infra(redirect): workwell.os → twh.os 301 redirect container

.github/workflows/deploy-workwell-redirect-mieweb.yml

@@ -0,0 +1,84 @@
+name: Deploy workwell.os redirect (MIEWeb)
+
+# workflow_dispatch-only — this deploys a minimal nginx 301 redirect container
+# so that https://workwell.os.mieweb.org/ → https://twh.os.mieweb.org/.
+# Run this once manually after the GHCR package has been made public.
+# See infra/redirect/README.md for first-time setup steps.
+
+on:
+  workflow_dispatch:
+    inputs:
+      replace_existing:
+        description: Delete and recreate existing MIE containers if the hostnames already exist.
+        required: true
+        default: "false"
+        type: choice
+        options:
+          - "false"
+          - "true"
+
+concurrency:
+  group: deploy-workwell-redirect-mieweb
+  cancel-in-progress: false
+
+env:
+  REGISTRY: ghcr.io
+  REDIRECT_IMAGE: ghcr.io/taleef7/workwell-redirect
+  REDIRECT_HOSTNAME: workwell
+  SITE_ID: 1
+
+jobs:
+  build-redirect:
+    name: Build redirect image
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: ./infra/redirect
+          file: ./infra/redirect/Dockerfile
+          push: true
+          tags: |
+            ${{ env.REDIRECT_IMAGE }}:latest
+            ${{ env.REDIRECT_IMAGE }}:sha-${{ github.sha }}
+
+  deploy-redirect:
+    name: Deploy workwell redirect container
+    runs-on: ubuntu-latest
+    needs: build-redirect
+    env:
+      MIEWEB_API_URL: ${{ secrets.LAUNCHPAD_API_URL }}
+      MIEWEB_API_KEY: ${{ secrets.LAUNCHPAD_API_KEY }}
+      REPLACE_EXISTING: ${{ inputs.replace_existing == 'true' }}
+      CONTAINER_ENV_VARS_JSON: "[]"
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Validate required secrets
+        run: |
+          missing=()
+          [ -z "$MIEWEB_API_URL" ] && missing+=("LAUNCHPAD_API_URL")
+          [ -z "$MIEWEB_API_KEY" ] && missing+=("LAUNCHPAD_API_KEY")
+          if [ ${#missing[@]} -gt 0 ]; then
+            echo "::error::Missing required secret(s): ${missing[*]}"
+            exit 1
+          fi
+
+      - name: Deploy redirect through Create-a-Container API
+        env:
+          CONTAINER_HOSTNAME: ${{ env.REDIRECT_HOSTNAME }}
+          CONTAINER_IMAGE: ${{ env.REDIRECT_IMAGE }}:sha-${{ github.sha }}
+          INTERNAL_PORT: 80
+        run: bash .github/scripts/deploy-mieweb-container.sh

infra/redirect/Dockerfile

@@ -0,0 +1,4 @@
+FROM nginx:1.27-alpine
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+RUN rm -f /etc/nginx/conf.d/default.conf.bak
+EXPOSE 80

infra/redirect/README.md

@@ -0,0 +1,33 @@
+# workwell.os redirect container
+
+Minimal nginx image that issues a `301 Moved Permanently` from
+`https://workwell.os.mieweb.org/` (and any path beneath it) to
+`https://twh.os.mieweb.org/`.
+
+## First-time deploy checklist (manual owner steps)
+
+1. **Make the GHCR package public.**
+   After the first workflow run pushes `ghcr.io/taleef7/workwell-redirect:latest`,
+   go to `https://github.com/Taleef7/workwell/pkgs/container/workwell-redirect` →
+   Package settings → Change visibility → Public.
+   MIE's cluster pulls images anonymously, so the package must be public before
+   the container can start.
+
+2. **Run the workflow.**
+   GitHub Actions → "Deploy workwell.os redirect (MIEWeb)" → Run workflow.
+   For the very first deploy, `replace_existing` should be `false` (default).
+   If the `workwell` hostname already exists in the MIE manager UI from the old
+   non-TWH stack, set `replace_existing: true`.
+
+3. **Verify.**
+   ```
+   curl -I https://workwell.os.mieweb.org/
+   ```
+   Expected: `HTTP/1.1 301 Moved Permanently` with
+   `Location: https://twh.os.mieweb.org/`.
+
+## Image
+
+- Source: `infra/redirect/Dockerfile` + `infra/redirect/nginx.conf`
+- Built image: `ghcr.io/taleef7/workwell-redirect`
+- Base: `nginx:1.27-alpine` (minimal, < 10 MB)

infra/redirect/nginx.conf

@@ -0,0 +1,8 @@
+server {
+    listen 80;
+    server_name _;
+
+    location / {
+        return 301 https://twh.os.mieweb.org$request_uri;
+    }
+}