Every Bettter tool now on bettter.us
The 9 Bettter tools on the 2.31.29.205 server now answer on bettter.us names with their own certificates, and all 13 old sslip.io addresses keep working (web pages redirect with path and query; engine APIs keep answering until the platform restarts).
Where the move stands
- New names live
9 bettter.us names, own certificates
- Old web links
301 with path, query, #route
- Engine routes
Platform secrets on new URLs
- Platform restart
Needed; then engines go 308
Engine contract checks passed on the new engine names
Before → after
Before (until 3 Nov)
- ops.2-31-29-205.sslip.io
- 2-31-29-205.sslip.io (+ /trousers/)
- convert-2-31-29-205.sslip.io
- design-builder.2-31-29-205.sslip.io
- design-builder-tech.2-31-29-205.sslip.io
- adapter[-qa].2-31-29-205.sslip.io
- design-builder-tech-engine[-qa].2-31-29-205.sslip.io
After
- ops.bettter.us
- adapter.bettter.us (+ /trousers/)
- convert.bettter.us
- builder.bettter.us
- tech-builder.bettter.us
- engine-adapter[-qa].bettter.us
- engine-tech-builder[-qa].bettter.us
The control room, opened from its old address
Tech builder feedback works on the new name
Every old → new address, checked
Checked 3 Nov 12:18 UTC without following redirects. 401 is the expected basic-auth wall. Browsers keep the #fragment: ops …/#/adapter?cat=trousers and builder …/uniqlo/#method/rules landed on the same route in Chrome.
| Tool | New name → status | Certificate | Old address (deep link) | Old → result |
|---|---|---|---|---|
| Ops dashboard / control room | ops.bettter.us/ → 200 | valid, Let's Encrypt YE1, until 2027-02-01 | ops.2-31-29-205.sslip.io/state.json?probe=1 | 301 → ops.bettter.us/state.json?probe=1 |
| Adaptation review platform (blazers) | adapter.bettter.us/ → 401 | valid, Let's Encrypt YE1, until 2027-02-01 | 2-31-29-205.sslip.io/platform.html?probe=1 | 301 → adapter.bettter.us/platform.html?probe=1 |
| Adaptation review platform (trousers) | adapter.bettter.us/trousers/ → 401 | valid, Let's Encrypt YE1, until 2027-02-01 | 2-31-29-205.sslip.io/trousers/?lang=uk | 301 → adapter.bettter.us/trousers/?lang=uk |
| Old trousers address | adapter.bettter.us/trousers/ → 401 | valid, Let's Encrypt YE1, until 2027-02-01 | trousers-2-31-29-205.sslip.io/?probe=1 | 301 → adapter.bettter.us/trousers/?probe=1 |
| DXF converter | convert.bettter.us/ → 401 | valid, Let's Encrypt YE1, until 2027-02-01 | convert-2-31-29-205.sslip.io/jobs?probe=1 | 301 → convert.bettter.us/jobs?probe=1 |
| Sales design builder | builder.bettter.us/uniqlo/ → 200 | valid, Let's Encrypt YE1, until 2027-02-01 | design-builder.2-31-29-205.sslip.io/uniqlo/?probe=1 | 301 → builder.bettter.us/uniqlo/?probe=1 |
| Sales design builder engine API | builder.bettter.us/v1/health → 200 | valid, Let's Encrypt YE1, until 2027-02-01 | design-builder.2-31-29-205.sslip.io/v1/health?probe=1 | 308 → builder.bettter.us/v1/health?probe=1 |
| Tech design builder lab site | tech-builder.bettter.us/ → 200 | valid, Let's Encrypt YE1, until 2027-02-01 | design-builder-tech.2-31-29-205.sslip.io/pieces.html?probe=1 | 301 → tech-builder.bettter.us/pieces.html?probe=1 |
| Tech builder lab, first address | tech-builder.bettter.us/ → 200 | valid, Let's Encrypt YE1, until 2027-02-01 | dxf-builder.2-31-29-205.sslip.io/fit.html?probe=1 | 301 → tech-builder.bettter.us/fit.html?probe=1 |
| Adaptation engine API (prod) | engine-adapter.bettter.us/adapter-blazers/v1/health → 200 | valid, Let's Encrypt YE2, until 2027-02-01 | adapter.2-31-29-205.sslip.io/adapter-trousers/v1/health?probe=1 | 200 (still serving until the platform restart; then 308) |
| Adaptation engine API (QA) | engine-adapter-qa.bettter.us/adapter-trousers/v1/health → 200 | valid, Let's Encrypt YE2, until 2027-02-01 | adapter-qa.2-31-29-205.sslip.io/adapter-blazers/v1/health?probe=1 | 200 (still serving until the platform restart; then 308) |
| Tech builder engine API (prod) | engine-tech-builder.bettter.us/v1/health → 200 | valid, Let's Encrypt YE1, until 2027-02-01 | design-builder-tech-engine.2-31-29-205.sslip.io/v1/health?probe=1 | 200 (still serving until the platform restart; then 308) |
| Tech builder engine API (QA) | engine-tech-builder-qa.bettter.us/v1/health → 200 | valid, Let's Encrypt YE1, until 2027-02-01 | design-builder-tech-engine-qa.2-31-29-205.sslip.io/v1/health?probe=1 | 200 (still serving until the platform restart; then 308) |
What was done, step by step
- DNS: 9 A records → 2.31.29.205, DNS only (not proxied), so Caddy gets its own Let's Encrypt certificates. The 22 existing records are untouched.
