SEO Tweaks

scripts/deploy-from-git.sh

@@ -429,6 +429,22 @@ if (( nginx_args_present )); then
   [[ -f "$DEPLOY_PATH/$NGINX_SOURCE" ]] || fail "Nginx config missing from deployment payload: $DEPLOY_PATH/$NGINX_SOURCE"
   [[ -f "$NGINX_COMPOSE_FILE" ]] || fail "Nginx compose file was not found on the server: $NGINX_COMPOSE_FILE"
 
+  # Pre-flight: SSL certificate for onboarding.goodwalk.co.nz must exist before
+  # nginx can reload — the config references this cert path directly.
+  ONBOARDING_CERT="/etc/letsencrypt/live/onboarding.goodwalk.co.nz/fullchain.pem"
+  ONBOARDING_KEY="/etc/letsencrypt/live/onboarding.goodwalk.co.nz/privkey.pem"
+  if [[ ! -f "$ONBOARDING_CERT" || ! -f "$ONBOARDING_KEY" ]]; then
+    fail "SSL certificate for onboarding.goodwalk.co.nz is not present on this server.
+       Expected: $ONBOARDING_CERT
+       One-time setup on the droplet:
+         1. Ensure the DNS A record for onboarding.goodwalk.co.nz points to this server's IP
+         2. Bring nginx up so the ACME webroot is reachable, then obtain the certificate:
+              certbot certonly --webroot -w /var/www/certbot \\
+                -d onboarding.goodwalk.co.nz \\
+                --non-interactive --agree-tos -m info@goodwalk.co.nz
+         3. Re-run this deploy script"
+  fi
+
   MAINTENANCE_HTML_SRC="$DEPLOY_PATH/nginx/maintenance.html"
   MAINTENANCE_LOGO_SRC="$DEPLOY_PATH/nginx/logo.png"
   [[ -f "$MAINTENANCE_HTML_SRC" ]] || fail "Maintenance page missing from deployment payload: $MAINTENANCE_HTML_SRC"