vitya
3c7ca3416b
Stood up a permanent self-renewing Let's Encrypt pipeline on the RUVDS IIS host, replacing the manual traefik acme.json -> PFX import and closing the 2026-07-22 cert-expiry deadline (new 25-SAN cert valid to 2026-09-03, SYSTEM scheduled task renews 55 days before expiry). Key obstacle: the MoreThenCms OWIN catch-all (owin:HandleAllRequests) swallowed /.well-known/acme-challenge/. Solved by carving the challenge path into a separate IIS application in a No-Managed-Code app pool, plus patching win-acme's Web_Config.xml template to remove the inherited Owin handler. Staging + prod validation green for all 25 hostnames; live TLS smoke confirms the new cert is served (incl degraded maljarka/rimiz). - scripts/iis-migration-to-ruvds/03-ruvds-winacme.ps1 (idempotent setup) - scripts/iis-migration-to-ruvds/winacme-Web_Config.xml (patched template) - .wiki/concepts/winacme-iis-owin-catchall-http01.md (recipe + gotchas) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
IIS migration to RUVDS — execution scripts
Скрипты для миграции IIS-хостинга windows-recovery-host (DESKTOP-NSEF0UK) → RUVDS Win Server 2025 Core (80.64.31.36).
Контекст и план целиком — .tasks/iis-migration-to-ruvds.md + .wiki/concepts/windows-server-2025-core-bootstrap.md.
Execution order
| # | Script | Where to run | Purpose |
|---|---|---|---|
| 1 | 01-ruvds-bootstrap.ps1 |
на RUVDS под RDP (PowerShell admin) | Install IIS + URL Rewrite + open FW 80/443 + open SMB scoped to source IP + create C:\sites share. Idempotent. |
| 2 | 02-source-transfer.ps1 (coming next) |
на source (DESKTOP-NSEF0UK) | net-use → robocopy snolla → verify. |
| 3 | 03-ruvds-recreate-sites.ps1 (coming next) |
на RUVDS | appcmd add site / bindings / web.config conn-string swap → mssql.kzntsv.site,1433. |
| 4 | 04-pilot-and-swap.md (playbook, not script) |
mixed | Pilot kupimknigi.spb.ru через hosts-file → 24h soak → DNS A swap. |
| 5 | 99-ruvds-cleanup-smb.ps1 (after cutover) |
на RUVDS | Remove SMB share + FW rule (закрываем 445 после migration). |
Pre-reqs
- RUVDS up + RDP ready (
pass show ruvds-iis/full-env) - Source public IP 46.151.25.64 уже whitelist'нут в скрипте
#1(если source IP меняется —-SourceIp <new>параметр) - На RUVDS — Administrator-shell PowerShell
How to copy scripts to RUVDS
Два варианта:
A. RDP drive-redirect (рекомендуемо):
mstsc /v:80.64.31.36→ Show Options → Local Resources → More → Drives → отметитьC:→ ОК.- После logon в RUVDS —
\\tsclient\C\mount'нут. СкопироватьC:\Users\vitya\projects\.admin\scripts\iis-migration-to-ruvds\01-ruvds-bootstrap.ps1→C:\bootstrap.ps1. - PowerShell admin →
C:\bootstrap.ps1.
B. Paste-friendly: открыть скрипт в нашей репе локально → copy всё содержимое → в RUVDS notepad C:\bootstrap.ps1 → paste → save → run.
Verification после bootstrap'а
На source:
Test-NetConnection 80.64.31.36 -Port 445 # должно стать True
Test-NetConnection 80.64.31.36 -Port 443 # должно стать True
Если оба True — переходим к script #2.