Merge branch 'task/t-1o2c9wcq3go.1' into live

2 files changed, 42 insertions, 4 deletions

diff --git a/Biz/PodcastItLater/INFRASTRUCTURE.md b/Biz/PodcastItLater/INFRASTRUCTURE.md
new file mode 100644
index 0000000..1c61618
--- /dev/null
+++ b/Biz/PodcastItLater/INFRASTRUCTURE.md
@@ -0,0 +1,38 @@
+# Infrastructure Setup for PodcastItLater
+
+## Mailgun Setup
+
+Since PodcastItLater requires sending transactional emails (magic links), we use Mailgun.
+
+### 1. Sign up for Mailgun
+Sign up at [mailgun.com](https://www.mailgun.com/).
+
+### 2. Add Domain
+Add `podcastitlater.com` (or `mg.podcastitlater.com`) to Mailgun.
+We recommend using the root domain `podcastitlater.com` if you want emails to come from `@podcastitlater.com`.
+
+### 3. Configure DNS
+Mailgun will provide DNS records to verify the domain and authorize email sending. You must add these to your DNS provider (e.g., Cloudflare, Namecheap).
+
+Required records usually include:
+- **TXT** (SPF): `v=spf1 include:mailgun.org ~all`
+- **TXT** (DKIM): `k=rsa; p=...` (Provided by Mailgun)
+- **MX** (if receiving email, optional for just sending): `10 mxa.mailgun.org`, `10 mxb.mailgun.org`
+- **CNAME** (for tracking, optional): `email.podcastitlater.com` -> `mailgun.org`
+
+### 4. Verify Domain
+Click "Verify DNS Settings" in Mailgun dashboard. This may take up to 24 hours but is usually instant.
+
+### 5. Generate API Key / SMTP Credentials
+Go to "Sending" -> "Domain Settings" -> "SMTP Credentials".
+Create a new SMTP user (e.g., `postmaster@podcastitlater.com`).
+**Save the password immediately.**
+
+### 6. Update Secrets
+Update the production secrets file on the server (`/run/podcastitlater/env`):
+
+```bash
+SMTP_SERVER=smtp.mailgun.org
+SMTP_PASSWORD=your-new-smtp-password
+EMAIL_FROM=noreply@podcastitlater.com
+```
diff --git a/Biz/PodcastItLater/Web.nix b/Biz/PodcastItLater/Web.nix
index 8f35dbb..7533ca4 100644
--- a/Biz/PodcastItLater/Web.nix
+++ b/Biz/PodcastItLater/Web.nix
@@ -5,7 +5,7 @@
   ...
 }: let
   cfg = config.services.podcastitlater-web;
-  rootDomain = "bensima.com";
+  rootDomain = "podcastitlater.com";
   ports = import ../../Omni/Cloud/Ports.nix;
 in {
   options.services.podcastitlater-web = {
@@ -39,7 +39,7 @@ in {
         # Manual step: create this file with secrets
         # SECRET_KEY=your-secret-key-for-sessions
         # SESSION_SECRET=your-session-secret
-        # EMAIL_FROM=noreply@podcastitlater.bensima.com
+        # EMAIL_FROM=noreply@podcastitlater.com
         # SMTP_SERVER=smtp.mailgun.org
         # SMTP_PASSWORD=your-smtp-password
         # STRIPE_SECRET_KEY=sk_live_your_stripe_secret_key
@@ -58,7 +58,7 @@ in {
           "PORT=${toString cfg.port}"
           "AREA=Live"
           "DATA_DIR=${cfg.dataDir}"
-          "BASE_URL=https://podcastitlater.${rootDomain}"
+          "BASE_URL=https://${rootDomain}"
         ];
         EnvironmentFile = "/run/podcastitlater/env";
         KillSignal = "INT";
@@ -77,7 +77,7 @@ in {
       recommendedTlsSettings = true;
       statusPage = true;
 
-      virtualHosts."podcastitlater.${rootDomain}" = {
+      virtualHosts."${rootDomain}" = {
         forceSSL = true;
         enableACME = true;
         locations."/" = {