migration - my-old → my-new

[edospadoni]

Infrastructure tracking issue for the coordinated rollout of the new my service across the fleet. Full step-by-step runbook lives in MIGRATION.md on this repository.

High-level phases

• Phase 1 — new my go-live (parallel to old my)

  • Merge my#81; deploy to Render prod
  • Add /collect/ + /backend/ proxy_pass on my-ent nginx so my.nethesis.it serves both old my and new my from the same hostname
  • Repoint the translation proxy's upstream from qa.my.nethesis.it to the Render prod URL

• Phase 2 — dual-send release (safe)

  • Merge nethsecurity#1608; release firmware
  • Merge ns8-core#1146; release core package set
  • Verify shadow traffic on my-ent's /var/log/proxy/*.log and on new my dashboard

• Phase 3 — cutover release (actual migration)

  • Merge nethsecurity#1609 + nethsecurity-ui#746; release firmware
  • Merge ns8-core#1148; release core package set
  • Monitor facts.migration.from_legacy_system_id coverage vs. proxy_mappings row count

• Phase 3.5 — NethShop & NethSpot on new my (before the DNS flip)
  Both must be merged and released before the flip so the add-on / dashboard integration keeps working when my.nethesis.it becomes new my. Detail runbook: ENTITLEMENTS_RELEASE_TODO.md.

  • Release new my v0.8.0 — entitlements backend + collect native /auth + dashboard widgets; migration 037 applied by hand on QA + prod
  • NethShop — merge nethshop#2 + nethesis-sso#2; deploy plugins to LIVE nethshop.nethesis.it; wp-config prod (owner key; NETH_ENT_MY_API/NETH_ENT_MY_URL; NETHESIS_OPENID_*; NETHESIS_ACTIVATE_REFERRER_HOSTS; NETH_ENT_MY_HOSTS; NETHESIS_USERINFO_ORIGINS_CFG — pre-flip use beta.my.nethesis.it overrides); publish + map the enterprise products (_entitlement_id, must be publish + purchasable); E2E LIVE (Buy → SSO → checkout → grant) + stamp legacy orders; verify renew-services.php covers the enterprise product ids
  • NethSpot — merge/deploy icaro#200 (Logto OIDC login + data-only /userinfo) to nethspot; add prod my origins (my.nethesis.it, beta.my.nethesis.it) to the NethSpot /userinfo CORS allowlist

• Phase 4 — DNS cutover

  • Flip my.nethesis.it DNS to new my Render
  • Publish legacy.my.nethesis.it → my-ent (same IP my.nethesis.it had)
  • Configure new my Render ingress forwards for /api/*, /isa/*, /proxy/*, /auth/* → legacy.my.nethesis.it
  • Remove the "Create new system" button from old my UI
  • Switch NethShop/NethSpot overrides beta.my.nethesis.it → my.nethesis.it (wp-config NETH_ENT_MY_*, CORS/referrer/host allowlists); enable the NethShop login button

• Phase 5 — decommissioning

  • Retire /proxy/* on my-ent once facts.migration.from_legacy_system_id covers the fleet
  • Swap the my-ent grant-all /auth broker → collect native /auth (closes the transitional grant-all); validate nsec feeds (200 with grant / 403 without)
  • Leave legacy.my.nethesis.it, backupd.nethesis.it and my.nethserver.com (dartagnan) online indefinitely — non-upgradable legacy systems and NS8 community still depend on them for heartbeat/inventory/backup, and migrated units still hit /api/Utils/freekey at unregister time

Pull requests involved

#	Repo	PR	Status
1	my	#81	MERGED
2	nethsecurity	#1608 dual-send	MERGED
3	nethsecurity	#1609 cutover	Draft
4	nethsecurity-ui	#746 UI consumer	Draft
5	ns8-core	#1146 dual-send	MERGED
6	ns8-core	#1148 cutover	Draft
7	my	#152 entitlements + /auth + widgets	Open
8	nethshop	#2 add-on integration	Ready-to-merge
9	nethesis-sso	#2 SSO /userinfo	Ready-to-merge
10	icaro	#200 OIDC login + data-only /userinfo	Ready-to-merge

Go / no-go

Cutover PRs blocked until Phase 1 is complete and my.nethesis.it/proxy/credentials responds with mapped credentials for a known test unit.

Refs: #83.

[edospadoni]

📋 Verification runbooks created — step-by-step end-to-end checks covering both scenarios (migration of an existing system and clean install / fresh registration):

• NethSecurity: migration to new my nethsecurity#1765
• NS8: NS8 → new my migration: end-to-end verification (migration + clean install) dev#8078

[DavidePrincipi]

VERIFIED on NS8 NethServer/dev#8078 (comment)