# BigGrinRTX · business legit stack

**Law:** BigGrinRTX is a **business** · real TLS where we host · WordPress magazine · ASM iron (EZZIE ESSIE) · HTML5/JS/CSS · **free thrift legal** · o7

## What is legal / public

| Piece | Where | TLS |
|-------|--------|-----|
| **Magazine / office** `biggrinrtx.com` | WordPress.com Atomic | **Legal** (Automattic) · already live HSTS |
| **www** | CNAME → apex WP.com | **Legal** via WP.com |
| **Mail transport** Titan IMAP/SMTP | Titan | Provider TLS 993/465 |
| **Desk subdomains** `email` `grok` `h7` `share` | Business desk `71.86.186.10` | **Let's Encrypt free** once public A records exist |
| **VPN me** `vpn` on `10.66.66.1` | WireGuard mesh only | Private · WG peer key = you |

## Desk software (this box)

| Layer | Tech | Role |
|-------|------|------|
| Iron | **ASM** multiarch (`OMEGA/`, `true_equates/`, `hostess7/`, …) | TRUE seats · OMEGA=Abobo · Hostess 7 |
| Language | **HTML5 + JS + CSS** (`bgrtx-lang.js`, Claws UI) | Translate/TRUE/Alpha/Dashpin · no MyMemory |
| Magazine public | **WordPress** (WP.com) | Public stampede |
| Magazine cohost | **WordPress** local `https://biggrinrtx.local` | Desk mirror / SDF · self-signed until LE on desk names |
| Mail desk | **email.biggrinrtx.com** Claws UI + Titan | Work + study |
| Office attach | **grok.biggrinrtx.com/email/** | Same Claws UI attached |
| Hostess | **h7.biggrinrtx.com** | Language when online · learn email API |

## DNS to finish legal LE for desk (do in WP.com Domains)

Keep **apex A** on WordPress.com (magazine).  
Add **A records only** for desk names:

```
email.biggrinrtx.com   A    71.86.186.10
grok.biggrinrtx.com     A    71.86.186.10
h7.biggrinrtx.com       A    71.86.186.10
share.biggrinrtx.com    A    71.86.186.10
```

Then:

```bash
sudo bgrtx-certbot-desk
```

Issues one Let's Encrypt cert `biggrinrtx-desk` for all four · wires Apache · auto-renew via `certbot.timer`.

## ACME ready on desk

- HTTP `:80` allows `/.well-known/acme-challenge/` (no redirect)
- Webroot: `/var/www/le-webroot`
- Helper: `/usr/local/bin/bgrtx-certbot-desk`

## Do not

- Do **not** point apex `biggrinrtx.com` A at the desk if magazine stays Atomic (you'd break WP.com hosting).
- Do **not** use MyMemory as mail language ground.
- Do **not** treat self-signed as production for public browsers.

## Canon

- **OMEGA** = Abobo's Big Adventure (sandboxed HTML5 + Ruffle · not a ROM)
- **ALPHA** = alphabet / TRUE study · return from OMEGA
- **Start** top-left · mail home
- **Dashpin** flyout · bottom dock

## Verify

```bash
# public magazine (WP.com legal TLS)
curl -sSI https://biggrinrtx.com/ | head -5

# after DNS + certbot:
curl -sSI https://email.biggrinrtx.com/ | head -8
echo | openssl s_client -connect email.biggrinrtx.com:443 -servername email.biggrinrtx.com 2>/dev/null | openssl x509 -noout -issuer -dates
```

Issuer should say **Let's Encrypt**, not BigGrinRTX Desk self-sign.