From 5ccf65afbb2734cd445de930a7d13af3f5c82ac3 Mon Sep 17 00:00:00 2001
From: Steven Welch <steven@makeitwork.cloud>
Date: Fri, 4 Sep 2026 22:51:02 -0600
Subject: [PATCH 1/2] feat(aws): add Orthodox Channel public web origin

---
 aws-channel-project-site-public-origin.tf | 32 +++++++++++++++++++++++
 main.tf                                   |  3 ++-
 2 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 aws-channel-project-site-public-origin.tf

diff --git a/aws-channel-project-site-public-origin.tf b/aws-channel-project-site-public-origin.tf
new file mode 100644
index 0000000..6ece497
--- /dev/null
+++ b/aws-channel-project-site-public-origin.tf
@@ -0,0 +1,32 @@
+# The public Orthodox Channel website origin follows the existing
+# makeitwork.cloud S3 website class. It is intentionally separate from the
+# private OAC-protected artifact bucket, which remains the rollback origin.
+# Publication remains limited to channel-project's main-only deployment role.
+resource "aws_iam_role_policy" "github_actions_channel_project_site_public_origin" {
+  name = "channel-project-site-public-origin"
+  role = aws_iam_role.github_actions_channel_project_site_deploy.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid      = "ListPublicSiteOrigin"
+        Effect   = "Allow"
+        Action   = ["s3:ListBucket"]
+        Resource = aws_s3_bucket.web["orthodox.channel"].arn
+      },
+      {
+        Sid    = "PublishPublicSiteAssets"
+        Effect = "Allow"
+        Action = [
+          "s3:AbortMultipartUpload",
+          "s3:DeleteObject",
+          "s3:GetObject",
+          "s3:ListMultipartUploadParts",
+          "s3:PutObject",
+        ]
+        Resource = "${aws_s3_bucket.web["orthodox.channel"].arn}/*"
+      },
+    ]
+  })
+}
diff --git a/main.tf b/main.tf
index 0f02c62..23d5a13 100644
--- a/main.tf
+++ b/main.tf
@@ -28,6 +28,7 @@ locals {
   s3_public_buckets = toset([])
   s3_web_buckets = toset([
     "makeitwork.cloud",
-    "onion.makeitwork.cloud"
+    "onion.makeitwork.cloud",
+    "orthodox.channel",
   ])
 }

From 6d50e6c5985d25289b6b801bbc507bb9b875d818 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sat, 5 Sep 2026 04:58:57 +0000
Subject: [PATCH 2/2] chore: apply pre-commit fixes

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index ea54471..4afa6ae 100644
--- a/README.md
+++ b/README.md
@@ -39,6 +39,7 @@ No modules.
 | [aws_iam_role_policy.github_actions_channel_project_site_deploy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
 | [aws_iam_role_policy.github_actions_channel_project_site_infrastructure](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
 | [aws_iam_role_policy.github_actions_channel_project_site_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
+| [aws_iam_role_policy.github_actions_channel_project_site_public_origin](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
 | [aws_iam_role_policy.github_actions_channel_project_state](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
 | [aws_iam_role_policy.github_actions_sops_kms](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
 | [aws_iam_role_policy.github_actions_twilio_state](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |