Three independent bugs caused repeated Hetzner SSH deploy failures and incomplete SSL coverage across all DNS-registered subdomains (@, www, api, orchestrator, * → 204.168.230.142; SSL/DDoS off at registrar, so Hetzner handles everything).

Deploy pipeline failures (deploy-hetzner.yml, deploy-backend.yml, package.json)

• Root cause: SSH scripts ran npm run lint from repo root (/opt/unicorn), which has no lint script → Missing script: lint on every push.
  • Added "lint": "npm --prefix UNICORN_FINAL run lint" to root package.json
  • Both deploy scripts now explicitly target UNICORN_FINAL for lint/test/install
• Secondary: npm install only ran at repo root, not in UNICORN_FINAL/ — app deps could be stale after pull
• ERR trap bug: quantum-integrity health check || (echo ... && false) fired the rollback trap on unavailable endpoints, failing deploys that were otherwise successful. Moved trap - ERR before all post-deploy health checks.

Nginx server_name truncation (fix-server.sh)

fix-server.sh copied nginx-unicorn.conf (which correctly lists all 4 hostnames) then immediately overwrote server_name with only 2:

# Before — drops api. and orchestrator.
sed -i "s/server_name .*;/server_name ${DOMAIN} www.${DOMAIN};/" "$NGINX_AVAILABLE"

# After — matches all DNS A records
sed -i "s/server_name .*;/server_name ${DOMAIN} www.${DOMAIN} api.${DOMAIN} orchestrator.${DOMAIN};/" "$NGINX_AVAILABLE"

Same fix applied to the inline fallback config generated when nginx-unicorn.conf is missing.

Certbot covers only 2 of 4 subdomains (fix-server.sh)

With SSL/DDoS off at sav.com, Let's Encrypt is the sole TLS provider. Certbot was only requesting certs for zeusai.pro and www.zeusai.pro — api.zeusai.pro and orchestrator.zeusai.pro had no HTTPS. Now auto-obtains a single cert covering all four with --redirect:

certbot --nginx \
  -d "${DOMAIN}" -d "www.${DOMAIN}" -d "api.${DOMAIN}" -d "orchestrator.${DOMAIN}" \
  --non-interactive --agree-tos -m "admin@${DOMAIN}" --redirect