itpp-infrastructure/projects/timapta.md

# TIMAPTA — Tybee Island Maritime Academy PTA

**Project owner:** Greyson's mom (PTA project)
**Status:** FORWARDING TO ptatime.org (ptatime.org itself NOT yet deployed)
**Deployed:** 2026-08-12 · **Re-pointed:** 2026-09-11

## Canonical-domain change (2026-09-11)

All three PTA domains now 301 to `ptatime.org`, which is the intended canonical
domain. `ptatime.org` has an active zone but ZERO DNS records — no web, no mail —
so every forward currently lands on a domain that does not resolve. Nothing serves
until a site is deployed at `ptatime.org`. Only `register.timapta.org` (membership
form on Core) is still live.

| Source (apex + www) | Mechanism | Target |
|---|---|---|
| `timapta.org` | proxied dummy A (192.0.2.1) + Page Rule | 301 → `https://ptatime.org/$1` |
| `ptatima.org` | proxied dummy A (192.0.2.1) + Page Rule | 301 → `https://ptatime.org/$1` |
| `ptaoftybeeislandmaritimeeducation.org` | proxied dummy A (192.0.2.1) + Page Rule | 301 → `https://ptatime.org/$1` |

Verified at the Cloudflare edge (all 6 hosts, path + query preserved):
`GET /join/thanks?x=1` → `301 Location: https://ptatime.org/join/thanks?x=1`

**timapta.org email is untouched by this change** (MX, SPF, DKIM, DMARC all intact
and resolving; only HTTP records/Page Rules are involved).

**timapta.org apex no longer serves the old site.** The apex + www A records that
pointed at app3 were gone before this change (site returned nothing). Site files
still exist at `/home/ippadmin/htdocs/timapta.org/` and the nginx vhost
`timapta.org.conf` is still enabled on app3 — orphaned until removed or re-homed.

## Summary

Public-facing website + email for the newly formed Tybee Island Maritime Academy
PTA. Domains `timapta.org` and `ptatima.org` registered at Cloudflare. `timapta.org`
serves the site from app3 (nginx); `ptatima.org` 301-forwards to it. Email runs on
MXroute with branded `mail.` and `webmail.` subdomains.

## Domain & DNS (Cloudflare)

| Record | Type | Value | Purpose |
|---|---|---|---|
| `timapta.org` | A (proxied, dummy 192.0.2.1) + Page Rule | 301 → `https://ptatime.org/$1` | forward (added 2026-09-11) |
| `www.timapta.org` | A (proxied, dummy 192.0.2.1) + Page Rule | 301 → `https://ptatime.org/$1` | forward (added 2026-09-11) |
| `ptatima.org` | A (proxied) + Page Rule | 301 → `https://ptatime.org/$1` | forward (retargeted 2026-09-11) |
| `www.ptatima.org` | A (proxied) + Page Rule | 301 → `https://ptatime.org/$1` | forward (retargeted 2026-09-11) |
| `ptaoftybeeislandmaritimeeducation.org` | A (proxied, dummy 192.0.2.1) + Page Rule | 301 → `https://ptatime.org/$1` | forward (added 2026-09-11) |
| `www.ptaoftybeeislandmaritimeeducation.org` | A (proxied, dummy 192.0.2.1) + Page Rule | 301 → `https://ptatime.org/$1` | forward (added 2026-09-11) |
| `ptatime.org` | (none) | — | zone exists, NO records (no web, no mail) as of 2026-09-11 |
| `mail.timapta.org` | CNAME | heracles.mxrouting.net | IMAP/SMTP hostname |
| `webmail.timapta.org` | A | 152.53.192.33 (Core) | Caddy 302 → Roundcube |

Cloudflare zone IDs:
- timapta.org: `92d1512d07b72142551aa5306fbacb2a`
- ptatima.org: `fe443f33606d319a35eeb473403371fe`
- ptatime.org: `7eaa5a94be7cd74e82852f1f287a9235`
- ptaoftybeeislandmaritimeeducation.org: `9566a9ecf7bfe5a0fad6fb808ddac616`

Page rule IDs (all `forwarding_url` → `https://ptatime.org/$1`, 301):
- timapta.org: `bce7af229a27455e7e6b0c1d2e383281` (prio 1) · www: `e36031c567a32349e19cc567e2221d5f` (prio 2)
- ptatima.org: `a0ce055a36f1d81a124654bf71f0a156` (prio 1) · www: `149fbab978c2a869122a284c827b9e99` (prio 2)
- ptaoftybeeislandmaritimeeducation.org: `a11f40b8da891cdde37d052e6efef981` (prio 1) · www: `d5083187d4f868f1989e50187834d146` (prio 2)

## Email (MXroute)

- **Server:** heracles.mxrouting.net (DirectAdmin API :2222)
- **Domain added:** timapta.org (via verification TXT `_da-verify-3ab1b283c7c6bb0074352d3264ede51a` → `domain-verified`)
- **Mailbox:** `contact@timapta.org` (quota 500 MB)

