Production cutover: apex domain, rollback drill and edge hardeningПереключение в прод: апекс-домен, учебный откат и укрепление на границе

StatusСтатус
completeзавершён
ServiceСервис
portfolio
IssueIssue
#42
Pull requestPull request
#43
ReleaseРелиз
0.1.10
Lead time (h)Время цикла (ч)
2.8

What this cycle decidedЧто решил этот цикл

dmitriimashkov.com serves the site through the mctl custom-domain registry with Cloudflare proxying and a Let's Encrypt certificate issued by DNS-01, and the rollback path was exercised before the domain went live rather than after.dmitriimashkov.com отдаёт сайт через реестр кастомных доменов mctl с проксированием Cloudflare и сертификатом Let's Encrypt, выпущенным через DNS-01, а путь отката был проверен до того, как домен стал публичным, а не после.

TimelineХронология

  1. Issue openedIssue открыт:
  2. Proposal approvedПредложение одобрено: +21 min+21 мин
  3. MergedСмержено: +2 h 25 min+2 ч 25 мин
  4. ReleasedРелиз выпущен: +2 min+2 мин

Manual interventionsРучные вмешательства

Each record below is quoted verbatim in English, the language it was written in.

Каждая запись ниже приводится дословно по-английски — на языке, на котором она была написана.

  1. rolled the service back to 0.1.3 and restored 0.1.4, running the production contract at each of the three points

    the rollback path is the one thing a site cannot claim without having used it, and the right time to use it is while the only live host is the rehearsal one

    2026-09-11T08:09:34Z

  2. disabled Cloudflare Web Analytics for the zone

    the edge injected static.cloudflareinsights.com/beacon.min.js into every page against ADR-0004; the content security policy blocked it, so nothing ran, but the tag shipped in the markup and every load produced a blocked third-party request

    2026-09-11T13:28:00Z

  3. disabled Cloudflare Email Obfuscation for the zone

    the edge replaced the contact mailto with a /cdn-cgi/l/email-protection link and injected a decoder script, so the contact link stopped working with JavaScript off — on a site whose promise is full usability without JavaScript

    2026-09-11T13:32:00Z

  4. repointed the apex from a dead CNAME, deleted the equally dead tsvilt record, added www and a 301 redirect rule that excludes the ACME challenge path

    DNS and the redirect ruleset are wiring, outside the DevLoop by ADR-0001, so every change to them is recorded here

    2026-09-11T14:14:00Z

Back to the colophonНазад к колофону