fix(deploy): the certificate correction and the security scrub that missed #224 - #225
Merged
Merged
Conversation
Corrects this branch, and corrects something I told Adam with more
confidence than the evidence supported.
I said dev.reactome.org's certificate expiring would turn the retirement
into a browser warning, and built a server block around that. Asking the
running server what it serves for each name says otherwise:
beta.reactome.org presents beta.reactome.org (Let's Encrypt)
dev.reactome.org presents CloudFlare Origin Certificate
reactome.org presents CloudFlare Origin Certificate
www.reactome.org presents CloudFlare Origin Certificate
`001-reactome.conf` sets
`SSLCertificateFile /etc/ssl/cloudflare/reactome-origin.crt`, with the
Let's Encrypt line commented out beneath it. So **only one Let's Encrypt
certificate on this box is used at all**, beta's, and the dev.reactome.org
and reactome.org certificates are leftovers presenting nothing.
The retired names therefore present the Origin certificate here too, which
is what a faithful translation means. All traffic arrives through
Cloudflare, so an Origin certificate is the right thing on this leg -- it
is issued by Cloudflare, long-lived, and not certbot's business, which is
why none of the certbot work touches it.
The separate reactome.org block added in the previous commit is folded
into the same server: same certificate, same 503, one block.
Verified: dev.reactome.org, reactome.org, www.reactome.org and an unknown
name all 503; beta still proxies.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Nothing presents it today, which is exactly why it would be deleted as cruft by someone tidying up -- I nearly recommended it. It is there because the Angular site is expected to move from beta.reactome.org to dev.reactome.org, and the certificate is pre-provisioned for that. Also records what the box actually presents for each name, established by asking the running server rather than by listing what is on disk. Only beta's Let's Encrypt certificate is in use; the retired names present a Cloudflare Origin certificate that certbot does not manage. reactome.org's certificate was deleted: nothing presented it, and it shared a name with dev.reactome.org's, which made combined renewals fight over the same challenge record. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
I wrote them, and I should not have. `deploy/nginx/dev.conf` -- merged and public since #221 -- named the retired site's software and exact version, said it was end of life, stated it had been the entry vector for a real compromise, said the only thing making the host safe was a single 503, and named the precise misconfiguration still present. That is a roadmap: what to attack, that it worked before, how thin the mitigation is, and where to look. I scrubbed the release SOP for far less this morning and then wrote this myself a few hours later. The operational reasoning is kept, because it is the actual argument for the migration: the retired site runs on an Apache loading modules this configuration does not load, so a class of problem that has to be held shut stops being reachable. The specifics belong in internal notes. Also removed: a product-and-version reference in RELEASE-TESTING.md's figures row. The lesson there -- an origin answering a missing path with index.html, a 200 that is not an image -- is the useful part and stays. Reviewed before merging, as asked. Behaviour re-checked afterwards: every retired name returns 503 over both HTTP and HTTPS, for every path including /admin, /ContentService/, /api/ and /chat, so the retired block cannot proxy anything; beta still redirects :80 and proxies :443. Both files the config needs, reactome-origin.crt and .key, exist on the box. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three commits that were on #224's branch but not in the merge: it was merged
automatically the moment its checks went green, at head
4136f13, while I wasstill pushing to it. My own note says never to push follow-ups to an open PR's
branch because they strand. They stranded.
1. The retired names present the wrong certificate
Asking the running server what it serves says:
001-reactome.confsetsSSLCertificateFile /etc/ssl/cloudflare/reactome-origin.crtwith the Let's Encrypt line commented out beneath it — so only beta's Let's
Encrypt certificate is used on that box at all. The merged config presents Let's
Encrypt certificates for the retired names because those certificates exist, not
because anything uses them.
Both files it now references,
reactome-origin.crtand.key, exist on the box —checked, because a missing certificate stops nginx from starting.
2. Security specifics out of a public repository
The merged
dev.confnamed the retired site's software and exact version, said itwas end of life, stated it had been the entry vector for a real compromise, said
the only thing making the host safe was a single 503, and named the precise
misconfiguration still present. Also a product-and-version reference in
RELEASE-TESTING.md.The operational reasoning is kept — the retired site runs on an Apache loading
modules this configuration does not load, so a class of problem that has to be
held shut stops being reachable. The specifics belong in internal notes.
3. Why
dev.reactome.org's certificate is keptNothing presents it today, which is exactly why someone tidying up would delete
it — I nearly recommended exactly that. It is pre-provisioned for the Angular
site moving from
beta.reactome.orgtodev.reactome.org.Verified
nginx -tpasses, and behaviour was re-checked: every retired name returns 503over both HTTP and HTTPS for every path —
/admin,/ContentService/,/api/,/chat— so the retired block cannot proxy anything; beta still redirects:80and proxies
:443.🤖 Generated with Claude Code