From 84eb2b701e777cd711eb9260333c11a2876db164 Mon Sep 17 00:00:00 2001
From: Benjamin Borbe <benjamin.borbe@gmail.com>
Date: Sun, 18 Oct 2026 20:43:58 +0200
Subject: [PATCH 1/2] nginx: remove driftline.benjamin-borbe.de vhost
 (leaderboard torn down)

---
 nodes/hz.hetzner-1.py | 42 ++++++++----------------------------------
 1 file changed, 8 insertions(+), 34 deletions(-)

diff --git a/nodes/hz.hetzner-1.py b/nodes/hz.hetzner-1.py
index 43c9cf9..cd70a63 100644
--- a/nodes/hz.hetzner-1.py
+++ b/nodes/hz.hetzner-1.py
@@ -122,40 +122,6 @@
                     },
                     'indexes': [],
                 },
-                # driftline online leaderboard (bborbe/driftline server/k8s): the
-                # StatefulSet on nuke-k3s-prod-worker-0 (192.168.178.44) behind the
-                # cluster traefik `web` entrypoint, routed by Host. Only /api/ is
-                # proxied — the server answers /metrics, /setloglevel, /gc, /healthz
-                # and /readiness on the same port, and those must stay internal; the
-                # cluster Ingress routes only /api/ as well. CORS is the server's job
-                # (ALLOWED_ORIGIN), so nginx passes Origin through untouched.
-                'driftline': {
-                    'ip': '159.69.203.89',
-                    'server_names': [
-                        'driftline.benjamin-borbe.de',
-                    ],
-                    'ssl': {
-                        'force': True,
-                        'cert': '/etc/letsencrypt/live/driftline.benjamin-borbe.de/fullchain.pem',
-                        'key': '/etc/letsencrypt/live/driftline.benjamin-borbe.de/privkey.pem',
-                    },
-                    'locations': {
-                        '/': {
-                            'return': '404',
-                        },
-                        '/api/': {
-                            'proxy_pass': 'http://192.168.178.44',
-                            'proxy_http_version': '1.1',
-                            'proxy_set_header Host': '$host',
-                            'proxy_set_header X-Forwarded-Host': '$host:$server_port',
-                            'proxy_set_header X-Forwarded-Server': '$host',
-                            'proxy_set_header X-Forwarded-For': '$remote_addr',
-                            'proxy_set_header X-Real-IP': '$remote_addr',
-                            'proxy_set_header X-Forwarded-Proto': 'https',
-                        },
-                    },
-                    'indexes': [],
-                },
                 'kickstart': {
                     'ip': '159.69.203.89',
                     'root': '/var/lib/kickstart',
@@ -448,6 +414,14 @@
                     'indexes': [],
                 },
             },
+            # driftline leaderboard torn down 2026-10-18 (phase on hold). Its vhost
+            # left the dict above, which only unmanages the file; this deletes it
+            # (with an nginx restart) on a scoped
+            # `bw apply hz.hetzner-1 -o file:/etc/nginx/sites-enabled/driftline.conf`.
+            # Drop the entry once the file is gone.
+            'delete_vhosts': [
+                'driftline.conf',
+            ],
             'htpasswd_files': {
                 # webdav auth_basic user file (user:hash) from TeamVault.
                 '/etc/nginx/webdav.htpasswd': teamvault.password('NqAE5q', site='benjamin-borbe'),

From 239768b4e0d85b325c85b389019a19b81cedf311 Mon Sep 17 00:00:00 2001
From: Benjamin Borbe <benjamin.borbe@gmail.com>
Date: Sun, 18 Oct 2026 20:44:33 +0200
Subject: [PATCH 2/2] nginx: clarify why driftline.conf needs an explicit
 delete

---
 nodes/hz.hetzner-1.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/nodes/hz.hetzner-1.py b/nodes/hz.hetzner-1.py
index cd70a63..860671f 100644
--- a/nodes/hz.hetzner-1.py
+++ b/nodes/hz.hetzner-1.py
@@ -415,8 +415,9 @@
                 },
             },
             # driftline leaderboard torn down 2026-10-18 (phase on hold). Its vhost
-            # left the dict above, which only unmanages the file; this deletes it
-            # (with an nginx restart) on a scoped
+            # left the dict above; only the sites-enabled purge of a full apply would
+            # remove the file, and a full apply is off-limits here (netplan drift).
+            # This item deletes it (with an nginx restart) on a scoped
             # `bw apply hz.hetzner-1 -o file:/etc/nginx/sites-enabled/driftline.conf`.
             # Drop the entry once the file is gone.
             'delete_vhosts': [