Retry the origin verification, which raced its own nginx reload

[ralyodio]

Found by running #6 on a real droplet for the first time.

The symptom

==> checking what the server now presents for chovy.hacker
warning: the server answered 'chovy.hacker' with: subject=CN=dev.profullstack.com
warning: another server block is matching first — check for a default_server

The configuration was already correct. nginx -T showed the block loaded, the certificate files were in place, and connecting a moment later returned subject=CN=chovy.hacker.

The cause

nginx -s reload returns as soon as the signal is sent, not when the new workers are serving. Old workers keep handling connections until they drain, so the verification was answered by the configuration from before the reload.

This is the worst possible false positive for this particular check: it is indistinguishable from the real default-vhost fallthrough the check exists to catch, so it tells an operator their working site is broken.

The fix

Retry five times at one-second intervals; warn only if the name still does not match.

Verified on the box it was found on

==> generating a key and certificate for chovy.hacker
  key already exists — reusing it so the published pin stays valid
==> writing the nginx server block
nginx: configuration file /etc/nginx/nginx.conf test is successful
==> checking what the server now presents for chovy.hacker
  subject=CN=chovy.hacker
==> the pin to publish
  chovy.hacker
  v6k99jmaVZC/RqHH5nBEXcCFgqKErHQTsn2umcBHPzQ=

Key reuse confirmed across runs — same pin, so republishing is never needed after a re-run.

chovy.hacker is now live and correct from the public internet:

$ openssl s_client -connect [2604:a880:400:d1:0:4:c3fe:1]:443 -servername chovy.hacker
subject=CN=chovy.hacker
issuer=CN=chovy.hacker
Negotiated TLS1.3 group: X25519MLKEM768

Post-quantum hybrid key exchange, end to end, on a self-signed key the registry will vouch for. The existing dev.profullstack.com vhost on the same box is unaffected (200, chain still valid).

🤖 Generated with Claude Code

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.