From 3a89c77cfc7bcdf8cdc1c1cd125aef16fc039bb0 Mon Sep 17 00:00:00 2001 From: Inferencebot Date: Fri, 30 Oct 2026 17:58:48 +0000 Subject: [PATCH] migration: fill in the new box addresses, decide IPv6, add box specs New box: 179.237.86.116 / 2001:1600:18:206::89, 4CPU/12GB/250GB, Ubuntu 26.04 LTS, one free snapshot slot, reverse DNS unset on both addresses. IPv6 exists, so the 18 AAAA records are repointed rather than deleted. --- cloudron-server-migration.md | 19 ++++---- dns-change-sheet.md | 92 +++++++++++++++++++++--------------- 2 files changed, 64 insertions(+), 47 deletions(-) diff --git a/cloudron-server-migration.md b/cloudron-server-migration.md index bbc0278..75edaf4 100644 --- a/cloudron-server-migration.md +++ b/cloudron-server-migration.md @@ -53,20 +53,24 @@ needed to restore are inside the thing being restored. - [ ] Confirm the backup target's S3 access key is available off-box. The agent host has `~/.hermes/security/backup_sites_backup.json` (0600) — check whether it carries the key; if not, retrieve it from the Infomaniak console. -- [ ] New host capacity: `df -h`, `free -m`, `lsb_release -a`, `cloudron --version`. - Must hold ~6 GB of app data plus Docker images and growth; check swap exists. -- [ ] OS: same or newer Ubuntu than the old box. Cloudron install version must be ≥ the - old box's (9.0.4). +- [x] New host capacity: **4 CPU, 12 GB RAM, 250 GB disk** (given 2026-10-30) — ample for + ~6 GB of app data plus images. Old box used ~17 GB of 58 GB. +- [ ] OS: the new box is **Ubuntu 26.04 LTS**. Confirm Cloudron 9.x supports 26.04 *before* + installing — an unsupported release can be refused by the installer. Install version + must be ≥ the old box's (9.0.4). - [ ] Confirm the Cloudron subscription can be moved to a new server. -- [ ] **Decide the IPv6 question before anything else DNS-related.** The zone carries +- [ ] **IPv6: DECIDED — repoint.** The new box has `2001:1600:18:206::89`, so all 18 + AAAA records move with the A records (§3 originally left this open). The zone carries **AAAA records on 18 hostnames** — everything that has an A record — all pointing to `2a02:4780:6e:83fd::1` (Hostinger's range). Counted 2026-10-30; the full list is in `dns-change-sheet.md`. This is 18 deletions or repoints, not a footnote. If the new box has IPv6, repoint them; if it does not, **delete the AAAA records** as part of the switch. Changing only the A records leaves every IPv6-capable client — including other Matrix homeservers and mail senders — still reaching the old box. -- [ ] Ask Infomaniak to set **rDNS/PTR for the new IP to `my.inference.coop`** — mail - deliverability depends on it. +- [ ] Set **rDNS/PTR → `my.inference.coop` on BOTH `179.237.86.116` and + `2001:1600:18:206::89`**. The console lists reverse DNS as unconfigured for both. + Not time-sensitive — do it now. If IPv6 sending causes trouble later, disable v6 + egress for SMTP rather than removing the AAAA. - [ ] Open on the new box: **22, 80, 443, 465, 587, 993, and 25 inbound** (mail delivery — test from outside, e.g. `telnet my.inference.coop 25` once DNS moves; note that many networks block *outbound* 25, so a closed result from inside another server is @@ -169,7 +173,6 @@ needed to restore are inside the thing being restored. - Whether the S3 access key is in the off-box JSON or only inside Cloudron. - Whether any provider API key is bound to our current IP. - Whether the subscription permits a server move. -- Whether the new Infomaniak box has IPv6 at all (decides the AAAA action). ## 8. Pitfalls this server has already produced diff --git a/dns-change-sheet.md b/dns-change-sheet.md index 29dd750..0e8c962 100644 --- a/dns-change-sheet.md +++ b/dns-change-sheet.md @@ -17,43 +17,43 @@ every change below is manual. **Nothing here is time-sensitive except the TTL lo | Name | Type | Current | Set to | |---|---|---|---| -| `chat-legacy.inference.coop` | A | `179.199.135.72` | `` | -| `chat.inference.coop` | A | `179.199.135.72` | `` | -| `cloud.inference.coop` | A | `179.199.135.72` | `` | -| `dashboard.inference.coop` | A | `179.199.135.72` | `` | -| `docs.inference.coop` | A | `179.199.135.72` | `` | -| `email.inference.coop` | A | `179.199.135.72` | `` | -| `forum.inference.coop` | A | `179.199.135.72` | `` | -| `gateway.inference.coop` | A | `179.199.135.72` | `` | -| `git.inference.coop` | A | `179.199.135.72` | `` | -| `inference.coop` | A | `179.199.135.72` | `` | -| `matrix.inference.coop` | A | `179.199.135.72` | `` | -| `my.inference.coop` | A | `179.199.135.72` | `` | -| `newsletter.inference.coop` | A | `179.199.135.72` | `` | -| `panel.inference.coop` | A | `179.199.135.72` | `` | -| `portal.inference.coop` | A | `179.199.135.72` | `` | -| `search.inference.coop` | A | `179.199.135.72` | `` | -| `status.inference.coop` | A | `179.199.135.72` | `` | -| `vault.inference.coop` | A | `179.199.135.72` | `` | -| `www.inference.coop` | A | `179.199.135.72` | `` | -| `chat-legacy.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `` | -| `chat.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `` | -| `cloud.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `` | -| `dashboard.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `` | -| `docs.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `` | -| `email.