games: the doors open on games.parodia.dev

pete_games_plan.md

@@ -126,12 +126,30 @@ A multi-session build. This section is the handover; read it before anything els
   a white-on-white verdict pill, a rack that collided with the dealer, and Hit still
   being offered over a table that was being paid out, none of which a Go test can see.
 
+- **Deployed, 2026-07-14.** https://games.parodia.dev is live. What that took, since
+  the shape of it was not quite what this plan guessed:
+  - The edge is **Traefik**, not Caddy (`/mash/traefik/config/provider.yml`, root-owned,
+    file provider so it hot-reloads). The casino needed no router of its own — the
+    existing `pete` router's rule grew a second host:
+    ``Host(`news.parodia.dev`) || Host(`games.parodia.dev`)``, and ACME issued the cert
+    on its own. DNS for the games host already pointed at the box.
+  - Authentik lives at **auth.parodia.dev**, and the app's OAuth2 provider is "Pete News"
+    (pk 12). It now holds both callbacks, strict: news and games. The provider's
+    `redirect_uris` is a list of objects, not strings.
+  - Server config gained `[web.games]` (enabled, host, `matrix_server = "parodia.dev"`)
+    and `web.auth.cookie_domain = ".parodia.dev"`, which is what makes a news sign-in a
+    games sign-in. Old host-only session cookies don't carry over — a signed-in user
+    signs in once more, and after that the session spans both.
+  - **gogobee is not on that box.** It runs on the LAN at `reala@192.168.1.212`, in a
+    screen session, out of `~/gogobee`, and it has no key for its own GitHub remote —
+    deploy it with `ssh -A` so the pull rides your agent. Its escrow loop needs no new
+    config: it is gated on the `FEATURE_PETE_NEWS` / `PETE_INGEST_*` env in `~/.env`
+    that adventure news already set. Restarted, it logs
+    `pete games: escrow loop started interval=3s`.
+
 ### Next, in order
 
-1. **Deploy.** Add the `games.parodia.dev` redirect URI to the `pete` app in Authentik,
+1. Phase 2 (trivia, hangman), 3 (UNO), 4 (hold'em) as below.
-   point Caddy at the same port, set `[web.games]` + `web.auth.cookie_domain` on the
-   server. Nothing else is host-specific.
-2. Then Phase 2 (trivia, hangman), 3 (UNO), 4 (hold'em) as below.
 
 Still open on the table itself, none of it blocking: **split** isn't implemented (the
 engine has no move for it), the felt is roomy at desktop widths with only one seat on