Jinemi/thermograph
4
0
Fork 0
Code Issues 2 Pull requests 4 Projects Releases Packages Wiki Activity Actions 2

provision-env-db: revoke PUBLIC connect on the owner database too #108

Merged
admin_emi merged 2 commits from fix/harden-owner-db-connect into dev 2026-07-26 07:17:21 +00:00
Conversation 0 Commits 2 Files changed 2 +11
1 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit 24b7ef4c86 - Show all commits

11
infra/deploy/RUNBOOK-vps1-vps2-cutover.md
View file

@ -247,12 +247,23 @@ serving; nothing has moved yet.
``` ```
ssh agent@169.58.46.181 ssh agent@169.58.46.181
sudo caddy validate --config /etc/caddy/Caddyfile # BEFORE reloading sudo caddy validate --config /etc/caddy/Caddyfile # BEFORE reloading
# `validate` runs as root and CREATES any log file the config names, owned by
# root — which the caddy user then cannot open, and the reload fails. Fix the
# ownership before reloading, or the first reload rejects the whole config:
sudo chown caddy:caddy /var/log/caddy/beta.log
sudo systemctl reload caddy sudo systemctl reload caddy
``` ```
Validate before reload, always: a malformed Caddyfile takes `thermograph.org` Validate before reload, always: a malformed Caddyfile takes `thermograph.org`
down with it, and prod is on this box now. down with it, and prod is on this box now.
The `chown` is not optional and it bit this cutover. `caddy validate` as root
left `/var/log/caddy/beta.log` as `root:root`, so the reload failed with
`permission denied` on the log writer. (The root-owned `centralis.log` sitting
in that directory is the same mistake, made earlier.) Note what did NOT happen:
Caddy rejects a bad config atomically and keeps serving the old one, so
`thermograph.org` stayed up throughout — verify it anyway.
Caddy cannot issue the certificate until DNS moves (step 7), so expect the beta Caddy cannot issue the certificate until DNS moves (step 7), so expect the beta
hostname to fail TLS until then. That is fine and expected. hostname to fail TLS until then. That is fine and expected.