ops(deploy): CLOUDFLARED_DIR preflight + fold frontend into core stack

deploy/redeploy.sh

@@ -37,6 +37,23 @@ if [ "$NON_SUCCESS" != "0" ]; then
 fi
 echo "CI green for ${HEAD_SHA}. Proceeding with deploy."
 
-docker compose up -d --build portal orchestrator
+# Preflight: cloudflared reads its tunnel credentials from CLOUDFLARED_DIR (audit
+# M5 replaced a hardcoded home path with this var, defaulting to ./deploy/cloudflared
+# which does NOT hold real creds). If it is unset or holds no credential JSON, the
+# recreate below crash-loops the tunnel on "tunnel credentials file not found" and
+# the public site goes down. Fail fast instead — this exact gap caused a ~3-minute
+# outage on 2026-07-13.
+CLOUDFLARED_DIR_VAL=$(grep '^CLOUDFLARED_DIR=' .env 2>/dev/null | cut -d= -f2- || true)
+if [ -z "$CLOUDFLARED_DIR_VAL" ]; then
+  echo "ERROR: CLOUDFLARED_DIR is not set in .env. cloudflared would not find its tunnel credentials and the tunnel would crash-loop, taking soholink.org down. Set it to the credential dir (the one holding <tunnel-id>.json) and re-run. Aborting." >&2
+  exit 1
+fi
+if ! ls "$CLOUDFLARED_DIR_VAL"/*.json >/dev/null 2>&1; then
+  echo "ERROR: no tunnel-credential JSON found in CLOUDFLARED_DIR=$CLOUDFLARED_DIR_VAL. Aborting before the tunnel would crash-loop." >&2
+  exit 1
+fi
+echo "Preflight OK: tunnel credentials present in $CLOUDFLARED_DIR_VAL."
+
+docker compose up -d --build portal orchestrator frontend
 docker compose up -d --force-recreate cloudflared
 echo "Deploy complete."

docker-compose.yml

@@ -143,6 +143,24 @@ services:
       portal:
         condition: service_healthy
 
+  # Public frontend edge: serves the static landing page at the site root and
+  # reverse-proxies every other path to the portal backend (deploy/frontend/).
+  # cloudflared's soholink.org public-hostname points at frontend:80. Folded
+  # into the core stack (was docker-compose.frontend.yml) so it is managed and
+  # started with the rest — the live homepage no longer depends on a separate
+  # overlay container staying up.
+  frontend:
+    image: nginx:alpine
+    restart: unless-stopped
+    volumes:
+      - ./deploy/frontend/html:/usr/share/nginx/html:ro
+      - ./deploy/frontend/nginx.conf:/etc/nginx/conf.d/default.conf:ro
+    ports:
+      - "127.0.0.1:8088:80"
+    depends_on:
+      portal:
+        condition: service_healthy
+
   cloudflared:
     image: cloudflare/cloudflared:latest
     restart: unless-stopped
@@ -154,6 +172,7 @@ services:
       - ${CLOUDFLARED_DIR:-./deploy/cloudflared}:/etc/cloudflared
     depends_on:
       - nginx
+      - frontend
 
 volumes:
   postgres_data: