OpeItcLoc03/admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tasks(iis-migration-to-ruvds): partial cutover live — kupimknigi DNS flipped

Browse Source 
Session 2026-05-23 evening → 2026-05-24: full snolla site migration
windows-recovery-host → RUVDS Win Server 2025 Core, partial DNS cutover для
1 prod hostname (kupimknigi.spb.ru), оставшиеся 24 hostnames pending.

What's live on RUVDS:
- snolla IIS site catch-all *:80: + 25 HTTPS SNI bindings (1 per hostname,
  LE certs от 2026-04-23 / valid до 2026-07-22)
- 8.66 GB / 44725 files transferred via scp после ISP-block discovery
- ApplicationPoolIdentity + ACL grant verified
- HTTP/2 auto-negotiated, MSSQL/imgproxy/MinIO connectivity OK from RUVDS

Findings (Decisions log в task file для деталей):
1. Outbound 445 блокирует home ISP (не RUVDS FW) — `windows-server-2025-core-bootstrap.md`
   SMB-section deprecated, SSH/scp = canonical transfer-метод.
2. Home network HTTP-middlebox mangles Host header в outbound external HTTP —
   тест с source даёт garbled response; тест с VDS (третья сеть) даёт корректный.
3. traefik acme.json → IIS PFX recipe: extract base64 cert+key per cert →
   openssl pkcs12 -export → Import-PfxCertificate + AddSslCertificate by
   thumbprint with SslFlags=1 (SNI). Reusable, потенциально новый concept.
4. IIS 10 на Win Server 2025 говорит HTTP/2 by default через TLS.
5. 4 hostnames (maljarka.tandemmebel.ru + 3 rimiz) → 502/404 на RUVDS;
   на source IIS:8089 возвращают 200 default-page. Pre-existing CMS-tenant
   config gap, не migration defect.

Scripts added:
- scripts/iis-migration-to-ruvds/01-ruvds-bootstrap.ps1 (idempotent)
- scripts/iis-migration-to-ruvds/02-source-transfer.ps1 (не использовался —
  SMB не работает; оставлен как reference)
- scripts/iis-migration-to-ruvds/README.md

Cleanup done:
- Plaintext PFX/PEM keys в C:\Users\vitya\iis-backup-pre-ruvds\certs\ удалены
  (PFX import на RUVDS уже сделан, source-of-truth = traefik acme.json).
- `.secrets/` уже удалён ранее в этой session (см. предыдущий commit).

Source state: IIS:8089 + traefik routes ALIVE — rollback ready. Decommission
после 1-week soak с RUVDS как live prod.

Не push'нуто — ждёт user grant per project-discipline Rule 4.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
vitya
2026-05-24 10:01:20 +03:00
parent fdefe96d6f
commit 7693400239
5 changed files with 461 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
.tasks/STATUS.md
View File

