We use secure.phabricator.com for both HTTP/HTTPS and SSH traffic and ELB can't currently forward port 22 -- except the docs now say EC2-VPC LBs can? So I need to figure out what's going on with that.

If ELBs still can't forward port 22, we need secure.phabricator.com to resolve to something we can put 22 on, so I'll probably put phurl.io on a separate ELB and then fiddle with the server config, but this won't impact where the certificate is so it doesn't block/impact this.

If ELBs can forward port 22, I may try to move the certificate to an ELB, which would make phurl.io straightforward.

I renewed the certificate and launched a new VPC load balancer, which can forward port 22 traffic:

$ ssh slb001-1579991418.us-west-1.elb.amazonaws.com
Warning: Permanently added the RSA host key for IP address '52.9.155.118' to the list of known hosts.
PTY allocation request failed on channel 0
phabricator-ssh-exec: Welcome to Phabricator.

You are logged in as epriestley.

You haven't specified a command to run. This means you're requesting an interactive shell, but Phabricator does not provide an interactive shell over SSH.

Usually, you should run a command like `git clone` or `hg push` rather than connecting directly with SSH.

Supported commands are: conduit, git-lfs-authenticate, git-receive-pack, git-upload-pack, hg, svnserve.
Connection to slb001-1579991418.us-west-1.elb.amazonaws.com closed.

This might let us simplify other parts of the cluster eventually, but I'll see if I can move everything up to the LB and stop terminating HTTPS on-host for now.

This is a little bit tricky because notifications use the same hostname, we don't have a wildcard certificate, and we can't (apparently) terminate SSL on the load balancer and pass it through with websockets.

There's an article here which suggests it's possible to use some magic and kind of get things working, but that seems very complicated:

https://blog.jverkamp.com/2015/07/20/configuring-websockets-behind-an-aws-elb/

But I can pass notification traffic through untouched and let the machine continue terminating it for now.

I'm going to deploy this host with rSERVICES + cluster awareness so it can accept SSL-terminated traffic. If I got something wrong, we may be down for a few minutes.

This appears to have deployed cleanly. I'm going to test notifications and SSH, and then I'll rebind DNS if they look good.

Seems OK. Swapping DNS shortly.

Something on the CDN side has grown deeply unhappy, looking into it.

CDN stuff is maybe-sorted.

(•ω•)

c( ⁰ 〰 ⁰ )੭