Skip to content

dev2 edge: route group.call.pit.world; a failed re-apply no longer rolls a live edge back - #211

Merged
ralyodio merged 2 commits into
masterfrom
edge-group-call
Oct 26, 2026
Merged

ralyodio merged 2 commits into
masterfrom
edge-group-call

Conversation

@ralyodio

@ralyodio ralyodio commented Oct 26, 2026 •

Copy link
Copy Markdown
Contributor
  • edge.json: group.call.pit.world -> :8810 (no gzip, so SSE is not held back)
  • edge-box: fixes the 2026-10-26 outage. Re-applying to add a site failed its own check (the new site's 404 -> 200 is by design), and the failure path ran the full pre-Caddy rollback, which took every *.pit.world / Moshpit name dark for ~6 minutes. New sites are now unjudged, and on a live edge a failure restores only the Caddyfile, cert sources and stream map.

Applied on dev2 from this branch: 307 names answer exactly as before.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

41 finding(s)

HIGH/CRITICAL: 15 | MEDIUM: 12 | LOW: 14

Severity Rule Location
HIGH py-ssrf-outbound-request dev2/dev2-site:151
HIGH py-ssrf-outbound-request dev2/dev2-site:1062
HIGH py-ssrf-outbound-request dev2/dev2-site:1800
HIGH sh-remote-script-execution root-ubuntu.sh:3262
HIGH sh-remote-script-execution root-ubuntu.sh:3263
HIGH sh-remote-script-execution root-ubuntu.sh:5168
HIGH sh-remote-script-execution root-ubuntu.sh:5172
HIGH sh-remote-script-execution root-w3bs-os.sh:3639
HIGH sh-remote-script-execution root-w3bs-os.sh:3640
HIGH sh-remote-script-execution root-w3bs-os.sh:5569
HIGH sh-remote-script-execution root-w3bs-os.sh:5579
HIGH sh-remote-script-execution root-w3bs-os.sh:5586
HIGH sh-remote-script-execution root-w3bs-os.sh:5602
HIGH sh-remote-script-execution root-w3bs-os.sh:5607
HIGH sh-plaintext-download root-w3bs-os.sh:6289
MEDIUM sql-template-interpolation dev2/dev2-site:1289
MEDIUM sql-template-interpolation dev2/dev2-site:1366
MEDIUM sh-remote-script-execution root-ubuntu.sh:5376
MEDIUM redos-nested-quantifier src/domain-free.ts:56
MEDIUM redos-nested-quantifier src/emoji.ts:167
MEDIUM redos-nested-quantifier src/icon.ts:166
MEDIUM redos-nested-quantifier src/mail.ts:1047
MEDIUM sql-template-interpolation src/users-dump.ts:487
MEDIUM sql-string-concatenation src/users-dump.ts:507
MEDIUM sql-template-interpolation src/users-dump.ts:540
MEDIUM sql-string-concatenation src/users-dump.ts:574
MEDIUM redos-nested-quantifier src/wcag.ts:556
LOW secret-generic-credential src/credentials.ts:36
LOW secret-generic-credential src/credentials.ts:53
LOW secret-generic-credential src/credentials.ts:56
LOW secret-generic-credential src/credentials.ts:61
LOW secret-generic-credential src/user-export.ts:689
LOW secret-generic-credential src/user-export.ts:695
LOW secret-generic-api-key test/credentials.test.ts:208
LOW secret-generic-credential test/mail.test.ts:141
LOW secret-generic-credential test/proxy.test.ts:69
LOW secret-generic-credential test/proxy.test.ts:85
LOW secret-generic-credential test/shorten.test.ts:36
LOW secret-database-url test/users-dump.test.ts:108
LOW secret-database-url test/users-dump.test.ts:119
LOW secret-database-url test/users-dump.test.ts:120

Snippets are redacted; ThreatCrush never prints matched credential material.

…e-Caddy nginx

Adding group.call.pit.world: its baseline answer was the relay's 404 and
Caddy's was 200, so the check failed, and the failure path ran the full
rollback. That hands :443 back to nginx, which no longer serves the
Caddy-only names, and stops Caddy: every *.pit.world site and Moshpit name
was dark 14:00-14:06 UTC on 2026-10-26.

- sites new in the bundle (exact hosts the running Caddyfile does not
  serve) are not judged against their old answer
- with the edge already live, a failure restores only the Caddyfile, cert
  sources and stream map from the backup and reloads; the full rollback
  stays for a first apply

Verified: re-apply on dev2, 307 names unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@ralyodio ralyodio changed the title dev2 edge: route group.call.pit.world to group.call (:8810) dev2 edge: route group.call.pit.world; a failed re-apply no longer rolls a live edge back Oct 26, 2026
@ralyodio
ralyodio merged commit 6b1aa57 into master Oct 26, 2026
5 checks passed
@ralyodio
ralyodio deleted the edge-group-call branch October 26, 2026 14:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant