@invisibleloop/pulse 0.1.21

package/docs/src/pages/config.js

@@ -0,0 +1,193 @@
+import { renderLayout, h1, lead, section, codeBlock, callout, table } from '../lib/layout.js'
+import { prevNext } from '../lib/nav.js'
+import { highlight } from '../lib/highlight.js'
+
+const { prev, next } = prevNext('/config')
+
+export default {
+  route: '/config',
+  meta: {
+    title: 'Configuration — Pulse Docs',
+    description: 'Full reference for pulse.config.js — port, Lighthouse thresholds, load test config, environments, and per-route overrides.',
+    styles: ['/docs.css'],
+  },
+  state: {},
+  view: () => renderLayout({
+    currentHref: '/config',
+    prev,
+    next,
+    content: `
+      ${h1('Configuration')}
+      ${lead('<code>pulse.config.js</code> sets the performance and load thresholds that Pulse enforces across your application. All fields are optional — the defaults match Google\'s Core Web Vitals "good" band. Configuration here is not about enabling features; it is about deciding where, if anywhere, you need to lower a guaranteed baseline.')}
+
+      ${section('schema', 'Full schema')}
+      ${codeBlock(highlight(`// pulse.config.js
+export default {
+  port: 3000,
+
+  lighthouse: {
+    // Category scores — 0 to 100. Default: 100 for all four.
+    performance:   100,
+    accessibility: 100,
+    bestPractices: 100,
+    seo:           100,
+
+    // Core Web Vitals and timing metrics.
+    // Defaults are the Google "good" thresholds.
+    lcp: 2500,   // Largest Contentful Paint (ms)
+    cls: 0.1,    // Cumulative Layout Shift
+    tbt: 200,    // Total Blocking Time (ms)
+    fcp: 1800,   // First Contentful Paint (ms)
+    si:  3400,   // Speed Index (ms)
+    inp: 200,    // Interaction to Next Paint (ms)
+  },
+
+  load: {
+    duration:    10,
+    connections: 10,
+    thresholds: {
+      rps:    undefined,  // minimum req/s (optional)
+      p99:    undefined,  // maximum p99 latency ms (optional)
+      errors: 0,
+    },
+  },
+
+  environments: {
+    // Environment names are bespoke — choose whatever suits your project.
+    local:   { url: 'http://localhost:3000', default: true },
+    staging: {
+      url:     'https://staging.myapp.com',
+      headers: { Authorization: \`Bearer \${process.env.STAGING_TOKEN}\` },
+      load:       { duration: 30, connections: 50 },
+      lighthouse: { performance: 90 },
+    },
+    production: { url: 'https://myapp.com' },
+  },
+
+  routes: {
+    // Per-route overrides — merged on top of global lighthouse/load config.
+    // Only specify what differs from the global defaults.
+    '/dashboard': {
+      lighthouse: {
+        performance: 85,
+        lcp:         4000,
+      },
+    },
+    '/embed': {
+      lighthouse: {
+        bestPractices: 85,
+      },
+    },
+  },
+}`, 'js'))}
+
+      ${section('port', 'port')}
+      ${table(
+        ['Field', 'Type', 'Default', 'Description'],
+        [
+          ['<code>port</code>', '<code>number</code>', '<code>3000</code>', 'Port the dev and production servers listen on.'],
+        ]
+      )}
+
+      ${section('lighthouse', 'lighthouse')}
+      <p>Global Lighthouse thresholds that every page must meet. <code>/pulse-report</code> enforces these after every audit — any page that falls below a threshold is reported as a failure, not a warning.</p>
+      ${table(
+        ['Field', 'Type', 'Default', 'Description'],
+        [
+          ['<code>performance</code>',   '<code>number</code>', '<code>100</code>',  'Lighthouse Performance category score (0–100).'],
+          ['<code>accessibility</code>', '<code>number</code>', '<code>100</code>',  'Lighthouse Accessibility category score (0–100).'],
+          ['<code>bestPractices</code>', '<code>number</code>', '<code>100</code>',  'Lighthouse Best Practices category score (0–100).'],
+          ['<code>seo</code>',           '<code>number</code>', '<code>100</code>',  'Lighthouse SEO category score (0–100).'],
+          ['<code>lcp</code>',           '<code>number</code>', '<code>2500</code>', 'Largest Contentful Paint budget (ms).'],
+          ['<code>cls</code>',           '<code>number</code>', '<code>0.1</code>',  'Cumulative Layout Shift budget.'],
+          ['<code>tbt</code>',           '<code>number</code>', '<code>200</code>',  'Total Blocking Time budget (ms).'],
+          ['<code>fcp</code>',           '<code>number</code>', '<code>1800</code>', 'First Contentful Paint budget (ms).'],
+          ['<code>si</code>',            '<code>number</code>', '<code>3400</code>', 'Speed Index budget (ms).'],
+          ['<code>inp</code>',           '<code>number</code>', '<code>200</code>',  'Interaction to Next Paint budget (ms).'],
+        ]
+      )}
+      ${callout('note', 'Unset fields default to the values above. Setting a field to <code>null</code> removes that check for the project — use sparingly. Raising a threshold is always preferable to disabling it.')}
+
+      ${section('routes', 'routes')}
+      <p>Route-specific overrides let you lower a threshold for a specific page without relaxing the global guarantee. Only specify the fields that differ — everything else inherits from the global config.</p>
+      ${codeBlock(highlight(`routes: {
+  // This route uses a third-party chart library — relax performance only.
