Editing Wiki.tetrain.com Upgrade Plan (section)

== 5. Progress log ==

* '''2026-07-24''': Base OS setup done — hostname set, <code><nowiki>dnf update</nowiki></code> run (kernel bumped to 5.14.0-687.29, reboot will be needed before go-live to run the current kernel), firewalld enabled, Docker CE 29.6.2 + compose installed.
* '''2026-07-24''': Backup of source <code><nowiki>wiki.tetrain.com</nowiki></code> interrupted — its SSH port stopped responding mid-session (ICMP still fine, port 22 silently drops; not an auth issue, no other access path available). Cause unconfirmed (possible fail2ban-style ban, possible resource event on the tiny 990MB-RAM box, possibly provider-side). Backup poller running in background, will resume the backup the moment it's reachable again.
* '''2026-07-24''': On <code><nowiki>wiki-new.tetrain.com</nowiki></code>: persistent MariaDB 10.11 container started for the hop chain (<code><nowiki>mw-mariadb</nowiki></code>, network <code><nowiki>mwmigrate</nowiki></code>, data volume <code><nowiki>/root/mw-hop-migration/db-data</nowiki></code>). Downloaded all 6 hop-chain release tarballs (1.23.16/1.27.7/1.31.16/1.35.13/1.39.11/1.43.2) into <code><nowiki>/root/mw-hop-migration/tarballs/</nowiki></code>. Building 6 Docker images (one per hop, PHP versions 5.6/5.6/7.2/7.4/8.0/8.1 matched to each MediaWiki version's supported range) — in progress.
* Real hop-chain execution against actual production data is blocked on the backup (see above) — the mechanics can be smoke-tested on an empty schema, but the meaningful test needs the real 1.18.4 data since that's where any real incompatibility would surface.
* '''2026-07-24''': All 6 hop Docker images built successfully (PHP 5.6/5.6/7.2/7.4/8.0/8.1 with mysqli, intl, gd, mbstring, calendar, opcache compiled in).
* '''2026-07-24''': Extension decisions finalized:
** <code><nowiki>HTML5video</nowiki></code> — drop, superseded by <code><nowiki>TimedMediaHandler</nowiki></code> (already installed).
** <code><nowiki>MsUpload</nowiki></code> — turns out to be an official Wikimedia-mirrored extension (not truly third-party as first assessed), actively maintained, confirmed working on 1.43 by other users. Will pull <code><nowiki>wikimedia/mediawiki-extensions-MsUpload</nowiki></code> on the <code><nowiki>REL1_43</nowiki></code> branch.
** <code><nowiki>UserAdmin</nowiki></code> — confirmed abandoned upstream, no reliable PHP8-compatible fork. Its functionality (add/edit/delete users, group management, password-reset/welcome emails) is fully covered by core MediaWiki's own special pages (<code><nowiki>Special:UserRights</nowiki></code>, <code><nowiki>Special:Block</nowiki></code>, <code><nowiki>Special:PasswordReset</nowiki></code>, <code><nowiki>Special:CreateAccount</nowiki></code>). '''Decision: drop, don't port''' — flag this explicitly at handover so nobody goes looking for the old UserAdmin panel URL and finds it missing without knowing why.
* '''2026-07-24''': Production stack built on <code><nowiki>wiki-new.tetrain.com</nowiki></code>, independent of the pending backup:
** Apache 2.4.62 + PHP-FPM 8.3.31 (mysqlnd, gd, mbstring, xml, intl, opcache) wired via <code><nowiki>proxy:unix:/run/php-fpm/www.sock</nowiki></code>.
** MariaDB 10.11.18, hardened (anonymous users removed, remote root removed, test DB dropped), <code><nowiki>my_wiki</nowiki></code> DB created with a '''dedicated scoped <code><nowiki>wikiuser</nowiki></code> account''' — not <code><nowiki>root</nowiki></code> like the old box. Credentials generated randomly, stored root-only-readable at <code><nowiki>/root/.mariadb_root_credentials</nowiki></code> and <code><nowiki>/root/.wiki_db_credentials</nowiki></code> on the box itself, never transmitted through chat.
** firewalld opened for http/https.
** Let's Encrypt cert issued and deployed via certbot (<code><nowiki>--redirect</nowiki></code>, HTTP→HTTPS enforced), auto-renewal configured, expires 2026-10-22. Confirmed serving HTTPS correctly (403 is expected — empty docroot, MediaWiki not deployed yet).
* Only remaining blocker for real progress: <code><nowiki>wiki.tetrain.com</nowiki></code> SSH still unreachable (~26 min and counting as of this note) — site itself (HTTP) confirmed still up and serving fine, so this is SSH-specific, not a box-down event. Background poller watching for recovery.