Domain migration: synvirt.mx → synvirt.io (2026-10-15)

Synced read-only from /home/synvirt/synvirt-platform/docs-internal/runbooks/domain-migration-2026-10-15.md. Edit at the source, not here.

Domain migration: synvirt.mx → synvirt.io (2026-10-15)

Owner instruction (2026-10-15): the server moves from synvirt.mx to synvirt.io; the owner handles the .mx → .io redirect in Cloudflare. This runbook records what was changed, what still needs the owner, and how to roll back.

Done in the working tree (no commit — commits are not authorised)

Area	Change
infra/caddy/Caddyfile.dev (the mounted one)	All vhosts renamed to .io; new legacy_mx snippet: every .mx name keeps its Let’s Encrypt cert and answers 301 https://<same host>.synvirt.io{uri}. Validated with caddy validate.
infra/caddy/Caddyfile.prod, Dockerfile	Names/comments to .io.
infra/compose/compose.yaml	WP_HOME, WP_SITEURL, SYNVIRT_CDN_URL → .io. Takes effect on container recreate.
.env, infra/secrets/dev.env, .env.example	CDN_URL, WP_SITE_URL → .io. WP_ADMIN_EMAIL stays [email protected] (mail is still on the .mx Microsoft 365 tenant). dev.enc.env not re-encrypted.
apps/web/src	Docs/CDN/canonical URLs → .io; pnpm build run.
apps/wordpress/scripts, mu-plugins, themes/synvirt, tests	Menu URLs, CDN comments, download manifests (SYNVirtOS-Lastest.json, SYNVirt-Media-Creator.json) → https://synvirt.io/downloads/….
synnet-devhub	astro.config.mjs site, module labels, content → .io; rebuilt into dist/ (bind-mounted at /dev).
README.md, CLAUDE.md, AGENTS.md, Taskfile.yml, infra/scripts/devbox-bootstrap.sh, infra/systemd/synvirt-web.service	Text → .io.
Workspace /home/synvirt/AGENTS.md	Publication note updated.

Deliberately not changed:

• [email protected], [email protected] — mailbox domain, see below.
• dev.synvirt.mx (10.10.26.1, product host) — LAN-only name, not in Cloudflare.
• update./updates./licensing./aurora.synvirt.mx in theme copy, apps/wizard-demo/upstream and release notes — baked into the hypervisor; changes there belong to a product release.
• status.synvirt.mx — hosted outside this infra.
• Dated specs/runbooks under docs-internal/, release-backups/, release-staging/ — history.
• Keycloak realm redirect URIs — still .test only, nothing referenced .mx.

Needs the owner (auto-mode blocked these as live changes)

Run as root: bash infra/scripts/cutover-synvirt-io.sh. It does, in order:

1. Cloudflare DNS for synvirt.io: apex, www, update, updates, licensing → 201.165.127.18 proxied; api, auth, cdn, docs, portal → 10.10.26.4 DNS-only (same shape as .mx).
2. /etc/hosts aliases for the .io names.
3. wp search-replace (dry-run on 2026-10-15: 23 CDN + 339 apex replacements across svt_posts, svt_postmeta, svt_options, svt_users, WooCommerce download directories).
4. docker compose up -d --force-recreate caddy wordpress, systemctl restart synvirt-web.
5. curl checks for every .io host and the .mx 301s.

Then, outside this box:

• Cloudflare redirect rule *.synvirt.mx → synvirt.io (owner).
• Microsoft 365: add synvirt.io domain, MX/SPF/autodiscover records, then switch hello@ everywhere (WP_ADMIN_EMAIL, menu mailto: links, seed-menus.php, apps/web).
• LAN split-horizon DNS: add synvirt.io → 10.10.26.4 wherever synvirt.mx is overridden today, or LAN clients will hairpin through Cloudflare.
• Product repo on 10.10.26.1: updates./licensing./aurora.synvirt.mx endpoints in a future release.
• task secrets:encrypt to refresh infra/secrets/dev.enc.env; commit when authorised.

Rollback

/var/backups/synvirt/domain-migration-20261015/ has the previous Caddyfile.dev, compose.yaml, .env, dev.env, /etc/hosts; the DB dump taken just before is /var/backups/synvirt/wpdb_2026-10-15_170151.sql.zst (bash infra/scripts/backup-wordpress.sh --restore 2026-10-15_170151). Restore the files, task wp:reload, recreate wordpress.