Epic: Move production to provider C (after staging is proven)

[crtahlin]

Epic: Move production to provider C (after staging is proven)

Follow-up to #240. Once the staging environment is running on its own VM on provider C and both flows are re-verified there, migrate production the same way: its own VM on C, decoupled from the current shared host.

Gated on #240 — do not start until staging is validated and the runbook (#246) exists.

Why

• Production currently shares a host (and Bee) with staging; Epic: Move staging to a dedicated Contabo VM (gateway + testnet Bee) #240 decouples staging, this epic gives prod its own isolated, controlled box.
• Same-spec cost on C is materially lower than the current setup.
• Reuse the exact install process documented in the staging runbook (Document the staging install as a reproducible runbook #246), adjusted for mainnet.

Plan (sub-issues to be split out from this checklist once #240 is done)

• Provision + harden the prod VM on C (same hardening as Provision + harden the staging VM (Docker, firewall, egress check) #241).
• Decision + stand-up of the mainnet Bee: full node (reserve/stake) vs light node, or connect to an existing/managed Bee. The gateway only needs upload/download, but prod may want a full node for reliability — decide and record the rationale.
• Deploy the prod gateway on the VM, pointed at the prod Bee; mainnet chain (GNOSIS_CHAIN_ID=100) config.
• Repoint CI/CD so the main branch deploys to the prod VM on C (mirror of Repoint CI/CD: dev branch deploys to the staging VM #245 for prod; deploy creds as secrets).
• DNS cutover for the production domain: pre-lower TTL, cut over, keep a documented rollback to the old host.
• Post-migration verification: /health ok, Bee networkAvailability=Available, Flow A (Epic: Agent-controlled uploads — stamped-chunk forwarding with prepaid bandwidth credit (Flow A) #218) re-verified on mainnet. Flow B (Epic: Flow B — gateway purchases postage batches owned by an external wallet (createBatch on Gnosis) #225) stays off by default; enable only deliberately with funded mainnet signer + allow-list.
• Decommission the old shared host once prod is stable on C.
• Update the runbook (Document the staging install as a reproducible runbook #246) with the mainnet specifics encountered.

Acceptance criteria (epic)

• Production runs on its own VM on C, no shared Bee/host with staging.
• main pushes deploy to the prod VM via CI/CD; old host retired.
• Prod reachable over HTTPS on the production domain with a clean DNS cutover (rollback documented).
• Flow A re-verified on mainnet prod; Flow B verifiable on demand behind its guards.
• Runbook updated so the process is reproducible.

Constraints / notes

• No secrets, keys, IPs, hostnames, or provider-account details in this public repo — keep them in the private store referenced by the runbook.
• Plan the DNS cutover to minimise downtime; never push directly to main.