Wire custom domain postkit.singletonsd.com to production Function App

[patoperpetua]

Goal

Bind postkit.singletonsd.com as the public HTTPS hostname for production Function App ssd-postkit-api-prod-ae, so consumers call a stable branded API URL instead of *.azurewebsites.net.

Context

• Subscription SSD Post Kit / 9b6fc2b1-064a-4eb2-81fe-0aa8c7c751b5, RG rg-postkit-prod-ae
• App is Linux Consumption (Y1) Node 22 today — custom domains are CNAME-based; managed cert support can be flaky on classic Consumption. Prefer completing on current plan; if Azure blocks managed TLS, document the blocker and the smallest plan change (e.g. Flex Consumption) as a follow-up issue rather than silently abandoning the hostname.
• DNS for singletonsd.com is Route53 hosted zone Z2PHDBJIVYBXRT. Use skill engineering/route53-subdomains (load company.secrets.env; never invent zone IDs).
• Custom domain verification ID (for asuid TXT): obtain via az functionapp show --query customDomainVerificationId (do not hardcode stale values).

Scope

1. DNS (Route53):
   • asuid.postkit.singletonsd.com TXT = Function App customDomainVerificationId
   • postkit.singletonsd.com CNAME → ssd-postkit-api-prod-ae.azurewebsites.net
2. Azure: bind hostname + HTTPS (App Service Managed Certificate / SNI if supported on this plan).
3. App Configuration ssd-postkit-appcs-prod-ae: set live key app:api:publicBaseUrl to https://postkit.singletonsd.com (this key is consumer-facing; Function App does not need it as an app setting).
4. Repo: update infra/appconfig-seed.json and docs that still teach the azurewebsites public base URL as source of truth (docs/integrations/inkads-marketing.md, infra/README.md / SETUP.md only if they state the public URL).
5. Smoke: curl -fsS https://postkit.singletonsd.com/health returns ok; TLS valid.

Out of scope

• Do not edit infra/function-app.bicep CORS (cors.allowedOrigins) — owned by the sibling CORS/consumer-onboarding issue.
• Do not change contact delivery / email provider behaviour.
• Do not migrate the plan unless required for TLS; if required, stop after hostname/DNS and open a follow-up issue.

Constraints

• Public repo: no secrets in issues/PRs/commits.
• Worktree from origin/main via ./scripts/add-worktree.sh --issue <N> --type feat --slug postkit-custom-domain.
• Claim by opening a PR with Closes #<N>; abort if an open linked PR already exists.

Acceptance criteria

• postkit.singletonsd.com resolves (CNAME) to the Function App
• Hostname is bound on the Function App with working HTTPS
• GET https://postkit.singletonsd.com/health succeeds
• Live App Config app:api:publicBaseUrl is https://postkit.singletonsd.com
• Seed + docs updated; PR opened with Closes #<N>
• Comment on the issue with verification curls (no secrets)

Agent notes

Read docs/github-source-of-truth.md, AGENTS.md, and engineering/route53-subdomains. Keep azurewebsites hostname working as fallback.

[patoperpetua]

Verification (#145)

DNS

• postkit.singletonsd.com CNAME → ssd-postkit-api-prod-ae.azurewebsites.net (Route53 INSYNC)
• asuid.postkit.singletonsd.com TXT present (domain ownership)

Azure

• Hostname bound on ssd-postkit-api-prod-ae
• Managed cert issued; SSL state: SniEnabled

Health

$ curl -fsS https://postkit.singletonsd.com/health

HTTP 200

App Config

• Live app:api:publicBaseUrl = https://postkit.singletonsd.com
• Seed + docs updated in linked PR

Azurewebsites hostname left as fallback.

[patoperpetua]

Follow-up verification

Health body (earlier comment caught a transient local DNS miss during scripting):

$ curl -fsS https://postkit.singletonsd.com/health
{"status":"ok","service":"post-kit-api"}
HTTP 200

PR: #147