OpeItcLoc03/admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mssql+minio vds migration done — IIS snolla cutover live

Browse Source 
- mssql-vds-migration 🟢: Express 2022 Linux на mssql.kzntsv.site:1433,
  5 DBs restored (schema 2019→2022 auto-upgrade), 8 prod hosts 200 OK
- minio-imgproxy-vds-migration 🟡: stack live, 3 GiB / 19324 obj mirrored
  (2020→2025 upgrade via S3 API), DNS swap imgproxy.kzntsv.site pending
- iis-cutover-to-vds-services 🟡: 1 web.config edit catch-all для 11 hosts;
  MinIO leg pending DNS swap (URLs уже через imgproxy.kzntsv.site domain)
- 3 wiki concepts: mssql-on-vds, minio-imgproxy-on-vds, index updated

Findings: (1) server logins НЕ переезжают в .bak — orphan fix manual,
(2) traefik recreate-not-restart для port mapping change,
(3) PowerShell не вызывает pass bash-script (NULL pw → misleading auth fail),
(4) mc 2025 не auto-creates target buckets, (5) non-ASCII filename silent
skip в mc mirror — verify по count+size обязательно.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
vitya
2026-05-22 09:55:17 +03:00
parent 86a94d7f9d
commit e17e8eb1c3
4 changed files with 278 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

