# URL Migration Mapping - Single Source of Truth
# This document defines all URLs across migration phases for the SyRF platform
# Last updated: 2025-11-16

# DNS Zones
dns_zones:
  production_public:
    name: syrf-org-uk-zone
    domain: syrf.org.uk
    description: Public-facing production domain

  infrastructure_internal:
    name: camarades-net-zone
    domain: camarades.net
    description: Infrastructure and non-production domain

# SyRF Application Services
services:
  web:
    description: Main SyRF web application (Angular frontend)
    legacy_production:
      url: syrf.org.uk
      cluster: jenkins-x
      namespace: jx-production
      ip: 35.246.22.231
    temporary_testing:
      url: syrf.prod.camarades.net
      cluster: argocd
      namespace: syrf-production
      ip: 34.13.63.21
      purpose: Testing production namespace before cutover
    staging:
      url: syrf.staging.camarades.net
      cluster: argocd
      namespace: syrf-staging
      ip: 34.13.63.21
      status: active
    final_production:
      url: syrf.org.uk
      cluster: argocd
      namespace: syrf-production
      ip: 34.13.63.21
      dns_zone: syrf-org-uk-zone
      tls_issuer: letsencrypt-prod
    notes:
      - Requires redirect from app.syrf.org.uk
      - Auth0 callback URL update required for testing phase

  web_redirect:
    description: Redirect from app.syrf.org.uk to syrf.org.uk
    legacy_production:
      url: app.syrf.org.uk
      redirects_to: syrf.org.uk
      cluster: jenkins-x
      namespace: jx-production
    temporary_testing:
      url: app.prod.camarades.net
      redirects_to: syrf.prod.camarades.net
      cluster: argocd
      namespace: syrf-production
      purpose: Test redirect behavior before cutover
    final_production:
      url: app.syrf.org.uk
      redirects_to: syrf.org.uk
      cluster: argocd
      namespace: syrf-production
      dns_zone: syrf-org-uk-zone
      tls_issuer: letsencrypt-prod
    notes:
      - Maintain redirect for backwards compatibility
      - Bookmarks and external links may use app.syrf.org.uk

  api:
    description: SyRF REST API backend (.NET)
    legacy_production:
      url: syrf-api.syrf.org.uk
      cluster: jenkins-x
      namespace: jx-production
      ip: 35.246.22.231
    temporary_testing:
      url: api.prod.camarades.net
      cluster: argocd
      namespace: syrf-production
      ip: 34.13.63.21
      purpose: Testing with new URL before Auth0 update
    staging:
      url: api.staging.camarades.net
      cluster: argocd
      namespace: syrf-staging
      ip: 34.13.63.21
      status: active
    final_production:
      url: api.syrf.org.uk
      cluster: argocd
      namespace: syrf-production
      ip: 34.13.63.21
      dns_zone: syrf-org-uk-zone
      tls_issuer: letsencrypt-prod
    url_change:
      from: syrf-api.syrf.org.uk
      to: api.syrf.org.uk
      breaking_change: true
      requires_auth0_update: true
    auth0_dependencies:
      api_audience:
        current: https://syrf-api.syrf.org.uk
        new: https://api.syrf.org.uk
        update_required: true
      callback_urls:
        - Update all redirect URIs
        - Update allowed origins
        - Update logout URLs
      services_affected:
        - web (Angular app)
        - api (validates tokens)
    notes:
      - BREAKING CHANGE - URL migration required
      - Test thoroughly on api.prod.camarades.net before cutover
      - Update Auth0 configuration BEFORE DNS cutover

  project_management:
    description: Project management microservice (.NET)
    legacy_production:
      url: syrf-projectmanagement.syrf.org.uk
      cluster: jenkins-x
      namespace: jx-production
      ip: 35.246.22.231
    temporary_testing:
      url: pm.prod.camarades.net
      cluster: argocd
      namespace: syrf-production
      ip: 34.13.63.21
      purpose: Testing before cutover
    staging:
      url: pm.staging.camarades.net
      cluster: argocd
      namespace: syrf-staging
      ip: 34.13.63.21
      status: not_configured
      note: No ingress configured yet
    final_production:
      url: pm.syrf.org.uk
      cluster: argocd
      namespace: syrf-production
      ip: 34.13.63.21
      dns_zone: syrf-org-uk-zone
      tls_issuer: letsencrypt-prod
    url_change:
      from: syrf-projectmanagement.syrf.org.uk
      to: pm.syrf.org.uk
      breaking_change: true
    notes:
      - URL shortened from syrf-projectmanagement to pm
      - Check for hardcoded URLs in frontend

