infra(deploy): serve MCP on multiple domains + SKIP_BUILD for label-only redeploys

The prod connector domain (fleetmcp.rahamafresh.com) had no Traefik router —
deploy.sh only ever set one HOST_DOMAIN (defaulting to fleetmcp.fivetitude.com),
so requests to the prod domain returned 503 "no available server" even with the
container healthy.

- HOST_DOMAINS: comma-separated list folded into one Traefik router rule
  (Host(`a`) || Host(`b`)). One LE cert covers all names (SANs), so connectors
  on either domain keep working. Defaults to HOST_DOMAIN (back-compatible).
- SKIP_BUILD=1: reuse the existing image for a labels/env-only redeploy, so a
  routing change can't accidentally bake in new/stale code.

Deployed to prod with HOST_DOMAINS="fleetmcp.rahamafresh.com,fleetmcp.fivetitude.com";
both domains verified (healthz 200, /mcp 401, valid SAN cert).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy.sh

@@ -24,6 +24,20 @@ set -euo pipefail
 NAME=analytics_mcp
 PORT=8892
 HOST_DOMAIN="${HOST_DOMAIN:-fleetmcp.fivetitude.com}"   # prod: fleetmcp.rahamafresh.com
+# Comma-separated list of every domain this service answers on (defaults to
+# HOST_DOMAIN). All are folded into ONE Traefik router rule so a single cert
+# covers them and connectors on either domain keep working.
+HOST_DOMAINS="${HOST_DOMAINS:-$HOST_DOMAIN}"
+BT='`'
+RULE=""
+IFS=',' read -ra _DOMS <<< "$HOST_DOMAINS"
+for _d in "${_DOMS[@]}"; do
+  _d="${_d// /}"
+  if [ -n "$_d" ]; then
+    seg="Host(${BT}${_d}${BT})"
+    if [ -z "$RULE" ]; then RULE="$seg"; else RULE="$RULE || $seg"; fi
+  fi
+done
 IMAGE="fleetanalytics-mcp:latest"
 ENV_FILE="$(pwd)/.deploy.env"
 
@@ -53,9 +67,15 @@ RO_PW=$(cat "${ANALYTICS_RO_PW_FILE:-$HOME/.analytics_ro.pw}" 2>/dev/null || tru
 HOSTPART="${SRC_DB_URL#*@}"                       # host:port/dbname[?params]
 RO_DB_URL="postgresql://analytics_ro:${RO_PW}@${HOSTPART}"
 
-# Build the image from this repo.
+# Build the image from this repo (SKIP_BUILD=1 reuses the existing image for a
-echo "Building $IMAGE ..."
+# labels/env-only change — no new code is pulled in).
-docker build -t "$IMAGE" .
+if [ "${SKIP_BUILD:-0}" = "1" ]; then
+  echo "SKIP_BUILD=1 — reusing existing $IMAGE (no rebuild)."
+  docker image inspect "$IMAGE" >/dev/null 2>&1 || { echo "ERROR: $IMAGE not present"; exit 1; }
+else
+  echo "Building $IMAGE ..."
+  docker build -t "$IMAGE" .
+fi
 
 # Minimal env (read-only DSN + auth only — no Tracksolid ingestion secrets).
 { echo "DATABASE_URL=${RO_DB_URL}"; echo "MCP_AUTH_TOKENS=${MCP_AUTH_TOKENS}"; } > "$ENV_FILE"
@@ -73,9 +93,9 @@ docker run -d --name "$NAME" --restart unless-stopped \
   --label 'traefik.http.middlewares.fleetmcp-ratelimit.ratelimit.burst=60' \
   --label "traefik.http.routers.http-0-fleetmcp.entryPoints=http" \
   --label "traefik.http.routers.http-0-fleetmcp.middlewares=redirect-to-https" \
-  --label "traefik.http.routers.http-0-fleetmcp.rule=Host(\`${HOST_DOMAIN}\`)" \
+  --label "traefik.http.routers.http-0-fleetmcp.rule=${RULE}" \
   --label "traefik.http.routers.https-0-fleetmcp.entryPoints=https" \
-  --label "traefik.http.routers.https-0-fleetmcp.rule=Host(\`${HOST_DOMAIN}\`)" \
+  --label "traefik.http.routers.https-0-fleetmcp.rule=${RULE}" \
   --label "traefik.http.routers.https-0-fleetmcp.middlewares=fleetmcp-ratelimit" \
   --label "traefik.http.routers.https-0-fleetmcp.tls=true" \
   --label "traefik.http.routers.https-0-fleetmcp.tls.certresolver=letsencrypt" \