98
.wiki/concepts/minio-imgproxy-on-vds.md Normal file
View File

@@ -0,0 +1,98 @@
---
title: MinIO + imgproxy stack on vds-kzntsv
status: live (data-layer); DNS swap pending для imgproxy.kzntsv.site
tags: [vds, minio, imgproxy, migration, ops]
related: [[vds-kzntsv]], [[recovery-architecture-snapshot]], [[mssql-on-vds]]
---
# MinIO + imgproxy on vds-kzntsv
Запущен 2026-05-22 как часть `minio-imgproxy-vds-migration`. Заодно **upgrade MinIO** `RELEASE.2020-07-13` (5 лет, CVE-куча) → `RELEASE.2025-09-07`.
## Architecture
```
CMS templates (URL pattern: imgproxy.kzntsv.site/<sig>/.../plain/s3://<bucket>/<path>)
→ traefik (windows-host) [пока, до DNS swap]
→ imgproxy-nginx (windows-host) [пока]
→ imgproxy (windows-host) [пока]
→ MinIO localhost:9000 (windows-host) [пока]
После DNS swap imgproxy.kzntsv.site → 89.253.255.94 (VDS):
→ VDS traefik (HTTPS, LE cert)
→ imgproxy-nginx (VDS, nginx:alpine, 10 GB cache)
→ imgproxy (VDS, darthsim/imgproxy:latest)
→ minio (VDS, RELEASE.2025-09-07, internal docker DNS через proxy network)
```
Stack: `/opt/stacks/storage/minio-imgproxy/{docker-compose.yml,.env,data,nginx.conf,nginx-cache}`. Все 3 контейнера в `proxy` network — service-name DNS работает.
**Traefik routes (live):**
- `minio.vds.kzntsv.site` → minio:9000 (S3 API)
- `minio-console.vds.kzntsv.site` → minio:9001 (web UI)
- `imgproxy.vds.kzntsv.site` → imgproxy-nginx:80 (test endpoint pre-cutover)
После DNS swap имя `imgproxy.kzntsv.site` (без `.vds.`) добавить в traefik label imgproxy-nginx сервиса.
## Migration recipe
```bash
# 1. pass insert (local) — preserve original IMGPROXY_KEY/SALT, reuse MinIO creds
pass insert -m minio-vds/full-env <<EOF
MINIO_ROOT_USER=<same-as-source>
MINIO_ROOT_PASSWORD=<same-as-source>
IMGPROXY_KEY=<same-as-source-128hex>
IMGPROXY_SALT=<same-as-source-128hex>
EOF
# 2. VDS: create dir + scp nginx.conf + write .env from pass + write compose
ssh vitya@vds 'sudo mkdir -p /opt/stacks/storage/minio-imgproxy/{data,nginx-cache}
sudo chown -R vitya:vitya /opt/stacks/storage'
scp <source>/nginx.conf vitya@vds:/opt/stacks/storage/minio-imgproxy/
pass show minio-vds/full-env | ssh vitya@vds 'cat > /opt/stacks/storage/minio-imgproxy/.env
chmod 600 .env'
# 3. docker compose up -d (image pull + start all 3)
# 4. Local mc setup + bucket prep
mc alias set old http://localhost:9000 <creds>
mc alias set new https://minio.vds.kzntsv.site <creds> --insecure
for b in $(mc ls old | awk '{print $NF}' | tr -d /); do
mc mb --ignore-existing new/$b --insecure # mc 2025 не auto-creates на mirror
done
# 5. Mirror (background, ~1 час на 3 GB при 600 KiB/s)
mc mirror --preserve --quiet --overwrite old new --insecure
# 6. Verify per-bucket (size + object count)
for b in $(mc ls old | awk '{print $NF}' | tr -d /); do
echo "[$b]"; mc du old/$b; mc du new/$b --insecure
done
```
## Gotchas
1. **MinIO upgrade 5-летний gap WORKS via mc mirror** — старый FS backend (2020) → новый erasure-coded single-drive (2025) совместим через S3 API copy. `mc mirror` reads через S3 API, не сырое filesystem. Бинарный bind-mount свопнуть НЕЛЬЗЯ — формат `xl.meta` разный, новый MinIO не поднимется на старых dirs.
2. **mc 2025 НЕ auto-creates target buckets** — old mc (<2023?) делало неявно. Симптом: `Failed to perform mirroring The specified bucket does not exist`. Fix: `mc mb --ignore-existing new/<b>` для каждого bucket заранее.
3. **Non-ASCII filenames + slow uplink → partial mirror failure**: один файл `Albrecht Dürer ...tif` (30 MiB) в `imgproxytest` bucket не доехал с первого `mc mirror` exit=0 — silent skip без error. Retry того же `mc mirror` подтащил. Recommendation: всегда verify по object count + size после mirror, не doверять exit code.
4. **IMGPROXY_KEY + IMGPROXY_SALT preserve обязательно** — это HMAC signing для URLs. Если поменять, все pre-existing CMS image URLs (signed ссылки в шаблонах + кешированные в admin) ломаются. Reuse same values из source.
5. **MinIO root creds vs AWS-style**: source использует MINIO_ACCESS_KEY/MINIO_SECRET_KEY (deprecated env vars), новый MinIO — MINIO_ROOT_USER/MINIO_ROOT_PASSWORD. Reuse same values (no rotation в этой миграции) → CMS+imgproxy credentials не меняются. Rotation — отдельная hardening-таска.
## DNS swap (pending — user action)
`imgproxy.kzntsv.site` сейчас A-record на windows-host IP. Чтобы переключить картинки на VDS:
1. REGRU: `imgproxy.kzntsv.site` A → 89.253.255.94 (TTL 300s).
2. Дождаться propagate (`Resolve-DnsName imgproxy.kzntsv.site`).
3. В `/opt/stacks/storage/minio-imgproxy/docker-compose.yml` для service `imgproxy-nginx` добавить router rule `imgproxy.kzntsv.site` рядом с existing `imgproxy.vds.kzntsv.site`.
4. `docker compose up -d` (apply labels).
5. LE cert auto-issued.
## Rollback
```bash
# On VDS
cd /opt/stacks/storage/minio-imgproxy && sudo docker compose down -v
# Source windows-host MinIO + imgproxy + imgproxy-nginx должны быть still running (48ч uptime acceptance).
# Если уже decommissioned — docker start minio imgproxy imgproxy-nginx.
# Snapshot insurance: tar archive bind-mount source data preserved отдельно (acceptance step 3).
```

