# Websites deploy / provision agent (runs on websites VM: /opt/websites-agent)
#
# Endpoints (X-Deploy-Token):
#   POST /deploy     { slug }                    — git pull + build + pm2 restart
#   POST /provision  { slug, host, gitRepoUrl }  — clone + nginx + ecosystem + allowlist (no certbot)
#   POST /ssl        { host, slug? }             — certbot for apex + www (nginx must exist)
#   GET  /health
#
# Env (.env): PORT, DEPLOY_TOKEN, ALLOWED_SLUGS
#
# Note: provision.sh intentionally skips certbot. SSL is issued via POST /ssl so
# Edit/Add Domain does not hang when www DNS is wrong.