@@ -1,5 +1,5 @@
# Admin Task Board
_Updated: 2026-05-23 (Session-recovery: temp admin начал `[iis-migration-to-ruvds]` 2026-05-23 (09:37 creds в `.secrets/` plaintext, 18:01 size probe, 18:08 robocopy upal exit 16 «сетевой путь не найден»), drop'нул tree dirty. Восстановлено: creds → `pass show ruvds-iis/full-env`, `.secrets/` removed + gitignored, root-cause SMB-445 closed на fresh Win Server 2025 Core зафиксирован в [`windows-server-2025-core-bootstrap`](../.wiki/concepts/windows-server-2025-core-bootstrap.md), task ⚪ → 🟡 paused с concrete next-step. Previous session (2026-05-22): MSSQL Express 2022 live (`mssql.kzntsv.site:1433`, 5 DBs, 8 prod hosts 200 OK). MinIO/imgproxy VDS stack live as standby (CMS остаётся на windows из-за hardcoded URL в closed-source DLL). board-viewer-vds-deploy ✓ (board.kzntsv.site + basicauth). Portainer-migration sweep: 12 ad-hoc stacks → Portainer-managed.)_
_Updated: 2026-05-24 (IIS migration to RUVDS — **partial cutover live**: snolla site (8.66 GB / 44725 files) transferred via scp (после ISP outbound-445 block обнаружен), IIS recreated, 25 HTTPS SNI bindings с LE certs (re-used from traefik acme.json), 7 prod hostnames live-smoked через VDS (третья сеть) → 200 OK + correct content. DNS A для kupimknigi.spb.ru flipped на 80.64.31.36 (после initial misroute на VDS). Soak window: 24h+. Source IIS:8089 + traefik routes ALIVE — rollback ready. Previous: temp admin start 2026-05-23 09:37-18:08, dropped на UNC-robocopy exit 16; secrets-leak в `.secrets/` fixed → `pass`. См. также 2026-05-22 chain: MSSQL Express 2022 live на `mssql.kzntsv.site:1433` (5 DBs, 8 prod hosts 200 OK), MinIO/imgproxy VDS standby.)_
<!--
Status legend:
@@ -698,22 +698,24 @@ Copy-Item C:\sites\snolla\Web.config.bak-pre-vds-cutover-20260522 C:\sites\snoll
---
## 🟡 [iis-migration-to-ruvds] — Migrate 11 IIS sites from DESKTOP-NSEF0UK to RUVDS Windows Server 2025 Core
## 🟡 [iis-migration-to-ruvds] — RUVDS IIS live для 1 prod hostname (`kupimknigi.spb.ru`), 24 в очереди; источник held для rollback
**Status:** paused
**Where I stopped:** 2026-05-23 18:08 — failed-robocopy на fresh RUVDS (`exit 16 «сетевой путь не найден»`). Root cause зафиксирован: TCP/445 closed по дефолту на Win Server 2025 Core + SMB share не создан → UNC robocopy не работает без bootstrap RUVDS-стороны. Полный finding + transfer-методов матрица — в [`windows-server-2025-core-bootstrap`](../.wiki/concepts/windows-server-2025-core-bootstrap.md). Source size probe done: `C:\sites\snolla\` = 8.66 GB; 11 sites суммарно может быть 30-50 GB → **possible RUVDS 30 GB HDD capacity blocker** (см. Open questions).
**Next action:** Decision требуется (user) перед continuing:
1. **Capacity audit на source:** `Get-ChildItem C:\sites -Directory | %{ [PSCustomObject]@{Name=$_.Name; SizeGB=[math]::Round((Get-ChildItem $_.FullName -Recurse -EA SilentlyContinue | Measure-Object -Property Length -Sum).Sum / 1GB, 2)} } | Sort-Object SizeGB -Descending` — total для 11 sites. Если >25 GB → upgrade RUVDS HDD plan ИЛИ selective transfer (drop logs/cache).
2. **Transfer-метод confirm:** recommendation = SMB inbound с source-IP whitelist (см. concept). Альтернативы (RDP-redirect / WinRM / SFTP) в concept'е, выбор на user'е.
3. **RUVDS bootstrap:** RDP, `Install-WindowsFeature Web-Server -IncludeAllSubFeature -IncludeManagementTools`, verify .NET 4.8 (Release ≥ 528040), install URL Rewrite 2.1, open FW 80/443 + SMB-from-source. Полный чеклист — concept §Bootstrap-чеклист.
4. **Backup source IIS state:** `appcmd list site -config > sites-backup.txt` + `applicationHost.config` copy.
5. **Transfer + recreate IIS sites + Web.config conn-strings → `mssql.kzntsv.site,1433`** (matches `[mssql-vds-migration]`).
6. **Pilot kupimknigi.spb.ru через hosts-file → 24h soak → DNS swap.**
**Status:** in_progress (DNS partial cutover — soak window 2026-05-24)
**Where I stopped:** 2026-05-24 ~00:00 — `kupimknigi.spb.ru` DNS A flipped на 80.64.31.36 в reg.ru, authoritative `ns1.reg.ru` корректный, public resolver caches (8.8.8.8=6h, 1.1.1.1=24h, Yandex=2h) держат старое значение → real users мигрируют постепенно по TTL expiry. RUVDS state: snolla site (8.66 GB / 44725 files) transferred + IIS recreated + 25 HTTPS SNI bindings с LE certs (R13, valid до 2026-07-22), 7 prod hostnames live-smoke через VDS (третья сеть) → 200 OK / correct content. Source IIS:8089 + traefik routes ALIVE — rollback ready.
**Findings зафиксированы в** [iis-migration-to-ruvds.md](iis-migration-to-ruvds.md) Decisions log: (1) outbound 445 блокирует home ISP, не RUVDS-FW → SSH/scp = canonical transfer-метод (deprecate SMB section в `windows-server-2025-core-bootstrap.md`); (2) home network HTTP-middlebox mangles Host header for direct external HTTP — real end-users не пострадают, тестировать через VDS; (3) traefik acme.json → IIS PFX recipe работает (extract + openssl pkcs12 -export + Import-PfxCertificate + AddSslCertificate by thumbprint); (4) IIS 10 HTTP/2 default; (5) `maljarka.tandemmebel.ru` + 3 rimiz hostnames вернули 502/404 — pre-existing CMS-tenant config gap, не migration defect.
**Next action:**
1. **Снизить DNS TTL** в reg.ru на остальные 24 hostnames до 300s — `pilorama98.ru`, `emspb.ru`, `tandemmebel.ru`, `labtools.{ru,pro}`, `snolla.com` + 11 snolla subdomains. Это сократит будущий cache-tail с 24h до 5 мин.
2. **24h soak kupimknigi** — проверить через cache-clean resolver (можно подождать пока 8.8.8.8 cache expire'нет — ~6h, потом curl без `--resolve`).
3. **Bulk DNS swap** оставшихся 24 hostnames на 80.64.31.36 (single sitting).
4. **1-week prod soak** с RUVDS как live source.
5. **Decommission source IIS:8089** (но не traefik сам — много non-CMS routes остаётся): stop/remove IIS site `snolla` на windows-recovery-host + remove CMS traefik yml files.
6. **LE renewal pipeline** — win-acme + HTTP-01 на RUVDS после full cutover (LE certs expire 2026-07-22, soak window до ~07-15).
7. **Cleanup migration-temp:** `Remove-NetFirewallRule -DisplayName 'smb-from-source','ssh-from-source'` на RUVDS, удалить `~/.ssh/ruvds-iis-migration*` на source, очистить `C:\ProgramData\ssh\administrators_authorized_keys` на RUVDS.
Полный план + Decisions log + Open questions — в [iis-migration-to-ruvds.md](iis-migration-to-ruvds.md).
Полный план + Completed + Open questions + Remaining steps — в [iis-migration-to-ruvds.md](iis-migration-to-ruvds.md).
**Branch:** master
<!-- created-by: user-decision / 2026-05-22 / trigger: RUVDS purchased -->
<!-- paused-by: vitya / 2026-05-23 evening / session-recovery после failed-robocopy + secrets-leak fix -->
<!-- partial-cutover-by: vitya / 2026-05-24 / kupimknigi DNS flipped, 24 hostnames pending -->
---