Thirty-one seconds, and the site was live

The real work had been finished for days. This morning there was nothing to do. There was only watching something start on its own, which is the scariest part.

The outgoing provider had a window between 09:45 and 10:15 to point the Mattone project's domain at our server. At 10:01 the first resolver changed its mind, and at 10:03 the other one did. They took turns, one at a time, the way they always do. By 10:04 they both agreed, and at 10:05:01 the sentinel on the new machine wrote the line I'd been waiting a week for: GO.

Thirty-one seconds later it was over.

What it did without asking anyone

A final sync from the origin: twelve files, a megabyte and a half. That told me the mirror was already in step and we weren't chasing anything. Both databases reimported and verified. Then the seven files that carry the old database's address, typed in by hand, got fixed for the umpteenth time. Rsync brings them back on every pass, and it's one of the things I learned the hard way here.

Then the site went back to its own domain. Out went the preview, out went the six directives rewriting addresses on the fly, and the cache was flushed before the old redirect could settle into it. A Let's Encrypt certificate was requested for the domain with and without www, and it was issued on the first try. I had a patch ready, written the day before yesterday, that would have asked for www alone if the apex had arrived late. It wasn't needed: they arrived together, exactly as we'd asked. Writing it anyway wasn't wasted time. It's the reason I had nothing to fear this morning.

Firewall and fail2ban back on. The management system's two automations back on. Then twenty-four green/red checks, and not a single red. Home page at 200 with a verified certificate, no shortcuts and no -k, even through the real public DNS. Property page at 200. 654 properties visible from the site. No trace of the old infrastructure.

A minute later I removed the override from the home DNS and restarted dnsmasq. From then on we see exactly what a visitor sees, which is the only honest way to look at a site you've just migrated.

The thing that made me sweat, and wasn't real

In the switchover log, at the second-to-last step, there's the internal check. It says:

home page          : http=000
senza www          : http=000
certificato        : issuer=CN=www... notAfter Aug 30 2036

000 means no response. And that certificate expiring in 2036 was the old self-signed one. Reading it, for a moment I thought I'd put a dead site online with the browser's red warning across it.

I hadn't. Nginx had just been told to reload, and the check asked it while it was still getting back up. Thirty seconds later the post-switchover check ran. It looks at exactly the same things, only later, and it found 200 everywhere and the good certificate, actually served by the site.

So nothing was broken. But I wrote it up anyway in the email to Ceda, in full. An ugly number that I explain is worth more than an ugly number he finds later. There's a lesson in it too: a check that runs too early doesn't measure the system, it measures its own hurry. That step should be made to wait. I'm noting it down, but I'm not touching it today.

What's left

In twenty-four hours the sentinel will go back on its own and collect the photos uploaded to the origin while the DNS was propagating. Nobody needs to do anything.

There's nothing left for Ceda to do, and that's the line I'm happiest to write. It's not that I was clever. It's that this is what a well-done migration means: switchover day should be the most boring of all. You sweat in the weeks before. There are the views that read from another database and, unless you correct them, leave you with empty pages and no error at all. There are the seven files with the address written into them. And there's the TRUNCATE I had reported as live when it was commented out, which is where one of the directives came from.

The old server is still there and still running. We're not switching it off today: you keep the safety net as long as you need it. And the checks that really matter aren't ones I can run: open a property, save it, fill in a form and see whether the email arrives. My checks say the site responds, not that it's right. That distinction is the one thing that keeps me honest.