Editing Wiki.tetrain.com Upgrade Plan (section)

== 9. Post-handover: production DNS cutover (2026-07-25) ==

Client updated DNS directly (no registrar/API access was available in this environment to do it here): <code><nowiki>wiki.tetrain.com</nowiki></code> A record repointed from the old CentOS 7 box (172.105.56.64) to <code><nowiki>wiki-new.tetrain.com</nowiki></code> (172.105.39.56), and a new <code><nowiki>wiki-old.tetrain.com</nowiki></code> A record created pointing at the old box so it stays reachable post-cutover.

DNS alone wasn't sufficient — two things on the server side would have made the real domain look broken to visitors even with DNS correct, both found and fixed same-day:

# '''TLS certificate didn't cover the real domain.''' The existing Let's Encrypt cert (Section 5) only had <code><nowiki>wiki-new.tetrain.com</nowiki></code> in its SAN list; hitting <code><nowiki>https://wiki.tetrain.com</nowiki></code> fell through to Apache's default self-signed cert (browser security warning). Expanded the same cert lineage via <code><nowiki>certbot --apache -d wiki-new.tetrain.com -d wiki.tetrain.com --expand</nowiki></code>. Certbot issued the expanded cert but couldn't auto-install it into the vhost (ambiguous vhost match, no <code><nowiki>ServerAlias</nowiki></code> declared) — fixed manually by adding <code><nowiki>ServerAlias wiki.tetrain.com</nowiki></code> to both the port-80 and port-443 vhost blocks (<code><nowiki>/etc/httpd/conf.d/wiki.conf</nowiki></code>, <code><nowiki>wiki-le-ssl.conf</nowiki></code>, both backed up before editing) and broadening the HTTP→HTTPS <code><nowiki>RewriteCond</nowiki></code> to match either hostname.
# '''<code><nowiki>$wgServer</nowiki></code> still pointed at the old hostname.''' MediaWiki would have kept generating every internal link, canonical URL, and redirect against <code><nowiki>wiki-new.tetrain.com</nowiki></code> even with the correct cert and DNS in place. Updated <code><nowiki>$wgServer</nowiki></code> to <code><nowiki>https://wiki.tetrain.com</nowiki></code> in <code><nowiki>LocalSettings.php</nowiki></code> (backed up first).

'''Verified end-to-end''': valid cert presented for both hostnames (confirmed via SNI-specific TLS handshake against each), <code><nowiki>http://</nowiki></code> → <code><nowiki>https://</nowiki></code> redirect works for both, full redirect chain to <code><nowiki>Main_Page</nowiki></code> returns <code><nowiki>200 OK</nowiki></code>, and a video-embed page (Section 8) renders correctly — iframe present — when loaded via <code><nowiki>https://wiki.tetrain.com</nowiki></code>. <code><nowiki>wiki-old.tetrain.com</nowiki></code> resolves to and serves the old box.

Outbound email was checked as part of this same pass and found broken (see "Not yet done" above) — client explicitly deferred fixing it.

[[Category:Infrastructure Documentation]]