The cutover in 0.9 seconds

Starting point

odabas.ch still ran as WordPress behind its own nginx container, which terminates TLS itself while Traefik only passes traffic through unencrypted. The new static Astro site was ready, and a pipeline was already building an image from it, with the deploy step switched off.

Decision

Instead of a new container, I reused the existing nginx container. Its name, ports, Traefik labels and certificate mounts stay the same; only the image and one location block change, which leaves the proven certificate renewal untouched.

Implementation

Because the old test route no longer existed, I created a temporary Traefik entrypoint for the pre-test and removed it afterwards. To switch over, I changed location / in the nginx config from proxy_pass to root /usr/share/nginx/html with try_files, and in the Compose file I changed the image: line from nginx:latest to the self-built image; the restart took 0.9 seconds. I stopped the WordPress container instead of deleting it and backed up the old configuration first. Then I armed the deploy step of the pipeline: the first run, started by hand with “Run workflow”, took 49 seconds and delivered the site without touching the server.

Takeaway

A cutover stays small when everything around it stays the same: one line and one block changed, while ports, certificates and routing did not. And because WordPress and the old configuration were kept, the way back stayed open at all times.