Skip to content

dev2-edge: serve retired-domain apps as <name>.pwa.pit.world - #241

Merged
ralyodio merged 1 commit into
masterfrom
worktree-pwa-pit-world
Nov 8, 2026
Merged

ralyodio merged 1 commit into
masterfrom
worktree-pwa-pit-world

Conversation

@ralyodio

@ralyodio ralyodio commented Nov 8, 2026

Copy link
Copy Markdown
Contributor

28 apps whose ICANN domains are being let go now run from their existing dev2 containers as <name>.pwa.pit.world, so the domains can expire.

  • One *.pwa.pit.world wildcard (acme.sh DNS-01 via Porkbun, installed to /etc/ssl/pwa-pit-world, renews from root's acme.sh cron and re-runs caddy-edge-certs) added as an edge cert source; the path unit watches the dir.
  • 34 Caddy routes: 28 apps, 5 -supabase gateways (brisk, c0ncerts, icemap, saasrow, weedforcrypto), c0upons-bbs (board at /bbs).
  • Test asserts the routes and that every pwa host is a single label under the wildcard.

Already applied on dev2 (dev2-edge apply: 344 names unchanged, backup nginx-20261108T123105Z.tgz); all 28 app hosts answer 200.

🤖 Generated with Claude Code

28 apps whose ICANN domains are being let go (stopped 2026-11-03) now run
from their existing dev2 containers under <name>.pwa.pit.world, so the
domains can expire. One *.pwa.pit.world wildcard (acme.sh DNS-01, installed
to /etc/ssl/pwa-pit-world) covers every host; five -supabase hosts expose
the self-hosted Supabase gateways the browser code calls, and c0upons-bbs
serves the board at /bbs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@ralyodio
ralyodio merged commit 6208d03 into master Nov 8, 2026
@github-actions

github-actions Bot commented Nov 8, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

41 finding(s)

HIGH/CRITICAL: 15 | MEDIUM: 12 | LOW: 14

Severity Rule Location
HIGH py-ssrf-outbound-request dev2/dev2-site:151
HIGH py-ssrf-outbound-request dev2/dev2-site:1099
HIGH py-ssrf-outbound-request dev2/dev2-site:1843
HIGH sh-remote-script-execution root-ubuntu.sh:3262
HIGH sh-remote-script-execution root-ubuntu.sh:3263
HIGH sh-remote-script-execution root-ubuntu.sh:5168
HIGH sh-remote-script-execution root-ubuntu.sh:5172
HIGH sh-remote-script-execution root-w3bs-os.sh:3639
HIGH sh-remote-script-execution root-w3bs-os.sh:3640
HIGH sh-remote-script-execution root-w3bs-os.sh:5569
HIGH sh-remote-script-execution root-w3bs-os.sh:5579
HIGH sh-remote-script-execution root-w3bs-os.sh:5586
HIGH sh-remote-script-execution root-w3bs-os.sh:5602
HIGH sh-remote-script-execution root-w3bs-os.sh:5607
HIGH sh-plaintext-download root-w3bs-os.sh:6289
MEDIUM sql-template-interpolation dev2/dev2-site:1326
MEDIUM sql-template-interpolation dev2/dev2-site:1403
MEDIUM sh-remote-script-execution root-ubuntu.sh:5376
MEDIUM redos-nested-quantifier src/domain-free.ts:56
MEDIUM redos-nested-quantifier src/emoji.ts:167
MEDIUM redos-nested-quantifier src/icon.ts:166
MEDIUM redos-nested-quantifier src/mail.ts:1060
MEDIUM sql-template-interpolation src/users-dump.ts:487
MEDIUM sql-string-concatenation src/users-dump.ts:507
MEDIUM sql-template-interpolation src/users-dump.ts:540
MEDIUM sql-string-concatenation src/users-dump.ts:574
MEDIUM redos-nested-quantifier src/wcag.ts:556
LOW secret-generic-credential src/credentials.ts:41
LOW secret-generic-credential src/credentials.ts:58
LOW secret-generic-credential src/credentials.ts:61
LOW secret-generic-credential src/credentials.ts:66
LOW secret-generic-credential src/user-export.ts:689
LOW secret-generic-credential src/user-export.ts:695
LOW secret-generic-api-key test/credentials.test.ts:208
LOW secret-generic-credential test/mail.test.ts:141
LOW secret-generic-credential test/proxy.test.ts:69
LOW secret-generic-credential test/proxy.test.ts:85
LOW secret-generic-credential test/shorten.test.ts:36
LOW secret-database-url test/users-dump.test.ts:108
LOW secret-database-url test/users-dump.test.ts:119
LOW secret-database-url test/users-dump.test.ts:120

Snippets are redacted; ThreatCrush never prints matched credential material.

ralyodio added a commit that referenced this pull request Nov 8, 2026
…a.pit.world (#242)

sites.d "redirect_to" ({"default": origin, "<host>": origin}) makes
`dev2-site vhost` render redirect-only servers: every host 308s to its
target with path and query kept (308 so POSTs and webhooks survive), and
port 80 keeps the ACME location so the old certificate renews while the
domain lasts. "redirect_paths" sends a prefix elsewhere (c0upons.com/bbs).

The 28 apps moved to <name>.pwa.pit.world in #241 now redirect from their
old domains (supabase.<domain> to <name>-supabase), and env_overrides
pointing at the old URLs follow them so a re-provision cannot undo it.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant