Root cause (NOT a migration defect): MoreThenCms tenant `maljarka`
had `dbo.Sites.SettingsData = NULL` (no `httpSecure` block) -> on a
real HTTPS request SnollaMiddleware throws KeyNotFoundException ->
502. HTTP served 200 fine. DNS/TLS/IIS binding all correct.
Fix applied to shared MSSQL (mssql.kzntsv.site): UPDATE Sites set
SettingsData with httpSecure{enableHttps:true,...} + recycle snolla
pool. Verified 443->200 server-local and external via 80.64.31.36;
kupimknigi untouched. Audit: maljarka was the only NULL-settings
site with a :443 binding (of 25); rimiz degraded for another reason.
- new concept: morethencms-null-settingsdata-https-502
- entities/ruvds-iis-host: maljarka moved from Degraded -> fixed
- index.md + log.md + STATUS.md + NEXT_SESSION.md updated
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
3 classic chacha20-ietf-poly1305 SS inbounds (ports 32031/32/33),
one ss:// key each, per-key revocable. Protocol e2e-tested OK;
RF reachability unverified (SS DPI-blocked in RF on this node).
Keys/passwords in pass nl-vds-3xui/full-env.
Also flagged undocumented VLESS:13027 inbound found in DB.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Stood up a permanent self-renewing Let's Encrypt pipeline on the RUVDS
IIS host, replacing the manual traefik acme.json -> PFX import and
closing the 2026-07-22 cert-expiry deadline (new 25-SAN cert valid to
2026-09-03, SYSTEM scheduled task renews 55 days before expiry).
Key obstacle: the MoreThenCms OWIN catch-all (owin:HandleAllRequests)
swallowed /.well-known/acme-challenge/. Solved by carving the challenge
path into a separate IIS application in a No-Managed-Code app pool, plus
patching win-acme's Web_Config.xml template to remove the inherited Owin
handler. Staging + prod validation green for all 25 hostnames; live TLS
smoke confirms the new cert is served (incl degraded maljarka/rimiz).
- scripts/iis-migration-to-ruvds/03-ruvds-winacme.ps1 (idempotent setup)
- scripts/iis-migration-to-ruvds/winacme-Web_Config.xml (patched template)
- .wiki/concepts/winacme-iis-owin-catchall-http01.md (recipe + gotchas)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- new sources/nl-vds-3xui-setup-2026-06-05.md (full chronicle; HONEST outcome:
у реальных клиентов из РФ работает только plain VLESS 32030; Reality/MTProto/
SOCKS не поднялись)
- new concepts/proxy-debugging-test-the-real-client.md (anti-pattern: own curl/
standalone tests passed while user's real clients failed; overclaim + bad
MSS-clamp fix that broke things)
- rewrote entities/nl-vds-3xui.md — removed false "Reality verified/fixed" &
"mtg works" claims; honest status table; MSS-clamp removed
- caveat added to reality-pq concept (disabling PQ != working Reality for GUI
clients); index.md + log.md updated
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Confirmed by experiment: Reality on :443 worked ~12min then died (all
timeouts via live v2rayN); moved inbound to :2053 and verified from same
RU PC/core -> exit NL, google 200, 10MB @5.3MB/s. RKN port-blocks :443
dynamically. New X25519 share link (port 2053) in pass. Caveat: 2053 may
also get flagged under heavy use; rotate port if it dies.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Root cause of "Reality fails on client": v2rayN 7.19.5 + phone apps do NOT emit
mldsa65Verify to the xray core, so they can't auth to a PQ-mandated REALITY
inbound (only plain VLESS 32030 worked). Replica matrix: noPQ+no-verify=204,
PQ+no-verify=000, noPQ+with-verify=000. Removed mldsa65Seed from inbound id=1 ->
standard Reality X25519. Verified verify-less client through real :443 -> 204.
