/etc/nginx/conf.d/host-503b27.ai.conf

Live

74d248d381bf

Approved

74d248d381bf matches liveapproved 24 Oct 2026 19:57 UTC by operator

Recommended (template)

/etc/nginx/conf.d/*.conf · fileon drift rollback; no copy investigate_ticket; hold up to 24 h; alert on_fix, P1

Lock

locked by rule rule-e186e9d5790a7e6b critical

Verdict

adopted proxied name, origin trusts no Cloudflare rangeaccepted exception mem-9 holds until 30 Nov 2026 00:00 UTC (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEadopted proxied name, origin trusts no Cloudflare rangeaccepted exception mem-9 holds until 30 Nov 2026 00:00 UTC (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEadopted proxied name, origin trusts no Cloudflare rangeaccepted exception mem-12 holds until 30 Nov 2026 00:00 UTC (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEadopted proxied name, origin trusts no Cloudflare rangeaccepted exception mem-12 holds until 30 Nov 2026 00:00 UTC (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATE

Last change

no record

Changed by

no record

Live against approved

Live matches the approved value 74d248d381bf, approved 24 Oct 2026 19:57 UTC by operator.

Restore proof

The copy at the vault's head:

• vault commit 321fcfe4 taken 25 Oct 2026 13:53 UTC · nginx-t ok_with_gaps, 16 gaps, validated 25 Oct 2026 13:54 UTC
  the 16 gaps its validation names

  /etc/letsencrypt/live/host-18efce.ai/fullchain.pem, /etc/letsencrypt/live/host-18efce.ai/privkey.pem, /etc/letsencrypt/live/host-492568.ai/fullchain.pem, /etc/letsencrypt/live/host-492568.ai/privkey.pem, /etc/letsencrypt/live/host-503b27.ai/fullchain.pem, /etc/letsencrypt/live/host-503b27.ai/privkey.pem, /etc/letsencrypt/live/host-a00d2f.ai/fullchain.pem, /etc/letsencrypt/live/host-a00d2f.ai/privkey.pem, /etc/letsencrypt/live/host-c907ae.ai/fullchain.pem, /etc/letsencrypt/live/host-c907ae.ai/privkey.pem, /etc/letsencrypt/live/host-c9c1ae.club/fullchain.pem, /etc/letsencrypt/live/host-c9c1ae.club/privkey.pem, /etc/letsencrypt/options-ssl-nginx.conf, /etc/letsencrypt/ssl-dhparams.pem, /etc/ssl/word-8173ec/origin.crt, /etc/ssl/word-8173ec/origin.key

What a restore would regress

A restore of host-aa516a from its newest backup keeps this file's approved value. For the host: Restoring host-aa516a from its latest backup would regress no approved setting.

References

• server[host-503b27.ai:443].ssl_certificate names cert /etc/letsencrypt/live/host-503b27.ai/fullchain.pem
• server[host-503b27.ai:80].server_name[host-27618a.ai] names dns_name host-27618a.airesolves in the latest DNS run to A ip-6b6bba proxied
• server[host-503b27.ai:443].server_name[host-503b27.ai] names dns_name host-503b27.airesolves in the latest DNS run to TXT "v=spf1 include:host-46af70.com -all", TXT "MS=ms25926860", TXT "google-site-verification=<secret:value:45089257>", MX host-fd3013.com, TXT "MS=ms29230297", A ip-6b6bba proxied
• server[host-503b27.ai:80].server_name[host-503b27.ai] names dns_name host-503b27.airesolves in the latest DNS run to TXT "v=spf1 include:host-46af70.com -all", TXT "MS=ms25926860", TXT "google-site-verification=<secret:value:45089257>", MX host-fd3013.com, TXT "MS=ms29230297", A ip-6b6bba proxied
• server[host-27618a.ai:443].ssl_certificate names cert /etc/letsencrypt/live/host-503b27.ai/fullchain.pem
• server[host-27618a.ai:443].server_name[host-27618a.ai] names dns_name host-27618a.airesolves in the latest DNS run to A ip-6b6bba proxied

Decisions

• ADOPTproxied name, origin trusts no Cloudflare range · server[host-27618a.ai:443].real_ipaccepted exception mem-9 holds until 30 Nov 2026 00:00 UTC (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEuntil 30 Nov 2026 00:00 UTC · decided 25 Oct 2026 14:17 UTC by operator · fnd-a08488f45ff63140
• ADOPTproxied name, origin trusts no Cloudflare range · server[host-503b27.ai:80].real_ipaccepted exception mem-9 holds until 30 Nov 2026 00:00 UTC (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEuntil 30 Nov 2026 00:00 UTC · decided 25 Oct 2026 14:17 UTC by operator · fnd-5bd1b4c03ee72c7a
• ADOPTproxied name, origin trusts no Cloudflare range · server[host-503b27.ai:443].real_ipaccepted exception mem-12 holds until 30 Nov 2026 00:00 UTC (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEuntil 30 Nov 2026 00:00 UTC · decided 25 Oct 2026 14:17 UTC by operator · fnd-dfe22fa267b51c91
• ADOPTproxied name, origin trusts no Cloudflare range · server[host-503b27.ai:80].real_ipaccepted exception mem-12 holds until 30 Nov 2026 00:00 UTC (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEuntil 30 Nov 2026 00:00 UTC · decided 25 Oct 2026 14:17 UTC by operator · fnd-8a843610aeb1b709

Action history

The agent took no action on this object.

Change window

No change window is open on this object: a drift is rolled back at the next cycle under the rule.