vitya
fdefe96d6f
Temp admin (2026-05-23 09:37-18:08) начал импл iis-migration-to-ruvds, не закончил bootstrap, упал на UNC robocopy (exit 16) и dropped tree dirty. Session recovery: - secrets leak fix: `.secrets/ruvds-iis.env` → `pass show ruvds-iis/full-env` (etap-2 discipline restored). `.secrets/` + `*.env` + `*-log.txt` + `*-size.txt` added to `.gitignore` чтобы не повторилось. - root cause зафиксирован: TCP/445 closed по дефолту на fresh Win Server 2025 Core + SMB share не создан → UNC robocopy не работает без RUVDS bootstrap. - new concept `windows-server-2025-core-bootstrap.md` — default-blockers table + transfer-методов матрица (RDP-redirect / SMB / WinRM / SFTP) + bootstrap-чеклист 12 шагов. Recommendation = SMB inbound с source-IP whitelist. - task ⚪ → 🟡 paused с concrete next-step (capacity audit, transfer-method confirm, RUVDS bootstrap, backup source, recreate IIS sites + conn-string swap, pilot kupimknigi + DNS swap). - Open question raised: source 11 sites сумма vs RUVDS 30 GB HDD — capacity blocker possible (snolla одна 8.66 GB). Не push'нуто — ждёт user grant per project-discipline Rule 4. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
94 lines
8.8 KiB
Markdown
94 lines
8.8 KiB
Markdown
# iis-migration-to-ruvds
|
||
|
||
## Goal
|
||
|
||
Migrate 11 IIS sites from [[../entities/windows-recovery-host]] (DESKTOP-NSEF0UK) to RUVDS Windows Server 2025 Core. Убрать SPOF домашней машины.
|
||
|
||
**Pre-requisites done:**
|
||
- MSSQL+MinIO уже на [[../entities/vds-kzntsv]] (см [[mssql-minio-migration-to-vds]])
|
||
- RUVDS purchased: Windows Server 2025 Core, 2GB RAM, 30GB HDD, 1IP, DC Королёв
|
||
- RDP ready (creds — `pass show ruvds-iis/full-env`, public IP `80.64.31.36`)
|
||
|
||
## Key files
|
||
|
||
- `C:\sites\snolla\` — 8.66 GB source (samples sites), измерено 2026-05-23
|
||
- `C:\sites\<11 sites>` — полный inetpub root (по `recovery-architecture-snapshot`)
|
||
- `C:\Windows\System32\inetsrv\config\applicationHost.config` — source IIS state
|
||
- `[[../.wiki/concepts/windows-server-2025-core-bootstrap]]` — bootstrap-чеклист + transfer-методов матрица (ingested 2026-05-23 после failed-robocopy)
|
||
- `pass show ruvds-iis/full-env` — RDP creds
|
||
|
||
## Migration approach
|
||
|
||
1. **RDP-first setup** (RUVDS) — см. `concepts/windows-server-2025-core-bootstrap.md` §Bootstrap-чеклист:
|
||
- Install IIS (`Install-WindowsFeature Web-Server -IncludeAllSubFeature -IncludeManagementTools`)
|
||
- Verify .NET Framework 4.8 (Release ≥ 528040)
|
||
- Install URL Rewrite 2.1
|
||
- Open FW 80/443
|
||
- Test external MSSQL connection to VDS (`mssql.kzntsv.site:1433`)
|
||
- Test external MinIO connection (если CMS pipeline переезжает — см. caveat §MinIO ниже)
|
||
|
||
2. **Open SMB inbound на время migration** (см. transfer-методов матрица — это recommended choice):
|
||
- `Set-NetFirewallRule -DisplayGroup "File and Printer Sharing" -Enabled True`
|
||
- `New-NetFirewallRule -DisplayName "SMB-from-source" -Direction Inbound -Protocol TCP -LocalPort 445 -RemoteAddress <source-public-ip> -Action Allow`
