vitya
7f40bba14b
End-to-end pipeline verified — windows-host (DESKTOP-NSEF0UK) → kreknin SFTP daily 03:00 MSK live. Smoke run #1 на 14:03-15:25 = 4868 sec (81 min). Total 23 GB на kreknin /volume1/NetBackup/windows-host/<date>/. Components synced (6 paths): - mssql/ 486 MB (5 .bak FULL+COMPRESSION+INIT for MoreThenCms, StayerCalculator, StayerPrice, stostayer, TireService) - sites/ 20 GB (C:\sites\* всё содержимое) - minio/ 3.1 GB (windows-host MinIO data dir) - traefik/ 1.1 MB (config + acme.json) - iis-config/ 68 KB (applicationHost.config) - iis-backup-webconfiguration/ 384 KB (native Backup-WebConfiguration) ScheduledTask `WindowsHost-Backup-Daily` 03:00 MSK SYSTEM Wake-To-Run (машина просыпается из standby). Все 3 host backups (windows 03:00 → RUVDS 04:30 → VDS 05:00) sequential — аккумулируются за одну ночь. Notifications dual-channel ntfy `vds-backup` + email Yandex 587 STARTTLS fired clean (no WARNING/FAILED в log). Acceptance check 5/6: ✅ ScheduledTask, components, retention, notify, README ⚠ Smoke recovery test (restore .bak в чистый container + SELECT) — deferred как "DR drill" follow-up, не блокер. Decisions captured в .tasks/ARCHIVE.md closure block: - rclone в ProgramData (не Program Files) — non-admin staging path - icacls SID *S-1-5-32-544 — locale-safe для ru-Windows - sqlcmd 18 `-C` flag (TLS-required даже на localhost) - MinIO bind-mount path verified via docker inspect - SSH key deploy via VDS pivot (windows-host нет direct ssh к kreknin) - Wake-To-Run critical для warm-standby use-case Block moved: STATUS.md ⚪ → ARCHIVE.md 🟢 + header refresh. STATUS.md теперь 2 active tasks (iis-migration-to-ruvds 🟡, infra-inventory ⚪). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
47 lines
5.9 KiB
Markdown
47 lines
5.9 KiB
Markdown
# Admin Task Board
|
||
_Updated: 2026-05-24 (`windows-host-fallback-backup-daily` 🟢 closed — daily 03:00 MSK rclone SFTP windows-host → kreknin live, smoke #1 ✓ 4868 sec / 23 GB total / 5 MSSQL DBs backed up. Все 3 host'а (windows + RUVDS + VDS) теперь backup'ятся на kreknin sequentially за одну ночь. STATUS.md теперь 2 active tasks. Current scope: IIS migration в soak (kupimknigi + emspb flipped, tandemmebel excluded), infra-inventory ready.)_
|
||
|
||
<!--
|
||
Status legend:
|
||
🔴 Active — only one at a time
|
||
🟡 Paused — in progress, resumable
|
||
⚪ Ready — defined, not started
|
||
🟢 Done — moved to ARCHIVE.md once committed
|
||
🔵 Blocked — waiting on external input
|
||
-->
|
||
## 🟡 [iis-migration-to-ruvds] — RUVDS IIS live для 2 prod hostnames (kupimknigi + emspb flipped); 22 в очереди. tandemmebel.ru остаётся на windows-IIS отдельно. Source held для rollback.
|
||
|
||
**Status:** in_progress (DNS partial cutover — soak window 2026-05-24)
|
||
**Where I stopped:** 2026-05-24 — `kupimknigi.spb.ru` + `emspb.ru` (+ `www.emspb.ru`) DNS A flipped на `80.64.31.36`, authoritative `ns1.reg.ru` правильный, public resolver caches expire'ятся (8.8.8.8=~6h, 1.1.1.1=~24h max). RUVDS state: snolla site (8.66 GB / 44725 files) transferred + IIS recreated + 25 HTTPS SNI bindings c LE certs (R13, valid до 2026-07-22), 7 prod hostnames live-smoke через VDS (третья сеть) → 200 OK / correct content. Source IIS:8089 + traefik routes ALIVE — rollback ready.
|
||
**Findings зафиксированы в** [iis-migration-to-ruvds.md](iis-migration-to-ruvds.md) Decisions log: (1) outbound 445 блокирует home ISP, не RUVDS-FW → SSH/scp = canonical transfer-метод; (2) home network HTTP-middlebox mangles Host header for direct external HTTP — real end-users не пострадают, тестировать через VDS; (3) traefik acme.json → IIS PFX recipe работает (extract + openssl pkcs12 -export + Import-PfxCertificate + AddSslCertificate by thumbprint); (4) IIS 10 HTTP/2 default; (5) `maljarka.tandemmebel.ru` + 3 rimiz hostnames → 502/404 — pre-existing CMS-tenant config gap, не migration defect.