+  '/dashboard': {
+    lighthouse: {
+      performance: 85,
+      lcp:         4000,
+    },
+  },
+}`, 'js'))}
+      ${callout('note', 'Route keys must exactly match the spec <code>route</code> field, including any leading slash. Dynamic segments are not supported — create a specific override for each route pattern.')}
+
+      ${section('load', 'load')}
+      <p>Load test thresholds enforced by <code>/pulse-load</code>. All fields are optional — omitting a threshold means that check is not enforced.</p>
+      ${table(
+        ['Field', 'Type', 'Default', 'Description'],
+        [
+          ['<code>duration</code>',            '<code>number</code>',    '<code>10</code>',         'Test duration in seconds.'],
+          ['<code>connections</code>',          '<code>number</code>',    '<code>10</code>',         'Number of concurrent request chains.'],
+          ['<code>thresholds.rps</code>',       '<code>number</code>',    '<code>undefined</code>',  'Minimum acceptable requests per second. Unset = no check.'],
+          ['<code>thresholds.p99</code>',       '<code>number</code>',    '<code>undefined</code>',  'Maximum acceptable p99 latency (ms). Unset = no check.'],
+          ['<code>thresholds.errors</code>',    '<code>number</code>',    '<code>0</code>',          'Maximum acceptable error count.'],
+        ]
+      )}
+      ${codeBlock(highlight(`load: {
+  duration:    30,
+  connections: 20,
+  thresholds: {
+    rps:    100,   // fail if below 100 req/s
+    p99:    500,   // fail if p99 exceeds 500ms
+    errors: 0,
+  },
+},`, 'js'))}
+      <p>Per-route overrides follow the same pattern as <code>lighthouse</code>:</p>
+      ${codeBlock(highlight(`routes: {
+  '/feed': {
+    load: { connections: 5, thresholds: { rps: 20 } },
+  },
+}`, 'js'))}
+      <p>Results are saved to <code>.pulse/load-reports/</code> and displayed in the Load Tests tab of the report dashboard, alongside the Lighthouse Performance tab for the same route.</p>
+
+      ${section('environments', 'environments')}
+      <p>Named environments let you enforce thresholds against different targets — local, staging, production — from the same config. Thresholds are applied per-environment, so staging and production can have different performance floors.</p>
+      ${table(
+        ['Field', 'Type', 'Description'],
+        [
+          ['<code>url</code>',        '<code>string</code>',  'Base URL to test against. If it contains <code>localhost</code> or <code>127.0.0.1</code>, a local production build is spun up automatically. Remote URLs are tested directly.'],
+          ['<code>default</code>',    '<code>boolean</code>', 'The environment used when none is explicitly specified by <code>pulse report</code> and <code>pulse load-test</code>.'],
+          ['<code>headers</code>',    '<code>object</code>',  'HTTP headers sent with every request to this environment. Useful for authorization tokens on protected staging deployments — read values from <code>process.env</code> rather than hardcoding them.'],
+          ['<code>load</code>',       '<code>object</code>',  'Load test config overrides for this environment. Same fields as the global <code>load</code> block. Merged on top of global config.'],
+          ['<code>lighthouse</code>', '<code>object</code>',  'Lighthouse threshold overrides for this environment. Same fields as the global <code>lighthouse</code> block. Merged on top of global config.'],
+        ]
+      )}
+      ${callout('note', 'Environment names are fully bespoke — <code>local</code>, <code>staging</code>, <code>production</code>, <code>preview</code>, <code>eu</code> — whatever maps to your project\'s infrastructure. There are no reserved names.')}
+      <p>Threshold merge order: <strong>global config → environment override → per-route override</strong>.</p>
+      ${codeBlock(highlight(`environments: {