  quartz:
    description: Background job scheduler (.NET)
    legacy_production:
      url: syrf-quartz.syrf.org.uk
      cluster: jenkins-x
      namespace: jx-production
      ip: 35.246.22.231
    temporary_testing:
      url: quartz.prod.camarades.net
      cluster: argocd
      namespace: syrf-production
      ip: 34.13.63.21
      purpose: Testing before cutover
    staging:
      url: quartz.staging.camarades.net
      cluster: argocd
      namespace: syrf-staging
      ip: 34.13.63.21
      status: not_configured
      note: No ingress configured yet
    final_production:
      url: quartz.syrf.org.uk
      cluster: argocd
      namespace: syrf-production
      ip: 34.13.63.21
      dns_zone: syrf-org-uk-zone
      tls_issuer: letsencrypt-prod
    url_change:
      from: syrf-quartz.syrf.org.uk
      to: quartz.syrf.org.uk
      breaking_change: false
      note: URL pattern consistent, just different prefix

  user_guide:
    description: Public user documentation (Jekyll)
    legacy_production:
      url: help.syrf.org.uk
      cluster: jenkins-x
      namespace: jx-production
      ip: 35.246.22.231
      note: Referenced in config but may not be deployed
    temporary_testing:
      url: help.prod.camarades.net
      cluster: argocd
      namespace: syrf-production
      ip: 34.13.63.21
      purpose: Testing before cutover
    staging:
      url: help.staging.camarades.net
      cluster: argocd
      namespace: syrf-staging
      ip: 34.13.63.21
      status: not_configured
      note: Service exists but no ingress yet
    final_production:
      url: help.syrf.org.uk
      cluster: argocd
      namespace: syrf-production
      ip: 34.13.63.21
      dns_zone: syrf-org-uk-zone
      tls_issuer: letsencrypt-prod
    notes:
      - Public-facing documentation
      - No Auth0 dependencies
      - Production config file missing (needs creation)

  docs:
    description: Internal team documentation with OAuth2 Proxy (MkDocs)
    legacy_production:
      url: null
      note: New service, not in legacy cluster
    temporary_testing:
      url: docs.prod.camarades.net
      cluster: argocd
      namespace: syrf-production
      ip: 34.13.63.21
      purpose: Testing OAuth2 Proxy integration
    staging:
      url: docs.staging.camarades.net
      cluster: argocd
      namespace: syrf-staging
      ip: 34.13.63.21
      status: not_configured
      note: No staging deployment planned (production only)
    final_production:
      url: docs.syrf.org.uk
      cluster: argocd
      namespace: syrf-production
      ip: 34.13.63.21
      dns_zone: syrf-org-uk-zone
      tls_issuer: letsencrypt-prod
    oauth2_proxy:
      enabled: true
      provider: github
      github_org: camaradesuk
      client_id: stored_in_secret
      cookie_secret: stored_in_secret
    notes:
      - NEW service - internal team documentation
      - Requires GitHub OAuth2 authentication
      - Only camaradesuk org members can access

# Infrastructure Services
infrastructure:
  argocd:
    description: ArgoCD GitOps UI
    legacy_production:
      url: null
      note: Not in legacy cluster (Jenkins X used)
    current:
      url: argocd.camarades.net
      cluster: argocd
      namespace: argocd
      ip: 34.13.63.21
      status: configured_but_dns_broken
      issue: DNS conflict - records being deleted by legacy external-dns
    final_production:
      url: argocd.camarades.net
      cluster: argocd
      namespace: argocd
      ip: 34.13.63.21
      dns_zone: camarades-net-zone
      tls_issuer: letsencrypt-prod
    notes:
      - Internal infrastructure only
      - Blocked by txt-owner-id conflict (CRITICAL)

  rabbitmq:
    description: RabbitMQ management UI
    legacy_production:
      url: rabbitmq-stats.camarades.net
      cluster: jenkins-x
      namespace: jx-production
      ip: 35.246.22.231
    temporary_testing:
      url: rabbitmq.prod.camarades.net
      cluster: argocd
      namespace: rabbitmq
      ip: 34.13.63.21
      purpose: Testing new RabbitMQ instance
    final_production:
      url: rabbitmq.camarades.net
      cluster: argocd
      namespace: rabbitmq
      ip: 34.13.63.21
      dns_zone: camarades-net-zone
      tls_issuer: letsencrypt-prod
    url_change:
      from: rabbitmq-stats.camarades.net
      to: rabbitmq.camarades.net
      breaking_change: false
      note: Cleaner URL, only affects admin access
    notes:
      - Internal infrastructure only
      - Both clusters running RabbitMQ during migration
      - Services use different RabbitMQ instances per cluster

  legacy_infrastructure:
    description: Jenkins X infrastructure URLs (to be decommissioned)
    urls:
      - dashboard-jx.camarades.net
      - lighthouse-jx.camarades.net
      - hook-jx.camarades.net
      - chartmuseum-jx.camarades.net
      - nexus-jx.camarades.net
    note: These will be decommissioned when old cluster is retired
    status: keep_until_cutover_complete