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `` | -| `forum.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `` | -| `gateway.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `` | -| `git.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `` | -| `inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `` | -| `matrix.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `` | -| `my.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `` | -| `newsletter.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `` | -| `panel.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `` | -| `portal.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `` | -| `search.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `` | -| `status.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `` | -| `vault.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `` | +| `chat-legacy.inference.coop` | A | `179.199.135.72` | `179.237.86.116` | +| `chat.inference.coop` | A | `179.199.135.72` | `179.237.86.116` | +| `cloud.inference.coop` | A | `179.199.135.72` | `179.237.86.116` | +| `dashboard.inference.coop` | A | `179.199.135.72` | `179.237.86.116` | +| `docs.inference.coop` | A | `179.199.135.72` | `179.237.86.116` | +| `email.inference.coop` | A | `179.199.135.72` | `179.237.86.116` | +| `forum.inference.coop` | A | `179.199.135.72` | `179.237.86.116` | +| `gateway.inference.coop` | A | `179.199.135.72` | `179.237.86.116` | +| `git.inference.coop` | A | `179.199.135.72` | `179.237.86.116` | +| `inference.coop` | A | `179.199.135.72` | `179.237.86.116` | +| `matrix.inference.coop` | A | `179.199.135.72` | `179.237.86.116` | +| `my.inference.coop` | A | `179.199.135.72` | `179.237.86.116` | +| `newsletter.inference.coop` | A | `179.199.135.72` | `179.237.86.116` | +| `panel.inference.coop` | A | `179.199.135.72` | `179.237.86.116` | +| `portal.inference.coop` | A | `179.199.135.72` | `179.237.86.116` | +| `search.inference.coop` | A | `179.199.135.72` | `179.237.86.116` | +| `status.inference.coop` | A | `179.199.135.72` | `179.237.86.116` | +| `vault.inference.coop` | A | `179.199.135.72` | `179.237.86.116` | +| `www.inference.coop` | A | `179.199.135.72` | `179.237.86.116` | +| `chat-legacy.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` | +| `chat.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` | +| `cloud.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` | +| `dashboard.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` | +| `docs.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` | +| `email.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` | +| `forum.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` | +| `gateway.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` | +| `git.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` | +| `inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` | +| `matrix.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` | +| `my.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` | +| `newsletter.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` | +| `panel.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` | +| `portal.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` | +| `search.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` | +| `status.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` | +| `vault.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` | `www` has no app behind it in the Cloudron inventory — confirm whether it is an alias, a redirect, or stale before touching it. @@ -70,8 +70,9 @@ a redirect, or stale before touching it. ## Sequence (see the main runbook §4) 1. A day early: set every A and AAAA TTL to 300 s. -2. At cutover: point A records at the new IP; repoint or **delete** every AAAA record - (decide in advance — an IPv6-capable client or homeserver left on Hostinger's address +2. At cutover: point A records at **`179.237.86.116`**; repoint every AAAA record to **`2001:1600:18:206::89`** + (the new box has IPv6, so this is a repoint, not a delete — but it must happen in + the same pass: an IPv6-capable client or homeserver left on Hostinger's address reaches the old box even after the A switch). 3. Verify with the resolver set below, not one resolver. @@ -80,3 +81,16 @@ for h in inference.coop my.inference.coop matrix.inference.coop gateway.inferenc dig +short A $h @1.1.1.1; dig +short A $h @8.8.8.8; dig +short AAAA $h @1.1.1.1 done ``` + +## The new box (given 2026-10-30) + +- **IPv4** `179.237.86.116` · **IPv6** `2001:1600:18:206::89` +- 4 CPU · 12 GB RAM · **250 GB disk** · unlimited traffic +- **1 snapshot slot free** — take a snapshot *after* a clean restore and *before* the DNS + switch, so a bad restore is a revert rather than a rebuild. +- Location Plan-les-Ouates, Switzerland (same provider as the backup target, so the + restore reads from inside Infomaniak's network). +- Ubuntu **26.04 LTS** — confirm Cloudron 9.x supports it before installing. +- **Reverse DNS is listed as "configure" for BOTH addresses.** Set PTR → `my.inference.coop` + on the IPv4 *and* the IPv6. A sending IP without matching PTR is the classic cause of + fresh-IP mail landing in spam, and DMARC here is `p=reject` on our own domain.