+  local:   { url: 'http://localhost:3000', default: true },
+  staging: {
+    url:     'https://staging.myapp.com',
+    headers: { Authorization: \`Bearer \${process.env.STAGING_TOKEN}\` },
+    load:       { duration: 30, connections: 50, thresholds: { rps: 500 } },
+    lighthouse: { performance: 90 },
+  },
+  production: { url: 'https://myapp.com' },
+}`, 'js'))}
+
+      ${section('defaults', 'CWV default thresholds')}
+      <p>The default metric thresholds match the Google "good" band from the Core Web Vitals specification:</p>
+      ${table(
+        ['Metric', 'Default', 'Google "good" threshold'],
+        [
+          ['LCP', '<code>2500 ms</code>',  '≤ 2500 ms'],
+          ['CLS', '<code>0.1</code>',      '≤ 0.1'],
+          ['TBT', '<code>200 ms</code>',   '≤ 200 ms'],
+          ['FCP', '<code>1800 ms</code>',  '≤ 1800 ms'],
+          ['SI',  '<code>3400 ms</code>',  '≤ 3400 ms'],
+          ['INP', '<code>200 ms</code>',   '≤ 200 ms'],
+        ]
+      )}
+    `,
+  }),
+}

package/docs/src/pages/constraints.js

@@ -0,0 +1,99 @@
+import { renderLayout, h1, lead, section, sub, codeBlock, callout, table } from '../lib/layout.js'
+import { prevNext } from '../lib/nav.js'
+import { highlight } from '../lib/highlight.js'
+
+const { prev, next } = prevNext('/constraints')
+
+export default {
+  route: '/constraints',
+  meta: {
+    title: 'Constraints — Pulse Docs',
+    description: 'Automatic min/max bounds on state values, enforced after every mutation.',
+    styles: ['/docs.css'],
+  },
+  state: {},
+  view: () => renderLayout({
+    currentHref: '/constraints',
+    prev,
+    next,
+    content: `
+      ${h1('Constraints')}
+      ${lead('Constraints are always-on bounds for numeric state values. After every mutation, Pulse clamps constrained values to their declared range before the view re-renders. The value can never go out of range — there is no code path where it can.')}
+
+      ${section('declaring', 'Declaring constraints')}
+      <p>The <code>constraints</code> field maps top-level state keys to bounds objects with optional <code>min</code> and <code>max</code> properties:</p>
+      ${codeBlock(highlight(`export default {
+  route: '/cart',
+  state: {
+    quantity: 1,
+    zoom:     1.0,
+    rating:   0,
+  },
+  constraints: {
+    quantity: { min: 1,   max: 99  },
+    zoom:     { min: 0.5, max: 3.0 },
+    rating:   { min: 0,   max: 5   },
+  },
+  mutations: {
+    increaseQty: (state) => ({ quantity: state.quantity + 1 }),
+    decreaseQty: (state) => ({ quantity: state.quantity - 1 }),
+    zoomIn:      (state) => ({ zoom: state.zoom + 0.1 }),
+    zoomOut:     (state) => ({ zoom: state.zoom - 0.1 }),
+  },
+}`, 'js'))}
+      <p>When <code>decreaseQty</code> runs and <code>quantity</code> is already 1, the constraint clamps it back to 1 before the view renders. The mutation does not need to check bounds — the spec declares them once and Pulse enforces them everywhere.</p>
+
+      ${section('vs-validation', 'Constraints vs Validation')}
+      ${table(
+        ['', 'Constraints', 'Validation'],
+        [
+          ['When it runs', 'After <strong>every</strong> mutation, automatically', 'Only when an action has <code>validate: true</code>'],
+          ['What it does', 'Clamps numeric values silently', 'Rejects the action and surfaces errors'],
+          ['User feedback', 'None — state is silently corrected', 'Explicit error messages shown in the view'],
+          ['Best for', 'Numeric ranges that must never be exceeded', 'Form field correctness before submission'],
+        ]
+      )}
+
+      ${callout('note', 'Constraints and validation serve different purposes. Constraints silently enforce numeric bounds at every mutation — they cannot be bypassed. Validation rejects invalid form data before an action\'s async work begins — it only runs when explicitly declared.')}
