diff --git a/README.md b/README.md index 576249e..fbcba65 100644 --- a/README.md +++ b/README.md @@ -56,6 +56,21 @@ answers proves nothing about whether a record exists. At least two listed records turned out not to exist, and the real record inventory is only visible in the registrar's own list. +## Known open items — recorded, not hidden + +These are genuinely unresolved; a tidy document that omits them would be wrong. + +- **The old box `179.199.135.72` is still alive and internet-exposed** (22/80/443/587/993 + open), holding old data and config. Nothing in DNS points at it, so it serves no + member traffic — but it needs an operator decision: **shut it down or firewall it**. + Do not act on it without the operator's word. See `migration/cloudron-server-migration.md` (addendum). +- **CI is not green.** The Woodpecker agent is healthy but the server answers its + job-collection stream with HTTP 500, so no pipeline can run. See `maintenance/woodpecker-ci.md`. +- **The CI agent image source (`/home/ubuntu/repos/woodpecker-agent`) has no git + remote** — it exists only on the agent host. +- **Member mailbox contents after the migration** are still unconfirmed (needs a + real IMAP login). + ## No secrets here Audited 2026-11-01, including the full commit history: no credentials, tokens, diff --git a/migration/cloudron-server-migration.md b/migration/cloudron-server-migration.md index 519d397..2eb0d52 100644 --- a/migration/cloudron-server-migration.md +++ b/migration/cloudron-server-migration.md @@ -529,36 +529,47 @@ state at cutover, not today. | Woodpecker CI server | `ci.inference.coop` | `4984f95e-0c0a-4af3-9ce1-4ca4f3e8483d` | | Woodpecker CI agent (custom) | `ci-agent.inference.coop` | `5ac63873-cf2c-4ad9-acd6-81dc0e016c83` | -## The DNS "split" is resolved — no hostname is served by the old box +## The DNS cutover is COMPLETE — no hostname is served by the old box -At one point `chat.inference.coop` and `portal.inference.coop` were observed still -resolving to the **old** box (`179.199.135.72`) while `gateway`/`my`/`docs` were on -the **new** box (`179.237.86.116`). **As of 2026-11-04 there is no such split:** -every hostname — `chat`, `portal`, `gateway`, `my`, `docs`, `ci`, `ci-agent`, -`matrix`, `git`, `www` and the apex — resolves to the **new** box. +At one point `chat.inference.coop` and `portal.inference.coop` were *reported* as +still resolving to the **old** box (`179.199.135.72`). **That observation was +stale and the split does not exist.** Verified 2026-11-04 against an external +resolver (Cloudflare, `@1.1.1.1`): **every** hostname — apex, `my`, `chat`, +`portal`, `gateway`, `docs`, `ci`, `newsletter`, `git` — resolves to the **new** +box `179.237.86.116` with **both A and AAAA** +(`2001:1600:18:206::89`). No hostname resolves to the old box, and nothing in DNS +points at it. `chat.inference.coop` serves LibreChat and `portal.inference.coop` +returns the portal from the new box. -The zone is **wildcarded**, so a resolving name proves nothing by itself. The -decisive fact: a **made-up** hostname (`zzznope.inference.coop`) also answers the -**new** box `179.237.86.116` at the authoritative nameservers (`ns1.yoursrs.com`). -That means the **wildcard itself now points at the new box**, so no name is being -served by the old box via the wildcard either. +The zone is **wildcarded**, so a resolving name proves nothing on its own — but a +made-up hostname (`zzznope.inference.coop`) also answers the **new** box at the +authoritative nameservers, so the wildcard itself now points at the new box. -## The old box still exists (rollback), and serves nothing +## ⚠️ UNRESOLVED (operator decision): the old box is still alive and internet-exposed -- `179.199.135.72` is **still powered on** and answers on 22/80/443/587/993, **but - it hosts no running app.** A request with `Host: chat.inference.coop` returns - Cloudron's **"app down / Not Found" fallback page**, and its TLS certificate has - an **empty subject** — the signature of a Cloudron whose vhost's app is stopped, - exactly as documented ("powered on with apps stopped"). -- **No DNS reference points at it**, so it receives no real traffic. -- **Decommission is still pending** — this is the one open item from the cutover - that has not happened. Its backup schedule must remain **disabled** while it is - kept (two boxes on one S3 bucket interleave and prune each other's backups). +`179.199.135.72` is **powered on, reachable from the internet, and unaltered.** This +is not "a spare kept for rollback" — it is a **decommissioned server still running +and still exposed.** + +- **Open to the internet (verified 2026-11-04):** ports **22, 80, 443, 587, 993** + answer. (3306/5432/8080 are closed.) +- It answers HTTPS **for any Host header** with a **generic Cloudron-served page** + (its fallback / "app down" page, empty-subject certificate) rather than a real + app — because its apps are stopped. +- **It still holds whatever old data and configuration it had** — the old Cloudron + platform, its app data, and its host config are all present on the disk. +- **Nothing in DNS points to it**, so it serves **no member traffic** — the exposure + is the open ports and the retained data/config, not live traffic. + +**Decision needed from the operator:** either **shut it down**, or **firewall it** +(close all but what is genuinely needed) if it is being kept as a rollback. It is +NOT the steward's to act on: **do not shut it down or change anything on it without +the operator's word.** Its backup schedule must stay **disabled** while it is kept +(two boxes on one S3 bucket interleave and prune each other's backups). ## Still unresolved / for the operator -- **Decommission the old box** (`179.199.135.72`) when rollback is no longer - wanted, after confirming the new box's backups are proven. +- **The old box's exposure** — see above. Shut down or firewall. - **Member mailbox contents** — the long-standing unknown from §7 (whether members' mail is inside the Cloudron backup) still needs a real IMAP login to confirm.