From a0245748fbb43a593d195e1737adfc6a590d7a45 Mon Sep 17 00:00:00 2001 From: Yisroel Baum Date: Tue, 18 Aug 2026 09:56:35 +0300 Subject: [PATCH] test staging domain retirement --- checks/rabbi-gerzi-domains.nix | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/checks/rabbi-gerzi-domains.nix b/checks/rabbi-gerzi-domains.nix index 27c9e62..c3fd6e0 100644 --- a/checks/rabbi-gerzi-domains.nix +++ b/checks/rabbi-gerzi-domains.nix @@ -9,6 +9,8 @@ let backendConfig = config.services.rabbi-gerzi.backend; frontendVirtualHost = config.services.nginx.virtualHosts.${frontendConfig.hostName}; backendVirtualHost = config.services.nginx.virtualHosts.${backendConfig.hostName}; + frontendCertificate = config.security.acme.certs.${frontendConfig.hostName}; + backendCertificate = config.security.acme.certs.${backendConfig.hostName}; redirectVirtualHost = lib.attrByPath [ "www.rabbigerzi.com" ] { } config.services.nginx.virtualHosts; @@ -34,17 +36,24 @@ let assertion = backendConfig.corsAllowedOrigins == [ "https://rabbigerzi.com" - "https://rabbigerzi.yisroelbaum.com" ]; - message = "Rabbi Gerzi CORS origins do not cover production and staging"; + message = "Rabbi Gerzi CORS origins are not production-only"; } { - assertion = builtins.elem "rabbigerzi.yisroelbaum.com" frontendVirtualHost.serverAliases; - message = "Rabbi Gerzi frontend staging alias is missing"; + assertion = !builtins.elem "rabbigerzi.yisroelbaum.com" frontendVirtualHost.serverAliases; + message = "Rabbi Gerzi frontend still serves the staging alias"; } { - assertion = builtins.elem "rabbigerziapi.yisroelbaum.com" backendVirtualHost.serverAliases; - message = "Rabbi Gerzi backend staging alias is missing"; + assertion = !builtins.elem "rabbigerziapi.yisroelbaum.com" backendVirtualHost.serverAliases; + message = "Rabbi Gerzi backend still serves the staging alias"; + } + { + assertion = !builtins.elem "rabbigerzi.yisroelbaum.com" frontendCertificate.extraDomainNames; + message = "Rabbi Gerzi frontend certificate still covers staging"; + } + { + assertion = !builtins.elem "rabbigerziapi.yisroelbaum.com" backendCertificate.extraDomainNames; + message = "Rabbi Gerzi backend certificate still covers staging"; } { assertion = redirectVirtualHost.globalRedirect or null == "rabbigerzi.com";