DNS records created in Cloudflare:

| Record | Type | Name | Value |
|---|---|---|---|
| MX 10 | MX | `timapta.org` | heracles.mxrouting.net |
| MX 20 | MX | `timapta.org` | heracles-relay.mxrouting.net |
| SPF | TXT | `timapta.org` | `v=spf1 include:mxroute.com -all` |
| DKIM | TXT | `x._domainkey.timapta.org` | `v=DKIM1; k=rsa; p=...` (410-char key) |
| DMARC | TXT | `_dmarc.timapta.org` | `v=DMARC1; p=none; rua=mailto:contact@timapta.org` |

**Credentials:**
- `contact@timapta.org` password: stored at `/root/timapta-contact-pass.txt`
  (`IQrZwW0YpaLQlwOuGLcY`) — pending move to Vaultwarden.

## Website (app3, nginx)

- **Docroot:** `/home/ippadmin/htdocs/timapta.org/`
- **nginx config:** `/etc/nginx/sites-available/timapta.org.conf` (symlinked into sites-enabled)
- **SSL:** Let's Encrypt (certbot webroot), `timapta.org` + `www.timapta.org`, expires 2026-11-10, auto-renew
- **Structure:** HTTP + `www` → 301 to `https://timapta.org/`; apex serves static files

Site files:
- `index.html` — landing page (mission, membership/volunteer/fundraising/events cards, contact form)
- `assets/logo.svg` — vector emblem (sun, waves, lighthouse, sand + TIMAPTA wordmark)
- `assets/logo.png` — raster copy (512x512)

## Contact Form

- Uses FormSubmit.co (`https://formsubmit.co/contact@timapta.org`), POST, table template, no captcha.
- **Activation required:** the first real submission triggers a confirmation email to
  `contact@timapta.org`. Someone must click the link once to activate the endpoint.
- Alternative (unused): native mailto link in footer.

## PTA Functionality Research (summary)

Standard public-facing PTA sites include: mission/vision statement, membership join
call-to-action, volunteer signup, fundraising drives/events, event calendar,
teacher-appreciation programs, board/leadership roster, contact form. Built the
foundation with mission + four capability cards + contact form; calendar, membership
dues, and leadership roster are natural next additions once the board provides
real names, meeting schedule, and a phone/address.

## Open Items / Next Steps

- [ ] **Deploy a site at `ptatime.org`** (blocking). Decision 2026-09-11: leave the zone
      dark for now, a new site is being built and will be deployed there. The existing
      forwards activate automatically the moment it serves; no further DNS work needed.
- [ ] Decide fate of the orphaned app3 site (`/home/ippadmin/htdocs/timapta.org/` + `timapta.org.conf` vhost)
- [ ] Move `contact@timapta.org` password into Vaultwarden
- [ ] Activate FormSubmit endpoint (first submission + click confirmation)
- [ ] Add real phone number + mailing address once PTA provides them
- [ ] Add board/leadership roster + event calendar when available
- [ ] Replace placeholder logo if the PTA commissions branded artwork

## Notes / Pitfalls

- app3 uses nginx (CloudPanel layout, per-user `/home/<user>/htdocs` docroots), NOT
  Caddy. Caddy only runs on Core (152.53.192.33), which is why the webmail redirect
  lives there.
- `timapat.org` (as requested 2026-09-11) is NOT a registered domain — PIR whois
  returns "Domain not found". The real domain is `timapta.org` (letters transposed).
- Forwarding toward `ptatime.org` (2026-09-11): `ptatime.org` zone `7eaa5a94be7cd74e82852f1f287a9235`
  exists but has ZERO DNS records — no web, no mail. Redirects land on a dead domain
  until something is deployed there.
- Page Rule pattern `timapta.org/*` does NOT match subdomains — only the exact host.
  Verified: `register.timapta.org` (200) and `webmail.timapta.org` (302 → MXroute
  Roundcube) are unaffected by the new apex/www forwarding rules.
- Adding a proxied dummy A record at the apex does NOT affect mail: MX, SPF, DKIM and
  DMARC records are independent of the HTTP path. Confirmed resolving after the change.
- Freshly recreated names take ~60s to appear on Cloudflare's authoritative NS. A
  `dig @<ns>.ns.cloudflare.com` NXDOMAIN immediately after record creation is
  propagation lag, not a failed create — re-check the API record and retry.
- `ptatima.org` forward required a proxied dummy A record so the Cloudflare Page Rule
  can intercept before routing.
- MXroute domain-add requires a `_da-verify-*` TXT record; the add fails until that
  TXT is propagated (checked via `dig @1.1.1.1`).
- DKIM key arrives split across quoted lines from `CMD_API_DNS_CONTROL`; concatenate
  all quoted strings into one unbroken value.
- Caddyfile global block must remain first; insert new site blocks after it (anchor on
  an existing `# -- ... --` comment), not at line 1.