From 9edaa0bd53883af1c94640a505c1c96af6ed9f3f Mon Sep 17 00:00:00 2001 From: Lovis23 Date: Sun, 9 Aug 2026 22:47:07 -0500 Subject: [PATCH] infra: preserve www TLS configuration --- infra/aws/README.md | 9 +++++---- infra/aws/encodex-replica.yml | 5 +++++ 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/infra/aws/README.md b/infra/aws/README.md index 8efb79d..7c746a5 100644 --- a/infra/aws/README.md +++ b/infra/aws/README.md @@ -75,8 +75,9 @@ http:///login After the HTTP replica is healthy: 1. Change the Namecheap root `A` record (`@`) to the stack's `ElasticIp` output. -2. Wait until `encodexdrive.com` resolves to the new address. -3. Through SSM, switch Caddy to its production configuration: +2. Change the Namecheap `www` `A` record to the same `ElasticIp` output. +3. Wait until both domains resolve to the new address. +4. Through SSM, switch Caddy to its production configuration: ```bash sudo ln -sfn /etc/caddy/Caddyfile.production /etc/caddy/Caddyfile @@ -84,9 +85,9 @@ sudo caddy validate --config /etc/caddy/Caddyfile sudo systemctl reload caddy ``` -4. Verify `https://encodexdrive.com/login` and an authenticated database-backed +5. Verify both HTTPS hostnames and an authenticated database-backed API request. -5. Keep the old EC2 instance running for a rollback window. +6. Keep the old EC2 instance running for a rollback window. The old AWS credentials and SSH GitHub secrets should only be removed after the new deployment and DNS cutover have been stable. diff --git a/infra/aws/encodex-replica.yml b/infra/aws/encodex-replica.yml index 5fefe49..c3fba47 100644 --- a/infra/aws/encodex-replica.yml +++ b/infra/aws/encodex-replica.yml @@ -254,6 +254,11 @@ Resources: encode zstd gzip reverse_proxy 127.0.0.1:30180 } + + www.${DomainName} { + encode zstd gzip + reverse_proxy 127.0.0.1:30180 + } CADDY_PRODUCTION chown root:caddy /etc/caddy/Caddyfile.pre-dns /etc/caddy/Caddyfile.production