PX0 proxies and shrinking a migrated source

When a whole server moves with xmass, or an account moves with xoct, the old box does not have to be switched off. It can stay in front of the new one as a web proxy, so that every name still resolving to the old address keeps working while DNS moves at the client's own pace.

That proxy role needs almost nothing: nginx, the certificates, and the per-account proxy vhosts. Everything else the box is still carrying — databases, platform trees, file stores, backups — is dead weight, and on a metered plan it is the difference between an expensive server and a cheap one. xtrim removes exactly that dead weight and nothing else.

Before you shrink anything

A proxy is only safe to shrink once it has proven itself quiet. xtrim enforces that with a minimum age on the conversion marker (_XTRIM_MIN_DAYS, default 14 days, hard floor 7) and a battery of refusals that all have to pass first:

• the account really is a converted proxy, and is not a cancelled account (a cancelled account belongs to boa cleanup, never to xtrim);
• every live vhost is a proxy vhost, and they all agree on ONE target;
• the account's own policy record agrees with what the vhosts say;
• no certificate behind a retained HTTPS vhost has expired;
• every server_name answers both directly on the target and through the proxy relay;
• the target proves, over ssh, that it holds a populated database of each name about to be dropped and serves at least one real (non-proxy) vhost — this is what stops a proxy chain being mistaken for a target;
• nothing else is running that could be mid-flight: no install or upgrade, no other migration tool, and no sqlclean (they share a lock).

If any of those fail the tool stops and says which one. Nothing is deleted on a refusal.

The three stages

Quiesce — reversible. The account is parked: its dispatcher is moved out of the way, its PHP-FPM pools and nginx includes are moved to quarantine, its Solr cores are unloaded (without deleting a single index) and set aside, nginx is reloaded, and every site is re-probed through the proxy. Nothing is deleted. If a probe regresses, the tool puts everything back by itself and aborts.

Shrink — one way. Every database is dumped and the dump verified, the target is re-proved one last time, and only then are the databases and their users dropped and the retired trees removed. Store symlinks are resolved before deletion, so the real content goes and no orphan is left behind on attached storage. The proxy keeps serving throughout, because nothing removed here is part of what the proxy needs.

Finalize — box-wide. Once every account on the box is shrunk, the shared codebases go, MySQL and Solr are stopped and disabled, all but the control panel's PHP-FPM master is stood down, and the box is finally marked as a proxy node, which stands the rest of the BOA machinery down. The nginx watchdog deliberately keeps running: that is exactly what a proxy box wants.

The sequence in practice

xtrim status                     # what is proxied, cert horizon, reclaimable space
xtrim plan    o1                 # the full battery plus an itemised plan
xtrim quiesce o1                 # dry run
xtrim quiesce o1 --live          # parked and reversible; nothing deleted
xtrim restore o1                 # undo, if you change your mind
xtrim shrink  o1                 # dry run
xtrim shrink  o1 --live          # the one-way step
xtrim finalize --live            # only when every account is shrunk

Each verb has its own dry-run token: a clean dry run of one verb never arms a live run of another, and each live run consumes its token before doing any work. all in place of an account name operates on the proxied accounts and skips the others with a notice.

What is never touched

The account's whole config/ tree including its SSL material, and tools/le/ in its entirety. Deleting the certificate store would leave every HTTPS proxy vhost pointing at a file that is not there, and nginx would refuse to start. The system firewall, the BOA tooling directories and the box's own configuration are likewise out of scope.

Certificates on a long-lived proxy

A converted source stops issuing certificates the moment it becomes a proxy — it forwards ACME challenges to the target, which becomes the sole issuer. The frozen copies on the proxy would otherwise simply expire, so a daily mirror pulls each renewed certificate back from the target, verifying expiry and key match before installing it and reloading nginx behind a configuration test. That mirror keeps running long after a shrink; it is not something xtrim replaces.

Undoing things

A quiesce is fully reversible with xtrim restore. A shrink is not reversible on that box: bringing the account back means migrating it back from the live target, using the map and archived aliases that xtrim records in its manifest before the first deletion. If the target itself is gone, that is a restore from the remote backup history — which is why the backup configuration is on the keep list.

Retiring the proxy altogether is a separate operation and belongs to boa cleanup.