Fresh X25519 share-link generated for re-import. Wiki concept updated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
SOCKS5 works server-side but DPI on user's path blocks it -> stood up mtg
v2.2.8 as systemd service (DynamicUser, Restart=always), FakeTLS domain
www.cloudflare.com. Verified: openssl probe -> valid TLS1.3 CN=www.cloudflare.com
(indistinguishable from real HTTPS). Secret + tg link in pass.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Рецидив вчерашнего ES-инцидента вскрыл истинную причину. Вчерашняя
гипотеза «оператор в cutover попал на canonical» опровергнута.
Root cause: ES (stack 33) публиковал 0.0.0.0:9200 мимо traefik. Free-ES
7.10 без auth → порт открыт всему интернету. Ransom-бот сносил индексы
by-name (мимо Control #1 destructive_requires_name), оставлял read_me с
BTC-выкупом. accessLog (Control #2) пуст — бот шёл прямо в порт, не через
traefik. firewalld бесполезен (docker-publish обходит INPUT-зоны).
Fix (Control #3): убрана публикация host-порта из stack 33 (Portainer
PUT), дыра закрыта; re-restore epz/products/artmone из daily-2026-05-25.
Отдельный баг: epz-поиск падал у ОБОИХ тенантов — getTenantIdSeller(
config.get("tenant")) через node-config, а tenant не задан ни в
default.json, ни в env-маппинге (TENANT env = мёртвый груз). Добавлен
tenant в overlay default.json (slovo/bookva). products работал —
отдельный код-путь.
accessLog откатан (сторожил не ту дверь).
- wiki concept: correction-блок + секция «Рецидив 2026-05-29» + exposure-audit
- tasks: restore-es reopened+reclosed; new ⚪ harden-books-vds-exposed-ports
- NEXT_SESSION handoff
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
snapshot restore из kreknin:daily-2026-05-25 за 46 сек (epz=820604,
products=105922, artmone=2621, counts == source).
RCA: 5 индексов (включая system .tasks) удалены через ES API DELETE _all
за 1 сек на 2026-05-26 10:21 UTC — 1ч 11мин после создания bookva-es в
cutover-prep. Каноничный endpoint elasticsearch.kzntsv.site попал под
команду которая предназначалась bookva-es:9200 (internal-only, без
traefik route). Caller identity unrecoverable: ES audit = X-Pack платный,
traefik accessLog был выключен, Portainer CE без audit.
Preventive controls applied + verified:
1. ES env action.destructive_requires_name=true (stack 33) — DELETE _all
и wildcard теперь 400 BadRequest; by-name DELETE работает (нужно для
reindex). Pattern удаления что случился физически невозможен.
2. Traefik JSON accessLog в /letsencrypt/access.log — будущие DELETE
оставят forensic след с IP/user/method/path.
Wiki concept: .wiki/concepts/es-destructive-delete-incident-2026-05-26.md
с recovery runbook + preventive controls + cross-refs.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Temp admin (2026-05-23 09:37-18:08) начал импл iis-migration-to-ruvds,
не закончил bootstrap, упал на UNC robocopy (exit 16) и dropped tree dirty.
Session recovery:
- secrets leak fix: `.secrets/ruvds-iis.env` → `pass show ruvds-iis/full-env`
(etap-2 discipline restored). `.secrets/` + `*.env` + `*-log.txt` + `*-size.txt`
added to `.gitignore` чтобы не повторилось.
- root cause зафиксирован: TCP/445 closed по дефолту на fresh Win Server 2025
Core + SMB share не создан → UNC robocopy не работает без RUVDS bootstrap.
- new concept `windows-server-2025-core-bootstrap.md` — default-blockers
table + transfer-методов матрица (RDP-redirect / SMB / WinRM / SFTP) +
bootstrap-чеклист 12 шагов. Recommendation = SMB inbound с source-IP
whitelist.
- task ⚪ → 🟡 paused с concrete next-step (capacity audit, transfer-method
confirm, RUVDS bootstrap, backup source, recreate IIS sites + conn-string
swap, pilot kupimknigi + DNS swap).
