build(deploy)!: Learn's domain is LEARN_DOMAIN, as Train's and Todo's are TRAIN_DOMAIN and TODO_DOMAIN

DOMAIN named the domain of Learn's site alone (Caddy's), beside the
prefixed domains of the other apps' compose files.

BREAKING CHANGE: an instance's deploy/.env must set LEARN_DOMAIN (DOMAIN's
value) before this is deployed; without it Compose stops at once, and the
deploy fails before anything is switched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/.env.example

@@ -3,14 +3,16 @@
 # set up (e.g. rendered from Proton Pass on the deploying machine and copied over SSH,
 # so the server itself never holds Proton credentials).
 
-# `http://localhost` for the local rehearsal; `learn.halkyon.eu` on its server.
-DOMAIN=http://localhost
+# Halkyon Learn's domain, as TRAIN_DOMAIN and TODO_DOMAIN are Train's and Todo's (named
+# DOMAIN until 2 Nov 2026): `http://localhost` for the local rehearsal;
+# `learn.halkyon.eu` on its server.
+LEARN_DOMAIN=http://localhost
 
 # The domain people's handles are on (`raisondetredev@halkyon.eu`) and their profile
-# pages (`https://halkyon.eu/@raisondetredev`, ADR 0011), when it isn't DOMAIN's host:
-# point its DNS (A and AAAA) at this server, and Caddy serves the profile pages there,
-# nothing else. Unset: DOMAIN's host. Decide before anyone follows a handle: it can
-# never change once the fediverse knows it.
+# pages (`https://halkyon.eu/@raisondetredev`, ADR 0011), when it isn't LEARN_DOMAIN's
+# host: point its DNS (A and AAAA) at this server, and Caddy serves the profile pages
+# there, nothing else. Unset: LEARN_DOMAIN's host. Decide before anyone follows a
+# handle: it can never change once the fediverse knows it.
 #ACCOUNT_DOMAIN=halkyon.eu
 
 # The instance's other services (optional, ADR 0016), such as Halkyon Todo: Halkyon

deploy/Caddyfile

@@ -4,11 +4,11 @@
 # services (`/halkyon-base/…`, ADR 0016): they reach each other on its own network. Insights (8081) doesn't run in production;
 # if it is ever re-enabled, reach it through an SSH tunnel, never through this file.
 #
-# {$DOMAIN} is `learn.halkyon.eu` on its server, where Caddy obtains and renews a
+# {$LEARN_DOMAIN} is `learn.halkyon.eu` on its server, where Caddy obtains and renews a
 # Let's Encrypt certificate by itself, and `http://localhost` for the local rehearsal.
-# {$ACCOUNT_SITE} is the account domain handles are on where it isn't {$DOMAIN}
+# {$ACCOUNT_SITE} is the account domain handles are on where it isn't {$LEARN_DOMAIN}
 # (`halkyon.eu`), whose profile pages this instance serves; empty for none.
-{$DOMAIN} {$ACCOUNT_SITE} {
+{$LEARN_DOMAIN} {$ACCOUNT_SITE} {
 	encode zstd gzip
 
 	# Profile pages, `/@handle`; asked for on the other host, they send the visitor to

deploy/compose.yaml

@@ -35,9 +35,9 @@ services:
     environment:
       # `learn.halkyon.eu` on its server (automatic Let's Encrypt certificate);
       # `http://localhost` for the local rehearsal (plain HTTP, no certificate).
-      DOMAIN: ${DOMAIN:?set DOMAIN in deploy/.env}
+      LEARN_DOMAIN: ${LEARN_DOMAIN:?set LEARN_DOMAIN in deploy/.env}
       # The account domain whose profile pages this instance serves, where it isn't
-      # DOMAIN; empty for none.
+      # LEARN_DOMAIN; empty for none.
       ACCOUNT_SITE: ${ACCOUNT_DOMAIN:-}
     volumes:
       - ./Caddyfile:/etc/caddy/Caddyfile:ro
@@ -102,7 +102,7 @@ services:
       TRUSTED_PROXIES: 172.30.80.2 fd4a:6c6b:7e80::2
       # Where the source of what this instance runs is; empty: the project's.
       SOURCE_URL: ${SOURCE_URL:-}
-      # The domain people's handles are on; empty: DOMAIN's host.
+      # The domain people's handles are on; empty: LEARN_DOMAIN's host.
       ACCOUNT_DOMAIN: ${ACCOUNT_DOMAIN:-}
       # The instance's other services (ADR 0016), whose accounts this server's
       # register keeps: the secret every call between them carries, and their web