|
||
|
||
**Scope exception (2026-05-24 user decision):** `tandemmebel.ru` + `www.tandemmebel.ru` ОСТАЮТСЯ на windows-IIS на неопределённый срок (отдельное решение user'а — site не готов к cutover ровно сейчас). DNS НЕ свапать. Cert на RUVDS уже импортирован, binding existing — может оставаться idle, traffic не пойдёт.
|
||
|
||
**Next action:**
|
||
1. **Снизить DNS TTL** в reg.ru на оставшиеся **22 hostnames** до 300s — `pilorama98.ru`, `labtools.{ru,pro}`, `snolla.com` + 11 snolla subdomains + `rimiz.{ru,snolla.com}` + `maljarka.tandemmebel.ru` (но не `tandemmebel.ru` — см. Scope exception). Сократит cache-tail с 24h до 5 мин.
|
||
2. **24h soak kupimknigi + emspb** — verify через cache-clean resolver (потом curl без `--resolve`).
|
||
3. **Bulk DNS swap** оставшихся 22 hostnames на 80.64.31.36 (single sitting). **tandemmebel.ru / www.tandemmebel.ru — пропустить.**
|
||
4. **1-week prod soak** с RUVDS как live source для migrated hostnames.
|
||
5. **Decommission source IIS:8089** только для migrated hostnames (snolla catch-all site нельзя decommission'ить пока tandemmebel.ru на нём же). Решение defer до tandemmebel migration.
|
||
6. **LE renewal pipeline** — win-acme + HTTP-01 на RUVDS после full cutover (LE certs expire 2026-07-22, soak window до ~07-15).
|
||
7. **Cleanup migration-temp:** `Remove-NetFirewallRule 'smb-from-source','ssh-from-source'` на RUVDS, удалить `~/.ssh/ruvds-iis-migration*` на source, очистить `C:\ProgramData\ssh\administrators_authorized_keys` на RUVDS.
|
||
|
||
Полный план + Completed + Open questions + Remaining steps — в [iis-migration-to-ruvds.md](iis-migration-to-ruvds.md).
|
||
**Branch:** master
|
||
<!-- created-by: user-decision / 2026-05-22 / trigger: RUVDS purchased -->
|
||
<!-- partial-cutover-by: vitya / 2026-05-24 / kupimknigi + emspb DNS flipped, 22 hostnames pending, tandemmebel.ru excluded -->
|
||
<!-- scope-narrowed: vitya / 2026-05-24 / tandemmebel.ru stays on windows-IIS indefinitely -->
|
||
**Branch:** master
|
||
|
||
---
|
||
|
||
## ⚪ [infra-inventory] — two-tier инвентаризация: public-карта в global wiki + admin-detailed runbook локально
|
||
|
||
**Status:** ready
|
||
**Where I stopped:** (not started — создана 2026-05-22 из инцидента `gitea.` vs `git.` + перепутанный source/dest IP в traefik access-логах; scope расширена в тот же день — single-page → two-tier per user «у все общее представление, у админа полное»)
|
||
**Next action:** см. полный план в `infra-inventory.md`. Шаги: (1) probing-фаза одна для обоих — `nslookup` известных subdomain'ов + `vds-ops`/`synology-ops` `ops_docker_ps`/`inspect` + `knowledge_search` по существующим bootstrap-concept'ам + `rg "kzntsv.site"` по `~/projects/`. (2) Write A — light public в `projects-wiki/concepts/infrastructure-inventory.md` (машины, canonical hostnames, anti-aliases) → `knowledge_ingest`. (3) Write B — heavy admin в `.admin/.wiki/concepts/infrastructure-stack.md` (per-stack: версии, internal IPs, volumes, depends-on, backup paths, DR pointers) → commit + push. (4) Cross-refs A↔B + pointer в `.admin/.wiki/CLAUDE.md` Domain conventions.
|
||
**Branch:** n/a
|
||
<!-- created-by: OpeItcLoc03@DESKTOP-NSEF0UK / from: .workshop / 2026-05-22 / trigger: gitea-hostname-confusion-incident -->
|
||
<!-- scope-expanded: 2026-05-22 — single-page → two-tier (public + admin-detailed) -->
|
||
|