+
+      ${section('one-sided', 'One-sided bounds')}
+      <p>Either <code>min</code> or <code>max</code> can be declared alone — both are optional:</p>
+      ${codeBlock(highlight(`constraints: {
+  count:    { min: 0 },          // no upper limit
+  discount: { max: 100 },        // no lower limit
+  offset:   { min: 0, max: 999 } // both bounds
+}`, 'js'))}
+
+      ${section('how-it-works', 'How clamping works')}
+      <p>After Pulse applies a mutation's partial state update, it iterates over all declared constraints and applies <code>Math.max(min, Math.min(max, value))</code> to each constrained key. The view is then called with the clamped state.</p>
+      ${codeBlock(highlight(`// state.count = 10, constraints.count = { min: 0, max: 10 }
+mutations: {
+  increment: (state) => ({ count: state.count + 1 }),
+  // mutation returns { count: 11 }
+  // constraint clamps to 10
+  // view receives { count: 10 }
+}`, 'js'))}
+
+      ${section('top-level', 'Top-level keys only')}
+      <p>Constraints apply to top-level state keys. To constrain nested values, consider flattening your state structure or applying bounds logic in the mutation itself:</p>
+      ${codeBlock(highlight(`// Cannot do:
+constraints: {
+  'player.health': { min: 0, max: 100 }   // ✗ nested paths not supported
+}
+
+// Do instead:
+state: { playerHealth: 100 },
+constraints: { playerHealth: { min: 0, max: 100 } },
+
+// Or handle in the mutation:
+mutations: {
+  takeDamage: (state, _, amount) => ({
+    player: {
+      ...state.player,
+      health: Math.max(0, state.player.health - amount),
+    }
+  })
+}`, 'js'))}
+    `,
+  }),
+}

package/docs/src/pages/deploy.js

@@ -0,0 +1,233 @@
+import { renderLayout, h1, lead, section, codeBlock, callout, table } from '../lib/layout.js'
+import { prevNext } from '../lib/nav.js'
+import { highlight } from '../lib/highlight.js'
+
+const { prev, next } = prevNext('/deploy')
+
+export default {
+  route: '/deploy',
+  meta: {
+    title: 'Deployment — Pulse Docs',
+    description: 'Deploy a Pulse app to a VPS, Docker, Fly.io, Railway, or Render.',
+    styles: ['/docs.css'],
+  },
+  state: {},
+  view: () => renderLayout({
+    currentHref: '/deploy',
+    prev,
+    next,
+    content: `
+      ${h1('Deployment')}
+      ${lead('Pulse deploys as a single Node.js process. No adapters, no serverless wrapping, no separate static file server required. Build once, run anywhere Node 22+ runs. All guarantees — security headers, brotli compression, immutable asset caching — are active in production automatically.')}
+
+      ${section('build', 'Build')}
+      <p>Run the production build before deploying:</p>
+      ${codeBlock(highlight(`npm run build`, 'bash'))}
+      <p>This generates content-hashed bundles in <code>public/dist/</code> and writes <code>public/dist/manifest.json</code>. The server reads the manifest at startup to resolve hydration script paths.</p>
+      ${callout('warning', 'Without a manifest, the server falls back to serving source files directly — no compression, no content-hashed filenames, and no <code>immutable</code> cache headers. Always run <code>npm run build</code> before deploying to production.')}
+
+      ${section('files', 'What to deploy')}
+      ${table(
+        ['Include', 'Reason'],
+        [
+          ['<code>src/</code>',                            'Page specs — imported by the server at runtime'],
+          ['<code>public/</code>',                         'Static assets and built bundles (<code>public/dist/</code>)'],
+          ['<code>server.js</code>',                       'Entry point'],
+          ['<code>pulse.config.js</code>',                 'Server config'],
+          ['<code>package.json</code> + <code>node_modules/</code>', 'Runtime dependencies'],
+        ]
+      )}
+      ${table(
