From 384d3dd3c7fdbc588a920e2f8d3e2c643b87d1dd Mon Sep 17 00:00:00 2001
From: Local Dev <dev@localhost>
Date: Wed, 7 Oct 2026 19:18:11 +0200
Subject: [PATCH] drop(gateway): subdomain suffix *.bch.navigate.st retired for
 *.bns
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"bch.navigate.st" lied on every non-.bch name — sirius.x served as
sirius-x.bch.navigate.st reads like a BCH-TLD name. "bns" (Bitcoin
Cash Name Service, the actual protocol name) is accurate for every
TLD and the same length.

Hard swap, no deprecation window:
  BNS_SUB_BASE defaults to "bns.navigate.st"
  BNS_SUB_BASE_LEGACY defaults to "" (empty) — .bch is NOT accepted
  on inbound anymore; the matcher 404s *.bch.navigate.st hostnames.

Operators who want a temporary grace period can still set
BNS_SUB_BASE_LEGACY=bch.navigate.st in systemd env until bookmarks
have had time to migrate. nginx vhost bch-subdomain must be disabled
in parallel for the drop to be real at the TLS layer.
---
 src/gateway/public-gateway.mjs | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/src/gateway/public-gateway.mjs b/src/gateway/public-gateway.mjs
index 05c3731..230239b 100644
--- a/src/gateway/public-gateway.mjs
+++ b/src/gateway/public-gateway.mjs
@@ -257,20 +257,20 @@ async function activeListings() {
   return keep;
 }
 const S3_ENDPOINT = process.env.BNS_S3 || "http://127.0.0.1:8500";
-// Primary subdomain suffix — new URLs (banner "Isolated view" link, OG
-// hints, etc.) are built against this. Flip to "bns.navigate.st" once the
-// wildcard cert is issued; "bch.navigate.st" remains the current default
-// so no cutover is required.
-const SUB_BASE = (process.env.BNS_SUB_BASE || "bch.navigate.st").toLowerCase();
-// Every suffix the inbound-matching accepts. "bch.navigate.st" was the
-// original and stays live for the ~6-month deprecation window; "bns.
-// navigate.st" is the renamed form (BNS = Bitcoin Cash Name Service, the
-// actual protocol name, instead of the misleading .bch segment on
-// non-.bch names like sirius-x.bch.navigate.st). Both decode through the
-// same subdomainLabelToName.
+// Subdomain suffix for the relay. "bns.navigate.st" because "bns"
+// (Bitcoin Cash Name Service — the protocol) is accurate on every BCDN
+// TLD; the old "bch.navigate.st" lied about non-.bch names (sirius.x
+// was served as sirius-x.bch.navigate.st, reading like a .bch name).
+// The .bch form has been dropped — URL bookmarks or links that hit
+// *.bch.navigate.st 404 at the nginx layer. Fallback env var keeps
+// one knob available if an operator deploys with the old suffix.
+const SUB_BASE = (process.env.BNS_SUB_BASE || "bns.navigate.st").toLowerCase();
+// Operator-side override: comma-separated extra suffixes to accept on
+// inbound. Empty by default (dropping .bch means dropping it). Set
+// BNS_SUB_BASE_LEGACY=bch.navigate.st for a temporary grace period.
 const SUB_BASE_ALL = Array.from(new Set([
   SUB_BASE,
-  ...(process.env.BNS_SUB_BASE_LEGACY || "bch.navigate.st,bns.navigate.st")
+  ...(process.env.BNS_SUB_BASE_LEGACY || "")
     .toLowerCase().split(",").map((s) => s.trim()).filter(Boolean),
 ]));