- Caddy: each tool served on its new name next to the old one first. All 9 certificates were issued, then the old web names became redirects. Backup taken before any change.
- App settings: the bug tracker's public URL (invite links), the engines' public URLs (signed result links), the control room's allowed origin, and the tech builder's pages (they treated only *.sslip.io as their own host).
- Old web names: 301 to the new name with path and query; the old sales-builder /v1/* API answers 308. The redirects answer before any password prompt.
- Engine routes: the platform's 4 route secrets now carry the new URLs (URLs only, keys unchanged). Until the restart, the old engine names keep serving.
- References: links in 4 repositories (READMEs, status pages, CLAUDE.md, deploy scripts and Caddy files, dashboard link cards, chat knowledge), one PR per repository, all merged.
Waiting on the platform: restart needed
- Secrets updated, platform restart needed. The 4 engine-route secrets (prod and QA × adapter, tech-builder) now hold the bettter.us URLs; keys unchanged; the previous versions are kept by AWS.
- The platform's ECS backends read them only when a task starts. The prod and QA tasks running now started before the change (11:27 and 10:29 UTC), so they still call the old engine names. Those names keep answering exactly like the new ones.
- Not done here, as instructed: no task-definition edit and no forced deployment. The group chat relays this to the platform session (25801aabd1), which owns ECS.
- After the restart, a watcher on the Chief machine switches each environment's old engine names to 308 redirects. It acts once every running task started after the secret change. It validates and checks the result, and restores the previous files if any check fails. It then waits for the first platform engine job on the new names as evidence. Log: /mnt/data/OperationalLayer/domain-move/engine-switch.log.
Pull requests (all merged into main)
| Repository | PR | What |
|---|---|---|
| BettterAIDesignGenerator | #45 | Bug tracker Caddyfile (adapter.bettter.us + old-name redirects), converter, engine setup --old-host, links, status page |
| BettterAIDesignBuilder | #12 | builder.bettter.us Caddy file (old name: 301; /v1/* 308), deploy DOMAIN, links, status page |
| BettterAIDesignBuilderTech | #9 | tech-builder.bettter.us, site.py same-origin fix, engine deploy (old name kept until the switch), links, status page |
| OperationalLayer | #17 | ops.bettter.us Caddy file, control origin, deploy.sh validation, link cards, status page |
| OperationalLayer | #18 | Ask chat: knowledge base gives the bettter.us links even where old reports quote sslip.io |
Kept as it was, on purpose
- platform.bettter.us and its Amplify settings, the bettter.us site, MX, SPF, DMARC and DKIM records: unchanged (zone diff: 9 added, 0 changed, 0 removed).
- The parked Shopify app (upcycler) stays parked with no new name. The Chief host 49-13-95-174.sslip.io was not touched.
- design-builder-tech.…sslip.io/api/* still answers. Three older pages.dev copies of the tech builder post feedback there cross-origin, and a browser does not follow a redirect for that.
- The bug tracker's preview tool keeps <name>-<ip>.sslip.io names: they need no DNS record. A tech-builder dev engine, if ever deployed, keeps its sslip.io name for the same reason.
- The engine registry in the control room calls the engines over loopback (127.0.0.1), not over sslip.io, so it needed no change. All 5 rows read live.
What people will notice
- Signing in again once on each new name: the platform's site password and sign-in, the converter's password, and the control room's owner sign-in are per host.
- Old bookmarks and links in Slack, reports and docs keep working through the redirects. Published historical reports were not rebuilt.
- Engine result links already use the new name: a signed result file from a prod job downloaded with 200 from engine-adapter.bettter.us.
How to roll back
- Caddy: the config from before the change is on the server in /root/domain-move-backup/20261103T115848Z (etc-caddy.tgz; stage1/ holds the state where both names served). Restore, then systemctl daemon-reload && systemctl reload caddy.
- App settings: configs.tgz in the same folder (bug tracker, engines, control unit, caddy drop-in); restart the services.
- Platform routes: the secrets' AWSPREVIOUS versions hold the old URLs.
- DNS: delete the 9 A records (comment "sslip.io move 2026-11-03"). The old sslip.io names resolve on their own and never depended on bettter.us.
- Redirects stay in place indefinitely; there is no expiry.
How this was verified
- curl without following redirects for every old/new pair. Python TLS handshake for each certificate. Chrome (browser-use) for fragments, the control room and the tech builder's feedback.
- conformance.py read-only on the 6 new engine routes with the platform's own keys: 17/17 each. Repository tests: Adapter 60 passed, 8 skipped. Builder 10 passed, 1 skipped. Builder Tech 11 passed, 16 skipped. opsdash 10 passed.
- The dashboard's daily refresh ran from main after the merge (12:15 and 12:17 UTC) and deployed cleanly, including the changed validation step.