Character codes in typed text; the site and relay at app.kokkoja.com

With the Text tool, Klammertext's codes give letters a keyboard lacks:
^o" is ö, ^s^ ß, ^a1 ā, ^130ED^ a code point of 4 to 6 digits,
^9053 53EF^ a sequence, ^^ a caret, replaced as each code is completed.
The public site and relay moved to app.kokkoja.com; the old name
redirects.  The Markdown documentation is withdrawn from the release
while it is converted to Klammertext; the README's links to it are
stale until then.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/README.md

@@ -4,7 +4,8 @@ A Kokkoja *server* is one machine that does two things for a group of
 users: it runs the relay, which passes the participants' encrypted
 messages, and it serves the client as a web site, so that a guest can
 join by opening a link with nothing installed.  Neither stores anything.
-The first one is Andy's VPS at `kokkoja.andykopra.com`.
+The first one is Andy's VPS, reached at `app.kokkoja.com` (the older
+name `kokkoja.andykopra.com` still works, redirected there).
 
 | On the server              | What it is                                      |
 |----------------------------|-------------------------------------------------|
@@ -15,10 +16,10 @@ The first one is Andy's VPS at `kokkoja.andykopra.com`.
 | nginx site `kokkoja`       | `https://<site>/` serves the client; `wss://<site>/relay` reaches the relay |
 
 The client's `config.json` on the site says
-`{"relay": "wss://kokkoja.andykopra.com/relay", "storage": "browser",
-"site": "https://kokkoja.andykopra.com/"}`: the notebooks of anyone using
+`{"relay": "wss://app.kokkoja.com/relay", "storage": "browser",
+"site": "https://app.kokkoja.com/"}`: the notebooks of anyone using
 the site are kept in their browser.  A host with the local program uses
-the server with `python3 kokkoja.py --relay wss://kokkoja.andykopra.com/relay`;
+the server with `python3 kokkoja.py --relay wss://app.kokkoja.com/relay`;
 the invitation is then a link to the site.
 
 ## Setting up or updating
@@ -38,14 +39,16 @@ denied (publickey)".
 
 Steps a person does, once:
 
-1. DNS: an A record `kokkoja.andykopra.com` pointing at the VPS
-   (82.221.141.89), in cPanel's Zone Editor, since andykopra.com is on
-   the orangewebsite.com nameservers.  Check with
-   `host kokkoja.andykopra.com buffy.ns.orangewebsite.com`.
+1. DNS: an A record `app.kokkoja.com` pointing at the VPS
+   (82.221.141.89), wherever kokkoja.com's DNS is managed (its registrar,
+   or the orangewebsite.com nameservers if delegated there).  The older
+   name `kokkoja.andykopra.com` keeps its A record in cPanel's Zone
+   Editor and is redirected to app.kokkoja.com by nginx.  Check with
+   `host app.kokkoja.com`.
 
 2. TLS, after the name resolves and `deploy.sh` has run once:
 
-       ssh root@vps313847.iceservers.net certbot --nginx -d kokkoja.andykopra.com
+       ssh root@vps313847.iceservers.net certbot --nginx -d app.kokkoja.com -d kokkoja.andykopra.com
 
    certbot adds the TLS listener to the nginx site and turns the plain
    HTTP block into a redirect.  Afterwards `setup_vps.sh` leaves the
@@ -57,7 +60,7 @@ Steps a person does, once:
 
        vps-sentinel --accept
 
-Checks: `https://kokkoja.andykopra.com/config.json` shows the
+Checks: `https://app.kokkoja.com/config.json` shows the
 configuration above; `systemctl status kokkoja-relay` is active;
 `journalctl -u kokkoja-relay -n 20` shows it listening.
 

deploy/deploy.sh

@@ -12,8 +12,8 @@
 set -euo pipefail
 cd "$(dirname "$0")/.."
 server=${KOKKOJA_SERVER:-root@vps313847.iceservers.net}
-site=https://kokkoja.andykopra.com/
-relay=wss://kokkoja.andykopra.com/relay
+site=https://app.kokkoja.com/
+relay=wss://app.kokkoja.com/relay
 
 staging=$(mktemp -d)
 trap 'rm -rf "$staging"' EXIT

deploy/nginx-site.conf

@@ -1,13 +1,14 @@
 # nginx server block for a Kokkoja web site: the client's files at
-# https://kokkoja.andykopra.com/ and the relay at wss://kokkoja.andykopra.com/relay.
+# https://app.kokkoja.com/ and the relay at wss://app.kokkoja.com/relay.
 # Installed by deploy/setup_vps.sh as /etc/nginx/sites-available/kokkoja.
 #
-# This is the plain HTTP form.  certbot --nginx -d kokkoja.andykopra.com
-# adds the TLS listener and turns this block into a redirect.
+# This is the plain HTTP form.  certbot --nginx -d app.kokkoja.com -d
+# kokkoja.andykopra.com adds the TLS listeners and turns the HTTP blocks
+# into redirects.
 
 server {
     listen 80;
-    server_name kokkoja.andykopra.com;
+    server_name app.kokkoja.com;
 
     root /var/www/kokkoja;
     index index.html;
@@ -33,7 +34,22 @@ server {
     # browsers ask whether they have changed rather than keeping old ones.
     add_header Cache-Control "no-cache" always;
     # The client loads nothing from anywhere else, and may not be framed.
-    add_header Content-Security-Policy "default-src 'self'; connect-src 'self' wss://kokkoja.andykopra.com; img-src 'self' blob: data:; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'" always;
+    add_header Content-Security-Policy "default-src 'self'; connect-src 'self' wss://app.kokkoja.com; img-src 'self' blob: data:; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'" always;
     add_header X-Content-Type-Options "nosniff" always;
     add_header Referrer-Policy "no-referrer" always;
 }
+
+# The old name, kept so that bookmarks and links to the SITE still reach
+# it: everything is redirected to app.kokkoja.com.  The browser carries a
+# link's #join fragment across the redirect, so the join page opens; but
+# an invitation made before the move names the old relay inside that
+# fragment, and a WebSocket does not follow the 301 (and the new CSP
+# forbids the old host), so a pre-move invitation opens but cannot
+# connect.  Invitations made from app.kokkoja.com name the new relay and
+# are fine; live invitations are per-session, so none is affected in
+# practice.
+server {
+    listen 80;
+    server_name kokkoja.andykopra.com;
+    return 301 https://app.kokkoja.com$request_uri;
+}

deploy/setup_vps.sh

@@ -12,7 +12,7 @@
 #
 # TLS is the one step left to a person, once the name resolves to this
 # machine (see deploy/README.md):
-#   certbot --nginx -d kokkoja.andykopra.com
+#   certbot --nginx -d app.kokkoja.com -d kokkoja.andykopra.com
 
 set -euo pipefail
 incoming=/opt/kokkoja/incoming