2 Commits

Author	SHA1	Message	Date
vitya	8db4b0d71c	tasks(ruvds-backup-daily-kreknin): close 🟢 — live на 04:30 MSK daily ... End-to-end pipeline отработан, run #1 verified 20 sec, 8.8 GB snolla + IIS configs + 14 certs + sshd state → /volume1/NetBackup/ruvds-iis/<date>/ на kreknin. Retention 7 daily, ntfy vds-backup topic. Scripts checked into scripts/ruvds-backup-daily-kreknin/: - setup.ps1 (one-time install: SSH key + rclone + configs + ScheduledTask) - run.ps1 (live backup logic; Invoke-Rclone wrapper для NOTICE-on-stderr) - README.md (decisions log, smoke instructions, atomic revert) Bugs found and fixed during smoke (см. README Decisions log): 1. Backup-WebConfiguration -Force параметра нет → check + Remove first 2. rclone --log-file lock с PS Start-Transcript → drop --log-file 3. rclone NOTICE на stderr + $ErrorActionPreference=Stop → Invoke-Rclone wrapper temporarily switches к Continue 4. ssh-keyscan known_hosts не parsится rclone go-sftp → drop pinning, rely on key-auth Закрывает "Backup strategy для RUVDS IIS" Open question в [iis-migration-to-ruvds]. Open follow-ups (не блокер): - PFX export pass plaintext в скрипте — TODO move to gpg/DPAPI - Retention prune (kept 1 today) — verify в day 8 - Phone-side ntfy push — user verifies Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-24 11:49:44 +03:00
vitya	7693400239	tasks(iis-migration-to-ruvds): partial cutover live — kupimknigi DNS flipped ... Session 2026-05-23 evening → 2026-05-24: full snolla site migration windows-recovery-host → RUVDS Win Server 2025 Core, partial DNS cutover для 1 prod hostname (kupimknigi.spb.ru), оставшиеся 24 hostnames pending. What's live on RUVDS: - snolla IIS site catch-all *:80: + 25 HTTPS SNI bindings (1 per hostname, LE certs от 2026-04-23 / valid до 2026-07-22) - 8.66 GB / 44725 files transferred via scp после ISP-block discovery - ApplicationPoolIdentity + ACL grant verified - HTTP/2 auto-negotiated, MSSQL/imgproxy/MinIO connectivity OK from RUVDS Findings (Decisions log в task file для деталей): 1. Outbound 445 блокирует home ISP (не RUVDS FW) — `windows-server-2025-core-bootstrap.md` SMB-section deprecated, SSH/scp = canonical transfer-метод. 2. Home network HTTP-middlebox mangles Host header в outbound external HTTP — тест с source даёт garbled response; тест с VDS (третья сеть) даёт корректный. 3. traefik acme.json → IIS PFX recipe: extract base64 cert+key per cert → openssl pkcs12 -export → Import-PfxCertificate + AddSslCertificate by thumbprint with SslFlags=1 (SNI). Reusable, потенциально новый concept. 4. IIS 10 на Win Server 2025 говорит HTTP/2 by default через TLS. 5. 4 hostnames (maljarka.tandemmebel.ru + 3 rimiz) → 502/404 на RUVDS; на source IIS:8089 возвращают 200 default-page. Pre-existing CMS-tenant config gap, не migration defect. Scripts added: - scripts/iis-migration-to-ruvds/01-ruvds-bootstrap.ps1 (idempotent) - scripts/iis-migration-to-ruvds/02-source-transfer.ps1 (не использовался — SMB не работает; оставлен как reference) - scripts/iis-migration-to-ruvds/README.md Cleanup done: - Plaintext PFX/PEM keys в C:\Users\vitya\iis-backup-pre-ruvds\certs\ удалены (PFX import на RUVDS уже сделан, source-of-truth = traefik acme.json). - `.secrets/` уже удалён ранее в этой session (см. предыдущий commit). Source state: IIS:8089 + traefik routes ALIVE — rollback ready. Decommission после 1-week soak с RUVDS как live prod. Не push'нуто — ждёт user grant per project-discipline Rule 4. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-24 10:01:20 +03:00