diff --git a/README.md b/README.md
index b005f072c..9df6aa10a 100644
--- a/README.md
+++ b/README.md
@@ -82,7 +82,7 @@ Use `config/relay.json` as the single source of truth for dev + prod relay setti
   "relayProtocol": "wss",
   "relayPeerId": "<relay-peer-id>",
   "relayIdentityFile": "config/relay-peer-id.json",
-  "relayConfigUrl": "https://relay.secretworkshop.net/relay-config.json",
+  "relayConfigUrl": "https://secretworkshop.net/peercompute/config/relay-config.json",
   "relayConfigFile": "config/relay-config.json",
   "listenHost": "127.0.0.1",
   "listenPort": "8080",
diff --git a/config/relay.json b/config/relay.json
index 793f4b577..345dc0ee2 100644
--- a/config/relay.json
+++ b/config/relay.json
@@ -4,7 +4,7 @@
   "relayProtocol": "wss",
   "relayPeerId": "",
   "relayIdentityFile": "config/relay-peer-id.json",
-  "relayConfigUrl": "https://relay.secretworkshop.net/relay-config.json",
+  "relayConfigUrl": "https://secretworkshop.net/peercompute/config/relay-config.json",
   "relayConfigFile": "config/relay-config.json",
   "bootstrapPeers": [],
   "publicHost": "",
diff --git a/plan/log.md b/plan/log.md
index cd0eeafc8..737c58245 100644
--- a/plan/log.md
+++ b/plan/log.md
@@ -230,6 +230,43 @@ Instructions: This file contains a detailed implementation log describing choice
 
 ## Date: 2025-12-27
 
+### Prompt
+- ok put these instructions at the end of log.md
+
+### Changes
+- Appended deployment checklist for VM/nginx relay config.
+
+### Deployment Checklist (VM)
+1) Pull latest repo changes on the VM.
+2) Generate the relay config file from the repo root:
+```
+bash scripts/start-relay-prod.sh
+```
+3) Ensure nginx can read the config file (keep identity key private):
+```
+chmod 755 /home/cos /home/cos/projects /home/cos/projects/peercompute /home/cos/projects/peercompute/config
+chmod 644 /home/cos/projects/peercompute/config/relay-config.json
+chmod 600 /home/cos/projects/peercompute/config/relay-peer-id.json
+```
+4) Update the nginx alias to the repo path:
+```
+location = /peercompute/config/relay-config.json {
+    alias /home/cos/projects/peercompute/config/relay-config.json;
+    default_type application/json;
+    add_header Access-Control-Allow-Origin *;
+    add_header Cache-Control "no-store";
+}
+```
+5) Reload nginx:
+```
+sudo nginx -t
+sudo systemctl reload nginx
+```
+6) Verify the config URL loads:
+- `https://secretworkshop.net/peercompute/config/relay-config.json`
+
+## Date: 2025-12-27
+
 ### Prompt
 - looks like we weren't able to write to that location for nginx can we reconfigure nginx to serve that file directly from the config directory?
 
@@ -237,6 +274,15 @@ Instructions: This file contains a detailed implementation log describing choice
 - Pointed `relayConfigFile` to `config/relay-config.json` and updated nginx alias in `secretworkshop.net` to serve the config file from the repo config directory.
 - Updated README and gitignore to reflect the new relay-config file location.
 
+## Date: 2025-12-27
+
+### Prompt
+- lets host it at secretworkshop.net/peercompute/config/relay-config.json
+
+### Changes
+- Updated nginx config to serve the relay config at `/peercompute/config/relay-config.json`.
+- Updated `config/relay.json` and README defaults to match the new relay config URL.
+
 ## Date: 2025-12-25
 
 ### Prompt
diff --git a/secretworkshop.net b/secretworkshop.net
new file mode 100644
index 000000000..bc313f7cf
--- /dev/null
+++ b/secretworkshop.net
@@ -0,0 +1,131 @@
+server {
+    server_name relay.secretworkshop.net;
+
+    location / {
+        proxy_pass http://localhost:8080;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
+    }
+
+    location = /peercompute/config/relay-config.json {
+        alias /home/cos/projects/peercompute/config/relay-config.json;
+        default_type application/json;
+        add_header Access-Control-Allow-Origin *;
+        add_header Cache-Control "no-store";
+    }
+
+    listen [::]:443 ssl; # managed by Certbot
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/secretworkshop.net/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/secretworkshop.net/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name relay.secretworkshop.net;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    server_name secretworkshop.net *.secretworkshop.net;
+
+    #root /var/www/secretworkshop.net;
+    #index index.html;
+ location =  / {
+ return 301 https://ubernaut.github.io/secret-workshop/;
+	#proxy_pass http://localhost:3000/;
+}
+
+# location = / {
+#  proxy_pass http://localhost:3000/;
+    #return 301 http://$host/secret-workshop/;
+ #}
+    location /secret-workshop/ {
+	proxy_pass http://localhost:3000/secret-workshop/;
+    }
+  location /void/ {    
+    proxy_pass http://localhost:9000/;
+  }
+ location /void-server/ {
+    proxy_pass http://localhost:1137/;
+ }
+# location /cubechat/ {    proxy_pass http://localhost:8080/;}
+
+location /cubechat/ {
+    proxy_pass http://localhost:8080/;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header Host $host;
+    # Optional: Pass real client IP and protocol to backend
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+}
+
+ location /socket.io/ {
+    #add_header 'Access-Control-Allow-Origin' '*' always;
+    #add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
+    #add_header 'Access-Control-Allow-Headers' 'Authorization,Accept,Origin,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
+    #add_header 'Access-Control-Allow-Methods' 'GET,POST,OPTIONS,PUT,DELETE,PATCH';
+    rewrite ^/socket\.io/(.*)$ /socket.io/$1 break;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "Upgrade";
+    proxy_set_header Host $host;
+    proxy_pass http://localhost:1137/;
+ }
+
+    listen [::]:443 ssl ipv6only=on; # managed by Certbot
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/secretworkshop.net/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/secretworkshop.net/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+
+server {
+    if ($host = secretworkshop.net) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen  80;
+    listen [::]:80;
+    server_name secretworkshop.net;
+    return 404; # managed by Certbot
+
+
+}
+
+#server {
+ # listen 443 ssl http2;
+  #listen [::]:443 ssl http2;
+
+   #Replace sub1.example.com with the name of your first subdomain.
+  #server_name void.secretworkshop.net;
+
+#    listen [::]:443 ssl ipv6only=on; # managed by Certbot
+#    listen 443 ssl; # managed by Certbot
+#    ssl_certificate /etc/letsencrypt/live/secretworkshop.net/fullchain.pem; # managed by Certbot
+#    ssl_certificate_key /etc/letsencrypt/live/secretworkshop.net/privkey.pem; # managed by Certbot
+#    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+#    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+
+  # This block forwards traffic to the Docker container for the first subdomain.
+#  location / {
+#    proxy_pass http://localhost:9000/;
+#  }
+#}