fix(deploy): keep reactome.org's retirement a 503, not a browser warning - #224
Merged
Merged
Conversation
Found by reading the authenticator list after migrating beta: reactome.org was still on `apache`, and following that thread showed the nginx config had a matching gap. This box answers for `reactome.org` and `www.reactome.org` -- not because it serves them, production does, but because the retired Apache vhost lists them as aliases and presents the reactome.org certificate when something points there. My configuration had no server block for either, so they would have fallen to the catch-all and been shown *beta's* certificate: a name mismatch, and therefore a browser security warning where Apache gives a clean 503. That is a worse retirement than the one being replaced. They get their own block and their own certificate now, returning 503 as before. Verified: reactome.org, www.reactome.org, dev.reactome.org and an unknown name all 503; beta still proxies. Which means three certificates must renew without Apache before any cutover, not two. That is easy to talk yourself out of -- production serves the name, so why keep the certificate -- and the answer is that this box still answers for it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
reactome.org must renew without Apache too. This box answers for that name and for www because the retired vhost lists them as aliases, so the certificate has to keep existing and keep renewing -- otherwise those names get beta's certificate and a browser warning instead of a 503. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found by reading the authenticator list after migrating beta's certificate:
reactome.orgwas still onapache. Following that thread showed the nginxconfiguration had a matching gap.
The gap
This box answers for
reactome.organdwww.reactome.org— not because itserves them, production does, but because the retired Apache vhost lists them as
aliases and presents the
reactome.orgcertificate when something points there.dev.confhad no server block for either name, so they would have fallen to thecatch-all and been shown beta's certificate. A name mismatch, so a browser
security warning where Apache currently gives a clean 503 — a worse retirement
than the one being replaced.
The fix
They get their own server block and their own certificate, returning 503.
Verified against a running nginx:
reactome.orgwww.reactome.orgdev.reactome.orgbeta.reactome.orgWhat this changes about the cutover
Three certificates must renew without Apache, not two. That is easy to talk
yourself out of — production serves the name, so why keep the certificate here —
and the answer is that this box still answers for it.
All three have since been moved to
dns-cloudflareon the dev box. Proving theyrenew is a separate, in-progress step; the configuration in this PR is what makes
the third one necessary.
🤖 Generated with Claude Code