Skip to main content

External VPS — history & operations

Dated operations on the legacy Infomaniak VPS marcellus, newest first. Current state is on the External VPS page; hannibal's log is ISC Learn — history & operations.

2026-09-18 — TISC editor migrated off marcellus​

Its two vhosts (tisc.isc-vs.ch, tisc.isc-vs.dev) are dropped from the vhost table — replaced by a dedicated guest on the rack, and the marcellus.isc-vs.ch DNS records at Infomaniak were removed the same day. Full account: TISC Editor — history.

2026-09-07 — marcellus containment through the console​

After the Infomaniak abuse report cut the VPS off the network, the triage and the containment ran on the manager's noVNC console. Done: /tmp/python2.64, five _MEI* directories, installer.php, the 2021 Duplicator archive, dup-installer/ and the dup-*.txt state files moved to /root/quarantine-2026-09-07/; a2dissite ikarus-sozialearbeit-vs.ch; ProxyRequests on → Off in apt, lora, tisc.ch and tisc.dev; Apache reloaded. Verified afterwards: no www-data entry left in /tmp, twelve vhosts enabled, no process with a file open in /tmp, no socket in SYN-SENT.

2026-09-05 — frozen Aug-2024 Moodle removed from marcellus​

The pre-migration ISC Learn (last activity 2024-08-25) was deleted without an archive, after checking that its 43 courses all exist on hannibal under Archives with a current backup; the one exception, 23-24 / 105.1 - Summer school 1 (course 38), had been deleted on hannibal on purpose on 2024-08-15. Nothing referenced it any more: isc.hevs.ch resolves to hannibal, the vhost was disabled, the www-data crontab empty. Removed: /srv/data/moodle_isc (42 GB), /srv/backup/moodle_courses (33 GB, 220 .mbz), /srv/www/isc.hevs.ch (6.3 GB — Moodle code and its .backup copy, moodle_test, and the three WordPress trees of the pre-Moodle isc.hevs.ch site), /srv/data/moodle_test, and the disabled sites-available/isc.hevs.ch.conf. /srv went from 96 % to 9 %. The five matching MySQL databases and their users were left in place on request. The live sites (tisc, ikarus, inf1) were verified afterwards. The DS923 nightly rsync (--delete-before, no versions) drops its copy the following night. Log: marcellus:/root/frozen-moodle-removal-2026-09-05-1401.log.

2026-08-19 — ikarus.snowmon.ch added to the certificate​

The name was a ServerAlias on the :443 block without being on the lineage, so every visit by that name failed TLS verification. It resolves A and AAAA to marcellus, so it can answer an HTTP-01 challenge: re-issued with it as a 15th SAN (--dry-run first, all 15 authorized), valid to 2026-11-17. It now 301s to the canonical ikarus-sozialearbeit-vs.ch.

Two things this turned up. certonly does not reload Apache even with installer = apache, so the old certificate stayed in service until a manual reload — the caution is now on the current page. And the lineage still carries gptisc, influxdb2 and portainer, whose vhosts were disabled the day before: they authorize through the catch-all redirect today, but they are the next names to drop from it.

2026-08-18 — three dead marcellus vhosts disabled​

gptisc, influxdb2 and portainer were disabled with a2dissite, configs kept. Their backends were already gone. influxdb2 was checked before touching it: no legitimate client — telegraf outputs commented out, no Grafana datasource, no ChirpStack integration — so the residual traffic was scanner noise. The InfluxDB service (already stopped) and its data were left in place. The live sites were verified unaffected afterwards.

2026-08-10 — tMatch removed from marcellus​

tMatch and everything behind it were removed on request, deliberately without a backup: the four vhosts (tmatch.isc-vs.{ch,dev}, auth-tmatch.isc-vs.{ch,dev}), the tmatch compose project (tmatch_app, tmatch_db, and freeipa-server — part of the same project), its four named volumes, both images (1.35 GB + 876 MB) and /srv/tmatch + /home/tmatch_dev/tMatch. Root went from 89 % to 82 % full.

What survives: the source is on GitHub (ISC-HEI/tMatch), pushed up to date bar one uncommitted one-line change. What did not: the Postgres database, the specs data and the project .env.

The tmatch_ch and tmatch_dev accounts went too (2026-08-11) — both were in the docker group and held 8 SSH keys each, so their removal closed 16 root-equivalent entry points; the key owners are recorded in secretzone/marcellus.md. The six DNS records were deleted at Infomaniak the same day (tmatch CNAME plus auth-tmatch A/AAAA in each of isc-vs.ch and isc-vs.dev). marcellus.isc-vs.{ch,dev} were deliberately kept — they are the CNAME targets tisc and others still use.

This also closed the audit finding about FreeIPA publishing LDAP/LDAPS/HTTPS on 0.0.0.0 from a student's home directory — by removal, not by mitigation.

2026-08-10 — the marcellus certificate lineage re-issued​

Marcellus carries a single certbot lineage covering every vhost and was one renewal away from taking all its sites down — the standing rule and the certonly caution are on the current page. The lora.begincoding.net lineage went to 18 names, then to 14 the same evening once tMatch was deleted. apt.chezmoicamarche.ch was dropped from it — the name is NXDOMAIN, so it could never answer the challenge and the renewal due around 2026-09-04 would have failed everything. All 18 were checked in A and AAAA before re-issuing: marcellus has a working IPv6 address, and an AAAA pointing elsewhere fails an authorization just as surely as a missing A. Hannibal's lineage had the same problem, fixed the same day (ISC Learn log).