99
.wiki/concepts/mssql-on-vds.md Normal file
View File

@@ -0,0 +1,99 @@
---
title: MSSQL on vds-kzntsv (Express 2022 Linux)
status: live
tags: [vds, mssql, migration, ops]
related: [[vds-kzntsv]], [[recovery-architecture-snapshot]], [[traefik-tcp-passthrough-vs-starttls]], [[db-tls-self-signed-via-traefik-raw-tcp]]
---
# MSSQL on vds-kzntsv
Запущен 2026-05-22 как часть `mssql-vds-migration`. SPOF с windows-recovery-host снят для CMS DB park.
## Architecture
```
IIS snolla site (web.config)
→ mssql.kzntsv.site:1433 (LE/DNS A → 89.253.255.94)
→ VDS traefik :1433 (TCP entrypoint, HostSNI(*))
→ mssql container :1433 (self-signed TLS terminated по TDS)
→ /var/opt/mssql/data/{5 prod DBs}
```
Stack: `/opt/stacks/databases/mssql/{docker-compose.yml,.env,data,backups}`. Networks `proxy` only.
**Image:** `mcr.microsoft.com/mssql/server:2022-latest` (RTM-CU25, build 16.0.4255.1, on Ubuntu 22.04.5 LTS).
**Edition:** Express (`MSSQL_PID=Express`) — production licensing OK, 10 GB/DB cap (max .mdf сейчас `stostayer` 968 MB → 10× запас).
**Memory:** `MSSQL_MEMORY_LIMIT_MB=2048` env (Express auto-caps на 1410 в любом случае).
**TLS:** self-signed cert, mssql generates automatically. Client connects with `TrustServerCertificate=True`. Traefik forwards raw TCP — TLS terminates at mssql.
## Migration recipe (one-shot, executed 2026-05-22)
Источник: `mcr.microsoft.com/mssql/server:2019-latest` Developer на windows-recovery-host (volume `mssql_mssql_data` 26.6 GB; real data ~2.4 GB; .ldf logs 12 GB inflated).
```sql
-- 1. Source: BACKUP DATABASE for each prod DB (5 total)
BACKUP DATABASE [<db>] TO DISK='/var/opt/mssql/backups/<db>.bak'
WITH COMPRESSION, COPY_ONLY, INIT, STATS=50;
-- Compressed total: 486 MB (10× от .mdf size — built-in compression на UTF-16/varchar pads)
```
```bash
# 2. Extract from container → scp → VDS bind
docker cp mssql:/var/opt/mssql/backups/. C:/tmp/mssql-backups/
scp C:/tmp/mssql-backups/*.bak vitya@vds.kzntsv.site:/tmp/mssql-bak-staging/
ssh vitya@vds.kzntsv.site 'sudo mv /tmp/mssql-bak-staging/*.bak /opt/stacks/databases/mssql/backups/
sudo chown 10001:0 /opt/stacks/databases/mssql/backups/*.bak'
```
```yaml
# 3. compose + .env (см. /opt/stacks/databases/mssql/)
# MSSQL_SA_PASSWORD из pass show mssql-vds/sa-password (32-char alnum, no special chars)
```
```yaml
# 4. Traefik: добавить TCP entrypoint в /opt/stacks/traefik/data/traefik.yml
entryPoints:
mssql:
address: ":1433"
# + port 1433 в /opt/stacks/traefik/docker-compose.yml ports list
# + ufw allow 1433/tcp
# + sudo docker compose up -d (RECREATE, не restart — port mapping)
```
```sql
-- 5. RESTORE per DB
RESTORE DATABASE [<db>] FROM DISK='/var/opt/mssql/backups/<db>.bak' WITH REPLACE, STATS=50;
-- 2019 → 2022 schema upgrade автоматический (versions 953→957). DBCC CHECKDB PHYSICAL_ONLY clean.
```
```sql
-- 6. CRITICAL: server-level logins НЕ переезжают в .bak (sysadmin/master DB only).
-- Создать manually + fix orphan users в каждой DB:
CREATE LOGIN snolla WITH PASSWORD = '<from-source-web.config>', CHECK_POLICY = OFF;
USE MoreThenCms;
ALTER USER snolla WITH LOGIN = snolla;
-- Repeat for каждой DB где web.config упоминает данного user'а.
```
## Gotchas
1. **Logins vs users**: .bak восстанавливает DB-level users (с их role memberships + permissions), но НЕ server logins. Sites с `User Id=X` в conn-string ловят `Login failed for user 'X'` после restore, пока не выполнить `CREATE LOGIN` + `ALTER USER ... WITH LOGIN`.
2. **Traefik recreate, не restart**: добавление port mapping в `docker-compose.yml` требует **recreate** контейнера (`docker compose up -d`), не `restart`. `restart` оставит старые published ports.
3. **PowerShell + `pass` (bash script)**: `pass show` в PowerShell возвращает NULL (PS не запускает bash-скрипты напрямую). Нужно `bash -c "pass show ..."` или literal. Симптом: `Login failed for user 'sa'` несмотря на правильный пароль на VDS.
4. **`MSSQL_SA_PASSWORD` спец-символы**: rotation password generator должен excludeавать `+/=` (Base64) и shell-meta (`$`, `` ` ``, `"`, `'`, `\`). Иначе env-var passing через ssh heredoc или sed конструкторы ломаются. Пример безопасного: `[Convert]::ToBase64String($bytes) -replace '[+/=]','x'`.
5. **MSSQL Linux user uid**: `mssql` user = uid 10001. Bind-mount должен быть `chown 10001:0` чтобы контейнер read/write. Parent dir owns `vitya:vitya` чтобы можно было редактировать compose без sudo.
## Backup integration (TODO)
Расширить `/opt/stacks/backup/scripts/run.sh` (см. [[vds-backup-rsync-kreknin]]):
- `mssql_dump_full` daily — `BACKUP DATABASE [<db>] TO DISK='...' WITH COMPRESSION, COPY_ONLY` через `docker exec mssql sqlcmd ...`
- `mssql_tx_log_backup` hourly — `BACKUP LOG [<db>] TO DISK='...'` для FULL-recovery DBs (только `MoreThenCms` — остальные SIMPLE).
- Достигает target RPO 1ч (vs current daily snapshot).
- ntfy push на `vds-backup` topic.
## Rollback recipe
1. Revert IIS web.config'ы (см. `.bak-pre-vds-cutover-20260522` файлы).
2. `iisreset /restart` (или ждать auto-recycle ~30 sec).
3. Убедиться windows-host MSSQL контейнер всё ещё running (acceptance 48ч uptime до decommission).
4. Если уже decommissioned: `docker start mssql` (volume сохранён ещё неделю по acceptance).

2
.wiki/index.md
View File

@@ -24,7 +24,9 @@ Catalog of all wiki pages. One line per page, organized by type. Updated on ever
- [future-resilient-architecture-goals](concepts/future-resilient-architecture-goals.md) — fault-tolerance roadmap placeholder (расширяется через `[resilience-roadmap-design]`)
- [hyper-backup-structure-and-recovery](concepts/hyper-backup-structure-and-recovery.md) — Hyper Backup — структура репо и стратегия восстановления
- [iis-migration-2026-05-19-postmortem](concepts/iis-migration-2026-05-19-postmortem.md) — post-mortem миграции CMS на нативный IIS, 2026-05-19
- [minio-imgproxy-on-vds](concepts/minio-imgproxy-on-vds.md) — MinIO+imgproxy stack на VDS, миграция с upgrade 2020→2025 + DNS swap pending
- [mssql-container-data-restore](concepts/mssql-container-data-restore.md) — MSSQL контейнер с восстановленными production data — паттерн
- [mssql-on-vds](concepts/mssql-on-vds.md) — MSSQL Express 2022 Linux на VDS — миграция + login orphan fix + traefik TCP gotchas
- [ocis-on-vds-deploy-recipe](concepts/ocis-on-vds-deploy-recipe.md) — oCIS на VDS — deploy recipe + non-obvious gotchas (UID 1001 vs 1000, basic auth, LibreGraph user-create)
- [portainer-2.21-admin-password-regression](concepts/portainer-2.21-admin-password-regression.md) — Portainer 2.21 `--admin-password` regression + min 12-char policy
- [recovery-architecture-snapshot](concepts/recovery-architecture-snapshot.md) — текущая recovery architecture (2026-05-19/21, attempt 2)