file on host-4b4dc1 · linux.nginx

/etc/nginx/sites-available/host-525a57.com

adopted locked by rule

Live: 77c0bfaa68ff
Approved: 77c0bfaa68ff matches liveapproved 24 Oct 2026 19:57 UTC by operator
Recommended (template): /etc/nginx/sites-available/* · fileon drift rollback; no copy investigate_ticket; hold up to 24 h; alert on_fix, P1
Lock: locked by rule rule-6c41a25a00c404c8 critical
Verdict: adopted proxied name, origin trusts no Cloudflare rangeaccepted exception mem-17 holds until 30 Nov 2026 00:00 UTC (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEadopted proxied name, origin trusts no Cloudflare rangeaccepted exception mem-17 holds until 30 Nov 2026 00:00 UTC (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEadopted proxied name, origin trusts no Cloudflare rangeaccepted exception mem-11 holds until 30 Nov 2026 00:00 UTC (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEadopted proxied name, origin trusts no Cloudflare rangeaccepted exception mem-10 holds until 30 Nov 2026 00:00 UTC (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATE
Last change: no record
Changed by: no record

Live against approved

Live matches the approved value 77c0bfaa68ff, approved 24 Oct 2026 19:57 UTC by operator.

Restore proof

The copy at the vault's head:

vault commit 6e1d81ce taken 25 Oct 2026 13:53 UTC · nginx-t ok_with_gaps, 13 gaps, validated 25 Oct 2026 13:54 UTC
the 13 gaps its validation names
/etc/letsencrypt/live/host-17a03d.info/fullchain.pem, /etc/letsencrypt/live/host-17a03d.info/privkey.pem, /etc/letsencrypt/live/host-4c795e.quest/fullchain.pem, /etc/letsencrypt/live/host-4c795e.quest/privkey.pem, /etc/letsencrypt/live/host-525a57.com/fullchain.pem, /etc/letsencrypt/live/host-525a57.com/privkey.pem, /etc/letsencrypt/live/host-9ac4f1.com/fullchain.pem, /etc/letsencrypt/live/host-9ac4f1.com/privkey.pem, /etc/letsencrypt/live/host-f324df.com/fullchain.pem, /etc/letsencrypt/live/host-f324df.com/privkey.pem, /etc/letsencrypt/options-ssl-nginx.conf, /etc/letsencrypt/ssl-dhparams.pem, /etc/nginx/snippets/word-9af24b-api-key.conf

What a restore would regress

A restore of host-4b4dc1 from its newest backup keeps this file's approved value. For the host: Restoring host-4b4dc1 from its latest backup would regress no approved setting.

References

server[host-525a57.com:443].ssl_certificate names cert /etc/letsencrypt/live/host-525a57.com/fullchain.pem
server[host-525a57.com:80].server_name[host-22b64a.com] names dns_name host-22b64a.comresolves in the latest DNS run to A ip-6fb86d proxied
server[host-525a57.com:80].server_name[host-525a57.com] names dns_name host-525a57.comresolves in the latest DNS run to TXT "v=spf1 ip4:ip-71940c +a +mx +ip4:ip-52ca68 ~all", NS host-628385.com, NS host-f1df9f.com, MX ms29230297.msv1.invalid, TXT "google-site-verification=<secret:value:2a0f5650>", A ip-6fb86d proxied
server[host-525a57.com:443].location[^~ /cv/apply/].proxy_pass names ip ip-d572d2
server[host-5c38db.com:80].server_name[host-5c38db.com] names dns_name host-5c38db.comresolves in the latest DNS run to CNAME host-525a57.com proxied
server[host-5c38db.com:80].ssl_certificate names cert /etc/letsencrypt/live/host-525a57.com/fullchain.pem
server[host-525a57.com:443].server_name[host-525a57.com] names dns_name host-525a57.comresolves in the latest DNS run to TXT "v=spf1 ip4:ip-71940c +a +mx +ip4:ip-52ca68 ~all", NS host-628385.com, NS host-f1df9f.com, MX ms29230297.msv1.invalid, TXT "google-site-verification=<secret:value:2a0f5650>", A ip-6fb86d proxied
server[host-22b64a.com:443].server_name[host-22b64a.com] names dns_name host-22b64a.comresolves in the latest DNS run to A ip-6fb86d proxied
server[host-22b64a.com:443].ssl_certificate names cert /etc/letsencrypt/live/host-525a57.com/fullchain.pem
server[host-525a57.com:443].location[= /cv/apply/build].proxy_pass names ip ip-d572d2

Decisions

ADOPTproxied name, origin trusts no Cloudflare range · server[host-22b64a.com:443].real_ipaccepted exception mem-17 holds until 30 Nov 2026 00:00 UTC (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEuntil 30 Nov 2026 00:00 UTC · decided 25 Oct 2026 14:17 UTC by operator · fnd-d5622dbd2bf43e3e
ADOPTproxied name, origin trusts no Cloudflare range · server[host-525a57.com:80].real_ipaccepted exception mem-17 holds until 30 Nov 2026 00:00 UTC (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEuntil 30 Nov 2026 00:00 UTC · decided 25 Oct 2026 14:17 UTC by operator · fnd-b0472de6319451c4
ADOPTproxied name, origin trusts no Cloudflare range · server[host-525a57.com:80].real_ipaccepted exception mem-11 holds until 30 Nov 2026 00:00 UTC (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEuntil 30 Nov 2026 00:00 UTC · decided 25 Oct 2026 14:17 UTC by operator · fnd-770d13f327d54d12
ADOPTproxied name, origin trusts no Cloudflare range · server[host-5c38db.com:80].real_ipaccepted exception mem-10 holds until 30 Nov 2026 00:00 UTC (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEuntil 30 Nov 2026 00:00 UTC · decided 25 Oct 2026 14:17 UTC by operator · fnd-7548fb2a2e3cdca4

Action history

The agent took no action on this object.

Change window

No change window is open on this object: a drift is rolled back at the next cycle under the rule.