|
||
- `New-Item -ItemType Directory -Path C:\sites -Force`
|
||
- `New-SmbShare -Name sites -Path C:\sites -FullAccess Administrator`
|
||
|
||
3. **Backup source** (windows-recovery-host):
|
||
- Export IIS configuration: `appcmd list site -config > sites-backup.txt`
|
||
- Export applicationHost.config: `C:\Windows\System32\inetsrv\config\applicationHost.config`
|
||
- Backup inetpub\wwwroot\ (11 sites, ~8.66 GB на snolla одной, итого предположительно ~30-50 GB total)
|
||
- Document Web.config connection strings (MSSQL/MinIO endpoints)
|
||
|
||
4. **Deploy to target** (RUVDS) — через SMB robocopy:
|
||
- `net use \\<ruvds-ip>\sites /user:Administrator <pass-from-pass>`
|
||
- `robocopy C:\sites\<site> \\<ruvds-ip>\sites\<site> *.* /S /E /DCOPY:DA /COPY:DAT /Z /MT:8 /R:2 /W:5` per site
|
||
- Recreate sites через `appcmd add site` или `New-IISSite`, копировать bindings
|
||
- Update Web.config connection strings → `Data Source=mssql.kzntsv.site,1433;TrustServerCertificate=True` (matches `[mssql-vds-migration]` pattern)
|
||
- Import SSL certificates (traefik LE certs) или setup new LE через `win-acme` (wacs.exe)
|
||
|
||
5. **Pilot on kupimknigi.spb.ru** (low-traffic):
|
||
- DNS pointing test (local hosts file или temporary DNS)
|
||
- Smoke test: homepage + admin + database connectivity
|
||
- 24h soak — monitor stability (включая memory pressure — 2GB tight)
|
||
- Если OK → proceed с remaining 10 sites
|
||
|
||
6. **DNS swap cutover**:
|
||
- Update DNS A records → RUVDS IP (`80.64.31.36`)
|
||
- Monitor traefik logs на windows-recovery-host (должно увидеть 0 traffic)
|
||
- Keep windows-recovery-host warm для 1 week rollback window
|
||
- **Cleanup на RUVDS:** `Remove-SmbShare -Name sites` + `Remove-NetFirewallRule -DisplayName "SMB-from-source"`
|
||
|
||
## Decisions log
|
||
|
||
- **2026-05-23 09:37 (admin attempt):** RDP creds сохранены в `.secrets/ruvds-iis.env` (plaintext, в repo tree → нарушение etap-2 secrets-discipline, ретроспективно зафикшено в текущей сессии: → `pass show ruvds-iis/full-env`).
|
||
- **2026-05-23 18:01 (admin attempt):** замерен размер `C:\sites\snolla\` = 8871 MB ≈ 8.66 GB. Источник для capacity planning (snolla alone 8.66 GB → 11 sites суммарно может быть 30-50 GB → 30 GB HDD на RUVDS **tight**, потенциальный capacity blocker, см. Open questions).
|
||
- **2026-05-23 18:08 (admin attempt):** robocopy `C:\sites\snolla\` → `\\80.64.31.36\sites\snolla\` упал exit 16 «сетевой путь не найден». Root cause (post-mortem из текущей сессии): TCP/445 closed по дефолту на Win Server 2025 Core + SMB share `sites` не создан. UNC robocopy как первый transfer-метод **не работает** на fresh Core без подготовки RUVDS-стороны.
|
||
- **2026-05-23 (current session) recommendation:** SMB inbound с source-IP whitelist — самый быстрый transfer для 11 sites × ~1 GB, native robocopy /Z поддерживает interrupt-resume, FW rule убирается после cutover. Полная матрица альтернатив (RDP-redirect / WinRM / SFTP) в `concepts/windows-server-2025-core-bootstrap.md` §Transfer-методов.
