From ba909cd5364fff05f3a97677e6fe608af4c93ace Mon Sep 17 00:00:00 2001 From: Adam Wright Date: Wed, 16 Sep 2026 20:23:09 +0000 Subject: [PATCH 1/2] fix(deploy): keep reactome.org's retirement a 503, not a browser warning Found by reading the authenticator list after migrating beta: reactome.org was still on `apache`, and following that thread showed the nginx config had a matching gap. This box answers for `reactome.org` and `www.reactome.org` -- not because it serves them, production does, but because the retired Apache vhost lists them as aliases and presents the reactome.org certificate when something points there. My configuration had no server block for either, so they would have fallen to the catch-all and been shown *beta's* certificate: a name mismatch, and therefore a browser security warning where Apache gives a clean 503. That is a worse retirement than the one being replaced. They get their own block and their own certificate now, returning 503 as before. Verified: reactome.org, www.reactome.org, dev.reactome.org and an unknown name all 503; beta still proxies. Which means three certificates must renew without Apache before any cutover, not two. That is easy to talk yourself out of -- production serves the name, so why keep the certificate -- and the answer is that this box still answers for it. Co-Authored-By: Claude Opus 5 --- deploy/nginx/dev.conf | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/deploy/nginx/dev.conf b/deploy/nginx/dev.conf index 6dde7fa..d359634 100644 --- a/deploy/nginx/dev.conf +++ b/deploy/nginx/dev.conf @@ -98,6 +98,29 @@ server { return 503; } +# reactome.org and www.reactome.org, if anything points them here. +# +# Production serves these names. This box answers for them only because the +# retired Apache vhost lists them as aliases, and it presents the reactome.org +# certificate when it does. Without this block they would fall to the catch-all +# below and be shown *beta's* certificate -- a name mismatch, so a browser +# security warning where Apache gives a clean 503. That is a worse retirement +# than the one being replaced. +# +# The certificate must therefore keep existing and keep renewing. It renewed via +# the apache authenticator until 2026-09-16; moving it to dns-cloudflare is part +# of the cutover, not optional, because after the cutover there is no Apache for +# it to authenticate through. +server { + listen 80; + listen 443 ssl; + server_name reactome.org www.reactome.org; + ssl_certificate /etc/letsencrypt/live/reactome.org/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/reactome.org/privkey.pem; + include /etc/nginx/common/tls.conf; + return 503; +} + # Anything else pointed at this box. # # A name we do not serve cannot be answered without a certificate mismatch From 4136f132b2ecfccee714559997c1b17fdd729d8f Mon Sep 17 00:00:00 2001 From: Adam Wright Date: Wed, 16 Sep 2026 20:25:49 +0000 Subject: [PATCH 2/2] docs(deploy): three certificates, not two reactome.org must renew without Apache too. This box answers for that name and for www because the retired vhost lists them as aliases, so the certificate has to keep existing and keep renewing -- otherwise those names get beta's certificate and a browser warning instead of a 503. Co-Authored-By: Claude Opus 5 --- deploy/nginx/README.md | 29 ++++++++++++++++++++--------- 1 file changed, 20 insertions(+), 9 deletions(-) diff --git a/deploy/nginx/README.md b/deploy/nginx/README.md index 2aefe38..b2c3645 100644 --- a/deploy/nginx/README.md +++ b/deploy/nginx/README.md @@ -121,15 +121,26 @@ do not own. Deployed environments present certificates the server already holds. This box needs exactly two: -| | | -| ------------------- | ----------------------------------------------- | -| `beta.reactome.org` | the site | -| `dev.reactome.org` | the retired host, so its 503 is not a TLS error | - -and eventually only one, when the Angular site is the one going forward. The -wikis live on the release machine; `login.dev` is gone. The `reactome.org` -certificate here is presented only because the retired vhost lists that name as -an alias — production serves it. +| | | +| ------------------- | ----------------------------------------------------------- | +| `beta.reactome.org` | the site | +| `dev.reactome.org` | the retired host, so its 503 is not a TLS error | +| `reactome.org` | the same, for the two aliases the retired vhost answers for | + +The wikis lived here as leftovers and were deleted on 2026-09-16, along with the +long-expired `login.dev`. + +The third is easy to talk yourself out of. Production serves `reactome.org`, so +it is tempting to drop the certificate — but this box still _answers_ for that +name and for `www`, because the retired vhost lists them as aliases. Drop the +certificate and those names get beta's instead: a name mismatch, so a browser +security warning where there is currently a clean 503. A worse retirement than +the one being replaced. + +So all three certificates must renew without Apache before the cutover, not two. +`reactome.org` was still on the apache authenticator after the first migration +pass — worth checking rather than assuming, since the script only moves what it +is told to. ## Before any of this serves traffic