From d858abb87aef062527f08c51ef896673125fdf16 Mon Sep 17 00:00:00 2001 From: Anthony Ettinger Date: Sat, 1 Aug 2026 18:02:13 +0000 Subject: [PATCH] Retry the origin verification, which raced its own nginx reload MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The first live run of setup-origin.sh reported: warning: the server answered 'chovy.hacker' with: subject=CN=dev.profullstack.com warning: another server block is matching first — check for a default_server The configuration was already correct. `nginx -s reload` returns when the signal is sent, not when the new workers are serving — old workers keep handling connections until they drain — so the check was answered by the config from before the reload. Which is the worst possible false positive here: it is indistinguishable from the real default-vhost fallthrough this check exists to catch, and it tells an operator their working site is broken. Retries five times at one-second intervals and only warns if the name still does not match. Verified on the box it was found on: the re-run reports `subject=CN=chovy.hacker` cleanly, reuses the existing key, and prints the same pin. Co-Authored-By: Claude Opus 5 (1M context) --- scripts/setup-origin.sh | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/scripts/setup-origin.sh b/scripts/setup-origin.sh index 6271959..b3bc99d 100755 --- a/scripts/setup-origin.sh +++ b/scripts/setup-origin.sh @@ -139,12 +139,29 @@ fi # running server what it actually presents for this name. if [ "$DRY_RUN" = "0" ]; then step "checking what the server now presents for $NAME" - presented=$(echo | openssl s_client -connect 127.0.0.1:443 -servername "$NAME" 2>/dev/null \ - | openssl x509 -noout -subject 2>/dev/null || true) + + # Retried, because `nginx -s reload` returns as soon as the signal is sent, + # not when the new workers are serving. The old workers finish their existing + # connections first, so a check fired immediately gets answered by the config + # from *before* the reload — which looks exactly like the default-vhost bug + # this is here to catch. Found the hard way: the first live run of this script + # reported a name mismatch that had already been fixed. + presented="" + attempt=1 + while [ "$attempt" -le 5 ]; do + presented=$(echo | openssl s_client -connect 127.0.0.1:443 -servername "$NAME" 2>/dev/null \ + | openssl x509 -noout -subject 2>/dev/null || true) + case "$presented" in + *"$NAME"*) break ;; + esac + sleep 1 + attempt=$((attempt + 1)) + done + case "$presented" in *"$NAME"*) say " ${DIM}$presented${OFF}" ;; "") warn "could not read a certificate back from 127.0.0.1:443" ;; - *) warn "the server answered '$NAME' with: $presented" + *) warn "after 5 tries the server still answers '$NAME' with: $presented" warn "another server block is matching first — check for a default_server" ;; esac fi