|
||
- **MinIO pipeline caveat (из `[iis-cutover-to-vds-services]` 2026-05-22):** CMS image pipeline остаётся целиком на windows-recovery-host из-за hardcoded URL в `MoreThenCms.Modules.Imgproxy.dll`. RUVDS-IIS будет coupled к windows-host imgproxy через DNS `imgproxy.kzntsv.site` — то есть RUVDS IIS вызывает server-side GET на windows-host'овский imgproxy. Это **не убирает SPOF домашней машины** для image-rendering pipeline. Если windows-host умрёт, image-URLs broken. Open question для post-migration phase: decompile DLL или Option B (local nginx-relay).
|
||
|
||
## Open questions
|
||
|
||
- [ ] **RUVDS disk capacity** — 30 GB HDD vs estimated 30-50 GB total sites. Нужен audit `Get-ChildItem C:\sites -Directory | %{[PSCustomObject]@{Name=$_.Name; SizeGB=(Get-ChildItem $_.FullName -Recurse | Measure-Object -Property Length -Sum).Sum / 1GB}}` на source перед transfer'ом. Если >25 GB — нужен upgrade RUVDS plan (или selective transfer без cache/logs/temp dirs).
|
||
- [ ] **SSL strategy** — use existing traefik LE certs (export?) или setup new LE на IIS via `win-acme`? Recommendation: `win-acme` — standalone-friendly на Core, не зависит от traefik export-ритуала.
|
||
- [ ] **Traefik на RUVDS?** — IIS-only (port 80/443 direct) или traefik reverse proxy again? Recommendation: IIS-only для 11 sites, traefik overkill; ставить traefik только если будут не-IIS workloads на RUVDS.
|
||
- [ ] **Backup strategy для RUVDS IIS** — расширить `vds-backup-rsync-kreknin` cron на RUVDS как третий source? VDS snapshot? IIS native backup (`Backup-WebConfiguration`)? Решение откладывается до после успешного cutover.
|
||
- [ ] **Image-pipeline SPOF (post-cutover):** windows-host imgproxy остаётся single-point — Option B/D из `[iis-cutover-to-vds-services]` MinIO-phase. Решение откладывается до после успешного cutover.
|
||
|
||
## Completed steps
|
||
|
||
- [x] **2026-05-22:** vendor research (`windows-hosting-vendor-research` 🟢) — RUVDS selected.
|
||
- [x] **2026-05-23 09:37:** RUVDS purchased + RDP creds saved. **Note:** creds сначала жили в `.secrets/ruvds-iis.env` plaintext (нарушение etap-2 discipline); ретроспективно вынесены в `pass show ruvds-iis/full-env` 2026-05-23 в session-recovery.
|
||
- [x] **2026-05-23 18:01:** source size probe — `C:\sites\snolla\` = 8.66 GB.
|
||
- [x] **2026-05-23 18:08:** failed-robocopy attempt → root-cause analysis → finding закреплён в `[[../.wiki/concepts/windows-server-2025-core-bootstrap]]`.
|
||
|
||
## Notes
|
||
|
||
- **Windows Server 2025 Core** = GUI-less, PowerShell-only management. No Server Manager desktop. Drag-n-drop в RDP не работает без `mstsc /admin` Local Drives redirect.
|
||
- **2GB RAM constraint** — IIS + 11 sites = tight. Monitor memory после pilot. Возможно нужен per-pool `RecyclingPeriodicRestartMemory 200MB`.
|
||
- **Migration is transitional** — long-term snolla-on-node makes IIS obsolete. Don't over-engineer (не ставить Prometheus, не writing custom monitoring).
|
||
- **Image-pipeline caveat:** даже после RUVDS cutover, windows-host остаётся SPOF для image-rendering (см. Decisions log §MinIO caveat).
|
||
|
||
<!-- created-by: user-decision / 2026-05-22 / trigger: RUVDS purchased -->
|
||
<!-- attempted-by: admin-session / 2026-05-23 09:37-18:08 / dropped after failed-robocopy + giving up -->
|
||
<!-- session-recovery: vitya / 2026-05-23 evening / fix secrets-leak + document SMB-default finding + paused with concrete next-step -->
|