# Migration Phases
migration_phases:
  phase_1:
    name: Fix DNS Conflict
    description: Update txt-owner-id on both clusters
    duration: 2-3 hours
    urls_affected: argocd.camarades.net
    actions:
      - Update new cluster external-dns to txt-owner-id=camaradesuk-new
      - Update old cluster external-dns to txt-owner-id=camarades-legacy
      - Verify DNS records persist for 24 hours
    blocking: true
    note: MUST complete before any other migration work

  phase_2:
    name: Deploy Production Namespace with Testing URLs
    description: Deploy all services to production namespace using .prod.camarades.net URLs
    duration: 1-2 days
    urls_created:
      - syrf.prod.camarades.net
      - app.prod.camarades.net (redirect)
      - api.prod.camarades.net
      - pm.prod.camarades.net
      - quartz.prod.camarades.net
      - help.prod.camarades.net
      - docs.prod.camarades.net
      - rabbitmq.prod.camarades.net
    actions:
      - Create missing production config files
      - Configure ingresses with .prod.camarades.net URLs
      - Deploy all services to syrf-production namespace
      - Create DNS records in camarades-net-zone

  phase_3:
    name: Test Production Services
    description: End-to-end testing on temporary URLs
    duration: 3-5 days
    test_scenarios:
      - User authentication and registration
      - Project creation and management
      - Study screening workflows
      - Data annotation
      - Data export
      - Background job processing
      - RabbitMQ message flow
      - OAuth2 Proxy access control (docs)
    rollback: Easy - just keep using legacy cluster

  phase_4:
    name: Update Auth0 Configuration
    description: Migrate Auth0 to new API URL
    duration: 1-2 hours
    breaking_change: true
    actions:
      - Update API audience from syrf-api.syrf.org.uk to api.syrf.org.uk
      - Update all callback URLs
      - Update allowed origins
      - Update logout URLs
      - Test authentication on api.prod.camarades.net
    rollback: Revert Auth0 config changes

  phase_5:
    name: DNS Cutover
    description: Switch production DNS to new cluster
    duration: 2-4 hours (nighttime recommended)
    downtime: 5-15 minutes during DNS propagation
    dns_changes:
      syrf.org.uk:
        from_ip: 35.246.22.231
        to_ip: 34.13.63.21
        from_cluster: jenkins-x
        to_cluster: argocd
      app.syrf.org.uk:
        from_ip: 35.246.22.231
        to_ip: 34.13.63.21
      api.syrf.org.uk:
        action: create_new
        to_ip: 34.13.63.21
        note: New URL, legacy syrf-api.syrf.org.uk deleted
      pm.syrf.org.uk:
        action: create_new
        to_ip: 34.13.63.21
        note: New URL, legacy syrf-projectmanagement.syrf.org.uk deleted
      quartz.syrf.org.uk:
        from_ip: 35.246.22.231
        to_ip: 34.13.63.21
      help.syrf.org.uk:
        from_ip: 35.246.22.231
        to_ip: 34.13.63.21
      docs.syrf.org.uk:
        action: create_new
        to_ip: 34.13.63.21
        note: New service
      rabbitmq.camarades.net:
        action: create_new
        to_ip: 34.13.63.21
        note: Replaces rabbitmq-stats.camarades.net
    actions:
      - Update ingresses from .prod.camarades.net to .syrf.org.uk
      - Transfer TXT ownership from old to new external-dns
      - Update DNS A records
      - Monitor for 1-2 hours
    rollback: Revert DNS records to old cluster IPs

  phase_6:
    name: Decommission Legacy Cluster
    description: Scale down and delete old cluster after stability period
    duration: 1 week monitoring + 1 day teardown
    stability_period: 1 week with new cluster in production
    actions:
      - Monitor new cluster for 1 week
      - Scale down all Jenkins X workloads
      - Export any remaining data
      - DO NOT delete PVs with package data
      - Delete GKE cluster
      - Remove old DNS records
    cost_savings: ~$260/month (50% reduction)

# External Dependencies
external_dependencies:
  auth0:
    tenant: syrf
    domain: signin.syrf.org.uk
    region: eu
    update_required: true
    update_phase: phase_4
    critical_fields:
      - API audience
      - Callback URLs
      - Allowed origins
      - Logout URLs

  github_oauth:
    app_name: SyRF Team Docs OAuth
    redirect_uri: https://docs.syrf.org.uk/oauth2/callback
    organization: camaradesuk

  mongodb:
    connection_string: Stored in GCP Secret Manager
    note: Connection strings reference cluster-specific secrets

  storage:
    s3_buckets: No changes required
    lambda_function: syrfAppUploadS3Notifier (already updated)

# Risk Assessment
risks:
  high:
    - Auth0 URL change breaking authentication
    - DNS propagation delays causing service disruption
    - Database connection issues during cutover
  medium:
    - TLS certificate provisioning delays
    - External-DNS ownership conflicts
    - RabbitMQ message queue migration
  low:
    - Static asset caching issues
    - User bookmark updates needed
    - Documentation link updates

# Rollback Strategy
rollback:
  phase_1_to_4:
    complexity: low
    action: Continue using legacy cluster, no production impact

  phase_5_dns_cutover:
    complexity: medium
    action: Revert DNS A records to legacy cluster IPs
    time_to_rollback: 5-15 minutes (DNS TTL)

  phase_6_decommission:
    complexity: impossible
    note: Cannot rollback after cluster deletion - do not delete until confident
