From c0b69af064eba4f7376ada84f53a603ca080e991 Mon Sep 17 00:00:00 2001 From: Riddhesh Sanghvi Date: Mon, 26 Oct 2026 09:22:08 +0530 Subject: [PATCH 1/2] fix(migration): keep a site whose Let's Encrypt certificate is pending on HTTP The image migration regenerated each site's docker-compose.yml with HTTPS on whenever site_ssl was set. A site waiting for `ee site ssl-verify` after a manual DNS-01 challenge has site_ssl=le but no certificate yet, so nginx-proxy then served it over HTTPS with the closest matching certificate of another site. Use site-command's is_le_ssl_pending() when it exists, the same check refresh and `update --php` use. Older site-command versions don't have it and keep the previous behaviour. --- php/EE/Migration/SiteContainers.php | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/php/EE/Migration/SiteContainers.php b/php/EE/Migration/SiteContainers.php index e3a9d3bea..85872d72b 100644 --- a/php/EE/Migration/SiteContainers.php +++ b/php/EE/Migration/SiteContainers.php @@ -102,10 +102,29 @@ public static function is_site_service_image_changed( $updated_images, $site_inf public static function generate_site_docker_compose_file( $site_info, $site_object ) { $site_object->populate_site_info( $site_info['site_url'] ); EE::debug( "Start generating new docker-compose.yml for ${site_info['site_url']}" ); - $site_object->dump_docker_compose_yml( [ 'nohttps' => ! $site_info['site_ssl'] ] ); + $site_object->dump_docker_compose_yml( [ 'nohttps' => self::is_served_without_https( $site_info ) ] ); EE::debug( "Complete generating new docker-compose.yml for ${site_info['site_url']}" ); } + /** + * Whether a site is served over plain HTTP: without SSL, or while its Let's Encrypt certificate waits for `ee site ssl-verify`. + * + * With HTTPS on, nginx-proxy would serve a pending site with the closest matching certificate of another site. + * + * @param array $site_info array of site information. + * + * @return bool + */ + public static function is_served_without_https( $site_info ) { + if ( empty( $site_info['site_ssl'] ) ) { + return true; + } + + // site-command versions without the pending state don't have the helper and keep HTTPS on. + return function_exists( 'EE\Site\Utils\is_le_ssl_pending' ) + && \EE\Site\Utils\is_le_ssl_pending( $site_info['site_url'], $site_info['site_ssl'] ); + } + /** * Enable site. * From 2f4523f35bcbaca328be58feb45382cf4bea421b Mon Sep 17 00:00:00 2001 From: Riddhesh Sanghvi Date: Mon, 26 Oct 2026 09:32:48 +0530 Subject: [PATCH 2/2] docs(migration): say that is_served_without_https() decides the compose file's HTTPS state --- php/EE/Migration/SiteContainers.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/php/EE/Migration/SiteContainers.php b/php/EE/Migration/SiteContainers.php index 85872d72b..3232d69d4 100644 --- a/php/EE/Migration/SiteContainers.php +++ b/php/EE/Migration/SiteContainers.php @@ -107,7 +107,7 @@ public static function generate_site_docker_compose_file( $site_info, $site_obje } /** - * Whether a site is served over plain HTTP: without SSL, or while its Let's Encrypt certificate waits for `ee site ssl-verify`. + * Whether the site's docker-compose.yml turns HTTPS off: without SSL, or while its Let's Encrypt certificate waits for `ee site ssl-verify`. * * With HTTPS on, nginx-proxy would serve a pending site with the closest matching certificate of another site. *