Skip to content

feat(dev2): deploys without the maintenance page (standby_port); page says down for maintenance - #206

Merged
ralyodio merged 1 commit into
masterfrom
fix/dev2-zero-downtime-maintenance
Oct 21, 2026
Merged

ralyodio merged 1 commit into
masterfrom
fix/dev2-zero-downtime-maintenance

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Anthony: "make deploys not show the maintenance page" and "it's misleading to say coming soon it should say down for maintenance".

No maintenance page during a deploy (opt-in per site). sites.d "standby_port" (the app port + 10000 by convention):

  • vhost adds server 127.0.0.1:<standby> backup; to the site's keepalive upstream.
  • provision writes STANDBY_PORT into deploy.env.
  • templates/deploy-app.sh: after a successful build, it starts the new build (app service only) as a separate compose project on the standby port and waits for it to answer, then recreates the main container. While that restarts, nginx's refused connection goes on to the backup. Once the main container is healthy it waits 12 s (nginx fail_timeout) and removes the standby. An EXIT trap removes it on any failure. If the standby never answers (an app that needs sibling services), the deploy carries on as before.

Wording. templates/maintenance.html now says " is down for maintenance. We are updating it and will be back in a minute." instead of " is updating. Back in a moment."

Live on dev2: nixamp.com has standby_port 13216 (nginx backup line added by hand, because a re-render would drop the hand-added $www_to redirect lines in that vhost; deploy-app.sh replaced with this template; backups *.bak-standby). A redeploy of the live sha while probing https://nixamp.com/ once a second gave 37/37 × 200; the one failure was the probe host's own DNS timeout. All rendered maintenance pages were reworded in place.

🤖 Generated with Claude Code

…the page says down for maintenance

A site with sites.d standby_port gets that port as its upstream's nginx
backup, and deploy-app.sh starts the new build there before recreating the
main container, so a deploy never shows the maintenance page. On for
nixamp.com (13216): 37/37 requests 200 through a full redeploy.

The page said '<site> is updating' and read as 'coming soon'; it now says
'<site> is down for maintenance'.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@ralyodio
ralyodio merged commit 5f80d4e into master Oct 21, 2026
4 checks passed
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

41 finding(s)

HIGH/CRITICAL: 15 | MEDIUM: 12 | LOW: 14

Severity Rule Location
HIGH py-ssrf-outbound-request dev2/dev2-site:151
HIGH py-ssrf-outbound-request dev2/dev2-site:1060
HIGH py-ssrf-outbound-request dev2/dev2-site:1798
HIGH sh-remote-script-execution root-ubuntu.sh:3262
HIGH sh-remote-script-execution root-ubuntu.sh:3263
HIGH sh-remote-script-execution root-ubuntu.sh:5164
HIGH sh-remote-script-execution root-ubuntu.sh:5168
HIGH sh-remote-script-execution root-w3bs-os.sh:3639
HIGH sh-remote-script-execution root-w3bs-os.sh:3640
HIGH sh-remote-script-execution root-w3bs-os.sh:5565
HIGH sh-remote-script-execution root-w3bs-os.sh:5575
HIGH sh-remote-script-execution root-w3bs-os.sh:5582
HIGH sh-remote-script-execution root-w3bs-os.sh:5598
HIGH sh-remote-script-execution root-w3bs-os.sh:5603
HIGH sh-plaintext-download root-w3bs-os.sh:6285
MEDIUM sql-template-interpolation dev2/dev2-site:1287
MEDIUM sql-template-interpolation dev2/dev2-site:1364
MEDIUM sh-remote-script-execution root-ubuntu.sh:5372
MEDIUM redos-nested-quantifier src/domain-free.ts:56
MEDIUM redos-nested-quantifier src/emoji.ts:167
MEDIUM redos-nested-quantifier src/icon.ts:166
MEDIUM redos-nested-quantifier src/mail.ts:1047
MEDIUM sql-template-interpolation src/users-dump.ts:487
MEDIUM sql-string-concatenation src/users-dump.ts:507
MEDIUM sql-template-interpolation src/users-dump.ts:540
MEDIUM sql-string-concatenation src/users-dump.ts:574
MEDIUM redos-nested-quantifier src/wcag.ts:556
LOW secret-generic-credential src/credentials.ts:36
LOW secret-generic-credential src/credentials.ts:53
LOW secret-generic-credential src/credentials.ts:56
LOW secret-generic-credential src/credentials.ts:61
LOW secret-generic-credential src/user-export.ts:689
LOW secret-generic-credential src/user-export.ts:695
LOW secret-generic-api-key test/credentials.test.ts:208
LOW secret-generic-credential test/mail.test.ts:141
LOW secret-generic-credential test/proxy.test.ts:69
LOW secret-generic-credential test/proxy.test.ts:85
LOW secret-generic-credential test/shorten.test.ts:36
LOW secret-database-url test/users-dump.test.ts:108
LOW secret-database-url test/users-dump.test.ts:119
LOW secret-database-url test/users-dump.test.ts:120

Snippets are redacted; ThreatCrush never prints matched credential material.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant