chore: decommission ScanA11y (sa-core scanner, both vhosts, LDAP tenant, mail + nb references) #243

New issue

Open

opened 2026-07-30 11:45:50 +02:00 by dominik.polakovics · 0 comments

dominik.polakovics commented

2026-07-30 11:45:50 +02:00

Owner

Retire ScanA11y across the fleet: the sa-core scanner on web-arm, both nginx vhosts, the dc=scana11y,dc=com LDAP tenant on mail, and the leftover references on nb. Scanning capability ends outright — no replacement, and the (dead) pa11y/a11ywatch dashboards that would have been the obvious replacement go with it.

Decided in a design review on 2026-07-30; scope, sequencing and accepted risks below are settled, not open questions.

Repo changes — one PR, merge held (see gate)

web-arm

delete hosts/web-arm/modules/sa-core.nix (the services.sa-core module: monthly timer/service per instance, user scana11y_com, sops.secrets.sa-core-mailpw)
delete hosts/web-arm/modules/scana11y.nix (the only instance: wohnservice-wien.at, monthly, report to dominik.polakovics@cloonar.com)
delete hosts/web-arm/pkgs/sa-core.nix and drop the sa-core line from hosts/web-arm/overlays/packages.nix
delete hosts/web-arm/sites/scana11y.com.nix and hosts/web-arm/sites/stage.scana11y.com.nix; drop both imports from hosts/web-arm/sites/default.nix
hosts/web-arm/configuration.nix: drop both module imports, the now-pointless "comment out for first build" note above them (it existed only because sa-core built from the private ScanA11y/sa-core repo at eval time), and the commented-out # ./modules/a11ywatch.nix
separate commit: delete hosts/web-arm/modules/pa11y.nix and hosts/web-arm/modules/a11ywatch.nix — byte-identical duplicates, neither imported

mail

hosts/mail/modules/openldap.nix: drop { suffix = "dc=scana11y,dc=com"; } from tenants. Rewrite the index comment to state the real rule (lib.imap1 (i: mkTenant (i + 2)) → index = position + 2, so {03}–{06} after removal) instead of patching the numbers: the existing comment claims {03} {04} {06} {08} {09}, which the code has not produced for some time.
hosts/mail/modules/dovecot.nix: drop the doveadm user *@scana11y.com sync block
no postfix change: virtual_mailbox_domains is LDAP-driven, so mail acceptance stops on its own

nb / shared

hosts/nb/users/dominik.nix: remove the office@scana11y.com Thunderbird account
utils/home-manager/development/default.nix: remove the ScanA11y/sa-core clone line
hosts/nb/users/configs/project_history.json: remove the scana11y/sa-core entry (leave the wohnservice entries — unrelated project)

Deliberately untouched

hosts/web-arm/secrets.yaml — sa-core-mailpw is removed by hand via sops (see checklist)
docs/adr/0016 — its SPF-domain list mentions scana11y.com as a historical record
CONTEXT.md and no new ADR — the purge below means no new anomaly to document, and nothing architectural is being reversed

Merge gate (human, on mail, before merge)

All tenants share one LMDB environment (CONTEXT.md:26), so dropping an olcDatabase leaves its entries on disk but unreachable — dc=optiprot,dc=eu and dc=ghetto,dc=at are already in that state. To avoid a third orphan, purge the subtree while the tenant is still served:

ldapdelete -r -D cn=admin,dc=cloonar,dc=com -W dc=scana11y,dc=com
ldapsearch  -b dc=scana11y,dc=com          # expect: No such object

Only then merge. Merging deploys to web-arm, mail and nb within ~5 min via bento.

Post-deploy cleanup (host state NixOS will not remove)

rm -rf /var/www/scana11y.com /var/www/stage.scana11y.com (includes all report PDFs)
userdel / groupdel scana11y_com and stage_scana11y_com — orphaned UIDs can otherwise be handed to a future site user
rm -rf /var/lib/acme/scana11y.com /var/lib/acme/stage.scana11y.com
docker rmi cloonar/sa-core:v0.1.3 — docker itself stays enabled, modules/rustdesk.nix also sets virtualisation.docker.enable
on mail: rm /var/lib/rspamd/dkim/scana11y.com.* — rspamd signs from a per-domain templated path, so the key file is host state with no repo reference
check web-arm MySQL for an orphan DB/user for the PHP site — none is declared in the repo, so any that exists was made by hand
nix-shell -p sops --run 'sops hosts/web-arm/secrets.yaml' → remove sa-core-mailpw
Hetzner: delete the scana11y.com zone (A/AAAA/MX/SPF/DKIM/DMARC) — a live MX for a domain with no mailboxes only makes bounces
record the domain renewal date and decide lapse vs park, so it does not silently auto-renew
archive git.cloonar.com/ScanA11y/sa-core once nothing references it

Accepted risks

No archive of anything. Mailboxes under *@scana11y.com and the LDAP entries are deleted, not exported. Report PDFs are deleted; https://scana11y.com/reports links in already-sent reports will die.
Scanning ends, including the pa11y/a11ywatch dashboards.
If /var/lib/openldap/slapd.d turns out to be mutable rather than regenerated from the Nix settings on start, the next tenant appended after this lands on the index scana11y vacated and could inherit its stale olcDatabase. Worth a slapcat -n0 | grep olcDatabase check at some point.
Blackbox probes need no change — targets are derived from nginx vhosts, so they disappear with them.

Validation

.forgejo/workflows/deploy.yml only runs on push to main and does not build; the PR-time verify.yml was removed (still referenced in its paths-ignore), so the pre-commit hook is the only in-repo dry-build gate. If no dry-build check appears on the PR, run ./scripts/test-configuration web-arm, mail and nb from a nix-capable checkout before merging — nb because utils/ counts as a shared path.

Retire ScanA11y across the fleet: the sa-core scanner on `web-arm`, both nginx vhosts, the `dc=scana11y,dc=com` LDAP tenant on `mail`, and the leftover references on `nb`. Scanning capability ends outright — no replacement, and the (dead) pa11y/a11ywatch dashboards that would have been the obvious replacement go with it. Decided in a design review on 2026-07-30; scope, sequencing and accepted risks below are settled, not open questions. ## Repo changes — one PR, merge held (see gate) **web-arm** - delete `hosts/web-arm/modules/sa-core.nix` (the `services.sa-core` module: monthly timer/service per instance, user `scana11y_com`, `sops.secrets.sa-core-mailpw`) - delete `hosts/web-arm/modules/scana11y.nix` (the only instance: `wohnservice-wien.at`, monthly, report to dominik.polakovics@cloonar.com) - delete `hosts/web-arm/pkgs/sa-core.nix` and drop the `sa-core` line from `hosts/web-arm/overlays/packages.nix` - delete `hosts/web-arm/sites/scana11y.com.nix` and `hosts/web-arm/sites/stage.scana11y.com.nix`; drop both imports from `hosts/web-arm/sites/default.nix` - `hosts/web-arm/configuration.nix`: drop both module imports, the now-pointless "comment out for first build" note above them (it existed only because sa-core built from the private `ScanA11y/sa-core` repo at eval time), and the commented-out `# ./modules/a11ywatch.nix` - separate commit: delete `hosts/web-arm/modules/pa11y.nix` and `hosts/web-arm/modules/a11ywatch.nix` — byte-identical duplicates, neither imported **mail** - `hosts/mail/modules/openldap.nix`: drop `{ suffix = "dc=scana11y,dc=com"; }` from `tenants`. Rewrite the index comment to state the real rule (`lib.imap1 (i: mkTenant (i + 2))` → index = position + 2, so `{03}`–`{06}` after removal) instead of patching the numbers: the existing comment claims `{03} {04} {06} {08} {09}`, which the code has not produced for some time. - `hosts/mail/modules/dovecot.nix`: drop the `doveadm user *@scana11y.com` sync block - no postfix change: `virtual_mailbox_domains` is LDAP-driven, so mail acceptance stops on its own **nb / shared** - `hosts/nb/users/dominik.nix`: remove the `office@scana11y.com` Thunderbird account - `utils/home-manager/development/default.nix`: remove the `ScanA11y/sa-core` clone line - `hosts/nb/users/configs/project_history.json`: remove the `scana11y/sa-core` entry (leave the wohnservice entries — unrelated project) **Deliberately untouched** - `hosts/web-arm/secrets.yaml` — `sa-core-mailpw` is removed by hand via `sops` (see checklist) - `docs/adr/0016` — its SPF-domain list mentions scana11y.com as a historical record - CONTEXT.md and no new ADR — the purge below means no new anomaly to document, and nothing architectural is being reversed ## Merge gate (human, on mail, before merge) All tenants share one LMDB environment (CONTEXT.md:26), so dropping an `olcDatabase` leaves its entries on disk but unreachable — `dc=optiprot,dc=eu` and `dc=ghetto,dc=at` are already in that state. To avoid a third orphan, purge the subtree **while the tenant is still served**: ``` ldapdelete -r -D cn=admin,dc=cloonar,dc=com -W dc=scana11y,dc=com ldapsearch -b dc=scana11y,dc=com # expect: No such object ``` Only then merge. Merging deploys to web-arm, mail and nb within ~5 min via bento. ## Post-deploy cleanup (host state NixOS will not remove) - `rm -rf /var/www/scana11y.com /var/www/stage.scana11y.com` (includes all report PDFs) - `userdel` / `groupdel` `scana11y_com` and `stage_scana11y_com` — orphaned UIDs can otherwise be handed to a future site user - `rm -rf /var/lib/acme/scana11y.com /var/lib/acme/stage.scana11y.com` - `docker rmi cloonar/sa-core:v0.1.3` — docker itself stays enabled, `modules/rustdesk.nix` also sets `virtualisation.docker.enable` - on mail: `rm /var/lib/rspamd/dkim/scana11y.com.*` — rspamd signs from a per-domain templated path, so the key file is host state with no repo reference - check web-arm MySQL for an orphan DB/user for the PHP site — none is declared in the repo, so any that exists was made by hand - `nix-shell -p sops --run 'sops hosts/web-arm/secrets.yaml'` → remove `sa-core-mailpw` - Hetzner: delete the scana11y.com zone (A/AAAA/MX/SPF/DKIM/DMARC) — a live MX for a domain with no mailboxes only makes bounces - record the domain renewal date and decide lapse vs park, so it does not silently auto-renew - archive `git.cloonar.com/ScanA11y/sa-core` once nothing references it ## Accepted risks - **No archive of anything.** Mailboxes under `*@scana11y.com` and the LDAP entries are deleted, not exported. Report PDFs are deleted; `https://scana11y.com/reports` links in already-sent reports will die. - **Scanning ends**, including the pa11y/a11ywatch dashboards. - If `/var/lib/openldap/slapd.d` turns out to be mutable rather than regenerated from the Nix `settings` on start, the next tenant appended after this lands on the index scana11y vacated and could inherit its stale `olcDatabase`. Worth a `slapcat -n0 | grep olcDatabase` check at some point. - Blackbox probes need no change — targets are derived from nginx vhosts, so they disappear with them. ## Validation `.forgejo/workflows/deploy.yml` only runs on push to `main` and does not build; the PR-time `verify.yml` was removed (still referenced in its `paths-ignore`), so the pre-commit hook is the only in-repo dry-build gate. If no dry-build check appears on the PR, run `./scripts/test-configuration web-arm`, `mail` and `nb` from a nix-capable checkout before merging — `nb` because `utils/` counts as a shared path.

dominik.polakovics added the

ready-for-agent

label

2026-07-30 11:45:50 +02:00

dominik.polakovics referenced this issue from a commit

2026-07-30 12:01:06 +02:00

chore(web-arm): delete unimported pa11y/a11ywatch duplicate modules

dominik.polakovics referenced this issue from a pull request that will close it,

2026-07-30 12:01:25 +02:00

chore: decommission ScanA11y (sa-core scanner, both vhosts, LDAP tenant, mail + nb references) #244