGENDA_API_ENABLE_LEGACY_FLY_DEPLOY:-}" != "1" ]]; then
+  echo "Fly.io org-agenda-api deployment is decommissioned." >&2
+  echo "Production is https://org-agenda-api.rocket-sense.duckdns.org on railbird-sf." >&2
+  echo "Set ORG_AGENDA_API_ENABLE_LEGACY_FLY_DEPLOY=1 to run this legacy script." >&2
+  exit 1
+fi
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 NIXOS_DIR="$SCRIPT_DIR/../nixos"
diff --git a/org-agenda-api/justfile b/org-agenda-api/justfile
index 3e0ac5b5..7fbb75c1 100644
--- a/org-agenda-api/justfile
+++ b/org-agenda-api/justfile
@@ -1,6 +1,6 @@
 # org-agenda-api commands
 
-base_url := "https://colonelpanic-org-agenda.fly.dev"
+base_url := "https://org-agenda-api.rocket-sense.duckdns.org"
 user := "imalison"
 
 # Get all todos