50e263860d
- Sites.Alias+LoweredAlias on->internal (siteId B9ECDB50; PrimaryDomain on.snolla.com kept). - Web.config primaryAlias on->internal (catch-all default-site; without it the whole catch-all NRE-500s on every request — primaryAlias references the renamed alias). - hosts: on.snolla.com->internal.snolla.com under # snolla-local-admin marker. - setup-local-snolla-admin.ps1 aliases array updated. - runbook + NEXT_SESSION + memory updated. VDS prod on.snolla.com unaffected (snolla-app uses config.siteId, not alias) — verified byte-identical + smoke GREEN after rename. Incident: elevated hosts edit emptied hosts to 0B (Get-Content -Raw returned null in RunAs context) — restored from Windows default header + snolla-local-admin block. Memory snolla-catch-all-primaryalias-depends-on-alias. Co-Authored-By: Claude <noreply@anthropic.com>
75 lines
3.5 KiB
PowerShell
75 lines
3.5 KiB
PowerShell
# setup-local-snolla-admin.ps1 - restore local catch-all IIS site 'snolla' (admin for tirazh + on.snolla.com)
|
|
# RUN FROM elevated PowerShell: Set-ExecutionPolicy -Scope Process Bypass; & 'C:\Users\vitya\projects\.admin\scripts\local-snolla-admin-restore\setup-local-snolla-admin.ps1'
|
|
# Source: C:\sites\snolla\ already copied from RUVDS (selective ~100MB, Web.config -> mssql.kzntsv.site + MinIO S3).
|
|
|
|
$logPath = 'C:\Users\vitya\projects\.admin\.tmp\setup-log.txt'
|
|
Start-Transcript -Path $logPath -Force | Out-Null
|
|
$ErrorActionPreference = 'Stop'
|
|
try {
|
|
Import-Module WebAdministration
|
|
|
|
$siteName = 'snolla'
|
|
$poolName = 'snolla'
|
|
$physPath = 'C:\sites\snolla'
|
|
$aliases = @('tandemmebel.snolla.com','labtools.snolla.com','labtoolspro.snolla.com','emspb.snolla.com','kupimknigi.snolla.com','internal.snolla.com')
|
|
|
|
Write-Host "== 1. AppPool $poolName =="
|
|
if (Test-Path "IIS:\AppPools\$poolName") {
|
|
Write-Host " exists, ensuring config"
|
|
} else {
|
|
New-WebAppPool -Name $poolName | Out-Null
|
|
}
|
|
Set-ItemProperty "IIS:\AppPools\$poolName" -Name managedRuntimeVersion -Value 'v4.0'
|
|
Set-ItemProperty "IIS:\AppPools\$poolName" -Name processModel.identityType -Value 'ApplicationPoolIdentity'
|
|
Set-ItemProperty "IIS:\AppPools\$poolName" -Name recycling.periodicRestart.memory -Value 200
|
|
|
|
Write-Host "== 2. IIS site $siteName (catch-all *:80) =="
|
|
if (Test-Path "IIS:\Sites\$siteName") {
|
|
Write-Host " exists - removing to recreate cleanly"
|
|
Remove-Website -Name $siteName
|
|
}
|
|
# catch-all HTTP on *:80 (no HostHeader = matches any Host header)
|
|
New-Website -Name $siteName -PhysicalPath $physPath -ApplicationPool $poolName -Port 80 -Force | Out-Null
|
|
Set-ItemProperty "IIS:\Sites\$siteName" -Name physicalPath -Value $physPath
|
|
|
|
Write-Host "== 3. ACL: IIS AppPool\$poolName (OI)(CI)(M) on $physPath =="
|
|
icacls $physPath /grant "IIS AppPool\${poolName}:(OI)(CI)(M)" /T /C | Out-Null
|
|
|
|
Write-Host "== 4. hosts-override (127.0.0.1 aliases) =="
|
|
$hostsFile = "$env:windir\System32\drivers\etc\hosts"
|
|
$hostsContent = Get-Content $hostsFile -Raw -ErrorAction SilentlyContinue
|
|
$marker = '# snolla-local-admin'
|
|
if ($hostsContent -notmatch [regex]::Escape($marker)) {
|
|
$line = "`r`n$marker`r`n127.0.0.1 $($aliases -join ' ')`r`n"
|
|
Add-Content -Path $hostsFile -Value $line -Encoding ASCII
|
|
Write-Host " added hosts entries"
|
|
} else {
|
|
Write-Host " hosts entries already present (marker found)"
|
|
}
|
|
|
|
Write-Host "== 5. FW: block inbound TCP 80 (local-only guard; loopback not filtered) =="
|
|
$fwName = 'block-inbound-80-snolla-local'
|
|
if (-not (Get-NetFirewallRule -DisplayName $fwName -ErrorAction SilentlyContinue)) {
|
|
New-NetFirewallRule -DisplayName $fwName -Direction Inbound -Protocol TCP -LocalPort 80 -Action Block -Profile Any | Out-Null
|
|
Write-Host " block rule added"
|
|
} else { Write-Host " block rule already present" }
|
|
|
|
Write-Host "== 6. Start =="
|
|
Start-WebAppPool $poolName
|
|
Start-Website $siteName
|
|
Start-Sleep -Seconds 3
|
|
Write-Host " pool state: $((Get-WebAppPoolState $poolName).Text)"
|
|
Write-Host " site state: $((Get-WebsiteState $siteName).Text)"
|
|
|
|
Write-Host "== 7. Smoke (curl --noproxy bypasses VPN-proxy localhost swallow) =="
|
|
foreach ($a in $aliases) {
|
|
$code = & curl.exe --noproxy '*' -s -o NUL -w "%{http_code}" -H "Host: $a" "http://127.0.0.1/admin/account/login" 2>$null
|
|
Write-Host " http://$a/admin/account/login -> $code"
|
|
}
|
|
Write-Host "== DONE - open http://tandemmebel.snolla.com/admin in browser =="
|
|
Write-Host "(if login form not 200 - check C:\Logs\snolla\log*.txt and eventvwr IIS)"
|
|
} catch {
|
|
Write-Host "FATAL: $_"
|
|
Write-Host $_.ScriptStackTrace
|
|
}
|
|
Stop-Transcript | Out-Null |