- Open question raised: source 11 sites сумма vs RUVDS 30 GB HDD — capacity
blocker possible (snolla одна 8.66 GB).
Не push'нуто — ждёт user grant per project-discipline Rule 4.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
User confirmed imgproxy.kzntsv.site занят другим сервисом на другом сервере
(не наш scope). VDS imgproxy уже на imgproxy.vds.kzntsv.site (live).
CMS audit 2026-05-22 не нашёл refs на imgproxy/kzntsv/minio в:
- snolla source code (recursive grep)
- Admin/ templates
- bin/MoreThenCms.Modules.Imgproxy.dll strings (только namespace literal)
- MoreThenCms DB SiteSettings + ModuleProperties
- Public HTML rendering (всё relative /images/ + /themes/)
DLL deployed но не wired в active flow — vestigial или invoked через
Azure storage SDK (AccountName=snolla;AccountKey=... connection string
в snolla/Web.config — Azure-compat доступ к MinIO с неустановленным
endpoint). Identification реального consumer'а — отдельная audit-задача
перед source decommission.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- mssql-vds-migration 🟢: Express 2022 Linux на mssql.kzntsv.site:1433,
5 DBs restored (schema 2019→2022 auto-upgrade), 8 prod hosts 200 OK
- minio-imgproxy-vds-migration 🟡: stack live, 3 GiB / 19324 obj mirrored
(2020→2025 upgrade via S3 API), DNS swap imgproxy.kzntsv.site pending
- iis-cutover-to-vds-services 🟡: 1 web.config edit catch-all для 11 hosts;
MinIO leg pending DNS swap (URLs уже через imgproxy.kzntsv.site domain)
- 3 wiki concepts: mssql-on-vds, minio-imgproxy-on-vds, index updated
Findings: (1) server logins НЕ переезжают в .bak — orphan fix manual,
(2) traefik recreate-not-restart для port mapping change,
(3) PowerShell не вызывает pass bash-script (NULL pw → misleading auth fail),
(4) mc 2025 не auto-creates target buckets, (5) non-ASCII filename silent
skip в mc mirror — verify по count+size обязательно.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Import complete: 25 044 objs / 26 GB. 99.97% залито rclone'ом (22.2 GB
за ~2.5 ч), оставшиеся 6 файлов (4.04 GB) — 4× .pat ~221 MB + 2× .seospider
1.55+1.7 GB — упали с 502/500 на каждом rclone PUT из-за 60-секундного
HTTP timeout в reva v2.27 datagateway (hardcoded в Go http.Client.Timeout,
не env-configurable).
Workaround: VDS-side curl PUT loopback через throwaway sftp key.
Local network 142 MB/s → 4.04 GB за 28 секунд, все PROPFIND size match.
Wiki: §Gotcha 5 в concepts/ocis-on-vds-deploy-recipe.md документирует
finding + recipe для workaround. Traefik buffering middleware пробован,
не помог (likely vulcand/oxy buffer bug на больших телах) — откатил.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
New concept page documents the oCIS-on-VDS deploy pattern with the 4
non-obvious gotchas surfaced during owncloud-vds-deploy:
1. UID mismatch — image ocis-user is 1000, host vitya is 1001 →
compose `user: "1001:1001"` override (alt chown rejected as orphan-UID)
2. PROXY_TLS=false — explicit per docs when reverse proxy terminates HTTPS
3. PROXY_ENABLE_BASIC_AUTH=true — required for WebDAV/LibreGraph API
4. LibreGraph POST /graph/v1.0/users — only way to create users (no CLI)
Plus decomposedfs storage layout, atomic-revert recipe, backup integration
note. Source: .tasks/owncloud-vds-deploy.md.
entities/vds-kzntsv.md updated: stack table + hostnames + file layout
include owncloud row.
index.md catalog + log.md ingest entry refreshed.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
