fix(deploy): keep reactome.org's retirement a 503, not a browser warning - #224
Merged
Merged
Conversation
Found by reading the authenticator list after migrating beta: reactome.org was still on `apache`, and following that thread showed the nginx config had a matching gap. This box answers for `reactome.org` and `www.reactome.org` -- not because it serves them, production does, but because the retired Apache vhost lists them as aliases and presents the reactome.org certificate when something points there. My configuration had no server block for either, so they would have fallen to the catch-all and been shown *beta's* certificate: a name mismatch, and therefore a browser security warning where Apache gives a clean 503. That is a worse retirement than the one being replaced. They get their own block and their own certificate now, returning 503 as before. Verified: reactome.org, www.reactome.org, dev.reactome.org and an unknown name all 503; beta still proxies. Which means three certificates must renew without Apache before any cutover, not two. That is easy to talk yourself out of -- production serves the name, so why keep the certificate -- and the answer is that this box still answers for it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
reactome.org must renew without Apache too. This box answers for that name and for www because the retired vhost lists them as aliases, so the certificate has to keep existing and keep renewing -- otherwise those names get beta's certificate and a browser warning instead of a 503. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
adamjohnwright
added a commit
that referenced
this pull request
Sep 17, 2026
…issed #224 (#225) * fix(deploy): present the certificate Apache actually presents Corrects this branch, and corrects something I told Adam with more confidence than the evidence supported. I said dev.reactome.org's certificate expiring would turn the retirement into a browser warning, and built a server block around that. Asking the running server what it serves for each name says otherwise: beta.reactome.org presents beta.reactome.org (Let's Encrypt) dev.reactome.org presents CloudFlare Origin Certificate reactome.org presents CloudFlare Origin Certificate www.reactome.org presents CloudFlare Origin Certificate `001-reactome.conf` sets `SSLCertificateFile /etc/ssl/cloudflare/reactome-origin.crt`, with the Let's Encrypt line commented out beneath it. So **only one Let's Encrypt certificate on this box is used at all**, beta's, and the dev.reactome.org and reactome.org certificates are leftovers presenting nothing. The retired names therefore present the Origin certificate here too, which is what a faithful translation means. All traffic arrives through Cloudflare, so an Origin certificate is the right thing on this leg -- it is issued by Cloudflare, long-lived, and not certbot's business, which is why none of the certbot work touches it. The separate reactome.org block added in the previous commit is folded into the same server: same certificate, same 503, one block. Verified: dev.reactome.org, reactome.org, www.reactome.org and an unknown name all 503; beta still proxies. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(deploy): dev.reactome.org's certificate is kept on purpose Nothing presents it today, which is exactly why it would be deleted as cruft by someone tidying up -- I nearly recommended it. It is there because the Angular site is expected to move from beta.reactome.org to dev.reactome.org, and the certificate is pre-provisioned for that. Also records what the box actually presents for each name, established by asking the running server rather than by listing what is on disk. Only beta's Let's Encrypt certificate is in use; the retired names present a Cloudflare Origin certificate that certbot does not manage. reactome.org's certificate was deleted: nothing presented it, and it shared a name with dev.reactome.org's, which made combined renewals fight over the same challenge record. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(deploy): take the security specifics out of a public repository I wrote them, and I should not have. `deploy/nginx/dev.conf` -- merged and public since #221 -- named the retired site's software and exact version, said it was end of life, stated it had been the entry vector for a real compromise, said the only thing making the host safe was a single 503, and named the precise misconfiguration still present. That is a roadmap: what to attack, that it worked before, how thin the mitigation is, and where to look. I scrubbed the release SOP for far less this morning and then wrote this myself a few hours later. The operational reasoning is kept, because it is the actual argument for the migration: the retired site runs on an Apache loading modules this configuration does not load, so a class of problem that has to be held shut stops being reachable. The specifics belong in internal notes. Also removed: a product-and-version reference in RELEASE-TESTING.md's figures row. The lesson there -- an origin answering a missing path with index.html, a 200 that is not an image -- is the useful part and stays. Reviewed before merging, as asked. Behaviour re-checked afterwards: every retired name returns 503 over both HTTP and HTTPS, for every path including /admin, /ContentService/, /api/ and /chat, so the retired block cannot proxy anything; beta still redirects :80 and proxies :443. Both files the config needs, reactome-origin.crt and .key, exist on the box. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found by reading the authenticator list after migrating beta's certificate:
reactome.orgwas still onapache. Following that thread showed the nginxconfiguration had a matching gap.
The gap
This box answers for
reactome.organdwww.reactome.org— not because itserves them, production does, but because the retired Apache vhost lists them as
aliases and presents the
reactome.orgcertificate when something points there.dev.confhad no server block for either name, so they would have fallen to thecatch-all and been shown beta's certificate. A name mismatch, so a browser
security warning where Apache currently gives a clean 503 — a worse retirement
than the one being replaced.
The fix
They get their own server block and their own certificate, returning 503.
Verified against a running nginx:
reactome.orgwww.reactome.orgdev.reactome.orgbeta.reactome.orgWhat this changes about the cutover
Three certificates must renew without Apache, not two. That is easy to talk
yourself out of — production serves the name, so why keep the certificate here —
and the answer is that this box still answers for it.
All three have since been moved to
dns-cloudflareon the dev box. Proving theyrenew is a separate, in-progress step; the configuration in this PR is what makes
the third one necessary.
🤖 Generated with Claude Code