+        ['Exclude', 'Reason'],
+        [
+          ['<code>.claude/</code>',  'AI agent config — not needed at runtime'],
+          ['<code>.pulse/</code>',   'Local report data — not needed at runtime'],
+        ]
+      )}
+
+      ${section('env-vars', 'Environment variables')}
+      ${table(
+        ['Variable', 'Default', 'Description'],
+        [
+          ['<code>NODE_ENV</code>', '<code>development</code>', 'Set to <code>production</code> to enable HSTS headers and production cache behaviour.'],
+          ['<code>PORT</code>',     'Value in <code>pulse.config.js</code> (default <code>3000</code>)', 'Override the listening port. Most PaaS platforms set this automatically.'],
+        ]
+      )}
+      ${codeBlock(highlight(`NODE_ENV=production pulse start`, 'bash'))}
+
+      ${section('pm2', 'VPS with PM2')}
+      <p>PM2 keeps the process alive, restarts it on crash, and manages logs.</p>
+      ${codeBlock(highlight(`# Install PM2 globally
+npm install -g pm2
+
+# Start the app
+NODE_ENV=production pm2 start server.js --name myapp
+
+# Persist across reboots
+pm2 save
+pm2 startup
+
+# Zero-downtime reload after a deploy
+pm2 reload myapp`, 'bash'))}
+      <p>For repeatable deployments, check an <code>ecosystem.config.cjs</code> into version control:</p>
+      ${codeBlock(highlight(`// ecosystem.config.cjs
+module.exports = {
+  apps: [{
+    name:   'myapp',
+    script: 'server.js',
+    env_production: {
+      NODE_ENV: 'production',
+      PORT:     3000,
+    },
+  }],
+}`, 'js'))}
+      ${codeBlock(highlight(`pm2 start ecosystem.config.cjs --env production`, 'bash'))}
+
+      ${section('docker', 'Docker')}
+      <p>A two-stage build keeps the image small — build tools stay in the first stage.</p>
+      ${codeBlock(highlight(`# ---- build stage ----
+FROM node:22-alpine AS build
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci
+COPY . .
+RUN npx pulse build
+
+# ---- runtime stage ----
+FROM node:22-alpine
+WORKDIR /app
+ENV NODE_ENV=production
+COPY package*.json ./
+RUN npm ci --omit=dev
+COPY --from=build /app/src         ./src
+COPY --from=build /app/public      ./public
+COPY --from=build /app/server.js   ./server.js
+COPY pulse.config.js ./
+EXPOSE 3000
+CMD ["node", "server.js"]`, 'bash'))}
+      ${codeBlock(highlight(`docker build -t myapp .
+docker run -p 3000:3000 --env NODE_ENV=production myapp`, 'bash'))}
+
+      ${section('fly', 'Fly.io')}
+      ${codeBlock(highlight(`# fly.toml
+app            = 'myapp'
+primary_region = 'lhr'
+
+[env]
+  NODE_ENV = 'production'
+
+[build]
+  [build.args]
+    NODE_VERSION = '22'
+
+[deploy]
+  release_command = 'npx pulse build'
+
+[http_service]
+  internal_port       = 3000
+  force_https         = true
+  auto_stop_machines  = 'stop'
+  auto_start_machines = true
+
+[[vm]]
+  memory   = '256mb'
+  cpu_kind = 'shared'
+  cpus     = 1`, 'bash'))}
+      ${codeBlock(highlight(`# First deploy
+fly launch
+
+# Subsequent deploys
+fly deploy`, 'bash'))}
+
+      ${section('railway', 'Railway')}
+      <p>Railway auto-detects Node apps. Add a <code>railway.json</code> to set the build and start commands:</p>
+      ${codeBlock(highlight(`{
+  "$schema": "https://railway.app/railway.schema.json",
+  "build": {
+    "builder": "NIXPACKS",
+    "buildCommand": "npm run build"
+  },
+  "deploy": {
+    "startCommand": "NODE_ENV=production node server.js",
+    "healthcheckPath": "/",
+    "restartPolicyType": "ON_FAILURE"
+  }
+}`, 'js'))}
+
+      ${section('render', 'Render')}
+      ${table(
+        ['Setting', 'Value'],
+        [
+          ['Environment',   'Node'],
+          ['Build command', '<code>npm install &amp;&amp; npm run build</code>'],
+          ['Start command', '<code>NODE_ENV=production node server.js</code>'],
+          ['Node version',  '<code>22.x</code>'],
+        ]
+      )}
+      <p>Set <code>NODE_ENV=production</code> in the Render environment variables dashboard.</p>
+
+      ${section('serverless', 'Vercel, Cloudflare, and edge platforms')}
+      <p>These platforms each have multiple products with very different runtimes — the compatibility story varies significantly between them.</p>
+
+      ${section('vercel', 'Vercel')}
+      <p>Vercel has two distinct runtimes:</p>
+      ${table(
+        ['Product', 'Runtime', 'Pulse compatible?'],
+        [
+          ['<strong>Functions</strong> (Node.js)', 'Full Node.js — same built-ins as a VPS', 'Partially — see below'],
+          ['<strong>Edge Functions</strong>', 'V8 isolates (no Node built-ins)', 'No'],
+        ]
+      )}
+      <p><strong>Vercel Functions (Node.js)</strong> can run Pulse with some differences in behaviour:</p>
+      ${table(
+        ['Feature', 'Behaviour on Vercel Functions'],
+        [
+          ['<code>serverTtl</code> cache', 'Works within a warm instance, but cold starts reset it. Not reliable for expensive queries.'],
+          ['Streaming SSR', 'Vercel Functions support streaming responses, but require explicit configuration via <code>supportsResponseStreaming</code>.'],
+          ['Static files', 'Vercel serves <code>public/</code> automatically via its CDN — Pulse\'s static file serving is bypassed.'],
+          ['Security headers', 'Work as normal — Pulse adds them to every response.'],
+        ]
+      )}
+      ${callout('warning', 'Vercel Functions are not a tested or officially supported deployment target for Pulse. The adapter pattern (exporting a request handler rather than starting a server) is not yet documented. Railway, Render, or Fly.io are simpler choices with no adaptation required.')}
+
+      ${section('cloudflare', 'Cloudflare')}
+      ${table(
+        ['Product', 'Runtime', 'Pulse compatible?'],
+        [
+          ['<strong>Workers</strong>', 'V8 isolates — no <code>node:http</code>, <code>node:fs</code>, <code>node:zlib</code>', 'No'],
+          ['<strong>Pages Functions</strong>', 'Same V8 isolate runtime as Workers', 'No'],
+          ['<strong>CDN / proxy</strong>', 'Sits in front of your origin server', 'Yes — works great with Fly.io or a VPS behind it'],
+        ]
+      )}
+      ${callout('tip', 'The recommended pattern for edge performance: deploy Pulse to <strong>Fly.io</strong> (which runs real VMs in many regions) and put <strong>Cloudflare as a CDN/proxy</strong> in front of it. Static assets and cached HTML are served from Cloudflare\'s edge; dynamic requests are proxied to the nearest Fly VM.')}
+
+      ${section('https', 'HTTPS and reverse proxy')}
+      <p>Pulse detects TLS automatically. When a request arrives with an <code>x-forwarded-proto: https</code> header or over a direct TLS socket, <code>Strict-Transport-Security: max-age=31536000; includeSubDomains</code> is added to the response. All four platforms above forward this header — no Pulse config is needed.</p>
+      <p>If running behind nginx for TLS termination:</p>
+      ${codeBlock(highlight(`# nginx — TLS termination, proxy to Pulse
+server {
+  listen 443 ssl;
+  server_name myapp.com;
+
+  ssl_certificate     /etc/letsencrypt/live/myapp.com/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/myapp.com/privkey.pem;
+
+  location / {
+    proxy_pass         http://localhost:3000;
+    proxy_http_version 1.1;
+    proxy_set_header   Host              $host;
+    proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
+    proxy_set_header   X-Forwarded-Proto $scheme;
+  }
+}
+
+# Redirect HTTP to HTTPS
+server {
+  listen 80;
+  server_name myapp.com;
+  return 301 https://$host$request_uri;
+}`, 'bash'))}
+      ${callout('tip', 'Use <a href="https://certbot.eff.org">Certbot</a> to obtain and auto-renew a free Let\'s Encrypt certificate: <code>certbot --nginx -d myapp.com</code>.')}
+    `,
+  }),
+}