migration - my-old → my-new

[edospadoni]

Infrastructure tracking issue for the coordinated rollout of the new my service across the fleet. Full step-by-step runbook lives in MIGRATION.md on this repository.

High-level phases

• Phase 1 — new my go-live (parallel to old my)

  • Merge my#81; deploy to Render prod
  • Add /collect/ + /backend/ proxy_pass on my-ent nginx so my.nethesis.it serves both old my and new my from the same hostname
  • Repoint the translation proxy's upstream from qa.my.nethesis.it to the Render prod URL

• Phase 2 — dual-send release (safe)

  • Merge nethsecurity#1608; release firmware
  • Merge ns8-core#1146; release core package set
  • Verify shadow traffic on my-ent's /var/log/proxy/*.log and on new my dashboard

• Phase 3 — cutover release (actual migration)

  • Merge nethsecurity#1609 + nethsecurity-ui#746; release firmware
  • Merge ns8-core#1148; release core package set
  • Monitor facts.migration.from_legacy_system_id coverage vs. proxy_mappings row count

• Phase 4 — DNS cutover

  • Flip my.nethesis.it DNS to new my Render
  • Publish old.my.nethesis.it → my-ent (same IP my.nethesis.it had)
  • Configure new my Render ingress forwards for /api/*, /isa/*, /proxy/*, /#/server/* → old.my.nethesis.it
  • Remove the "Create new system" button from old my UI

• Phase 5 — decommissioning

  • Retire /proxy/* on my-ent once facts.migration.from_legacy_system_id covers the fleet
  • Leave old.my.nethesis.it, backupd.nethesis.it and my.nethserver.com (dartagnan) online indefinitely — non-upgradable legacy systems and NS8 community still depend on them for heartbeat/inventory/backup, and migrated units still hit /api/Utils/freekey at unregister time

Pull requests involved

#	Repo	PR	Status
1	my	#81	Review
2	nethsecurity	#1608 dual-send	Ready
3	nethsecurity	#1609 cutover	Draft
4	nethsecurity-ui	#746 UI consumer	Draft
5	ns8-core	#1146 dual-send	Ready
6	ns8-core	#1148 cutover	Draft

Go / no-go

Safe to merge any time: #81, #1608, #1146. Cutover PRs blocked until Phase 1 is complete and my.nethesis.it/proxy/credentials responds with mapped credentials for a known test unit.

Refs: #83.