openvibers/openvibe.network Commits

openvibe.compare parks onto OpenVibe.Exchange; parked names lead only to ours (#774)

OP OpenVibers committed 4 days ago · ab8c128fb7 · 2 files, +15 −3

It was parked onto a name that is not ours. A test now reads every
redirect in the parked file and fails on a target outside the owned zones.

Changes

ddiff --git a/deploy/nginx/parked-domains.conf b/deploy/nginx/parked-domains.conf
iindex 2f666842..e8b28289 100644
---- a/deploy/nginx/parked-domains.conf
++++ b/deploy/nginx/parked-domains.conf
@@@ -294,12 +294,13 @@ server {
  # openvibe.studio: not parked since Studio v0's launch. OpenVibe.Studio serves it (its own vhost,
  # deploy/nginx/openvibe.studio.conf in OpenVibe.Studio, installed with ov-vhost-install).
  
--# openvibe.compare: parked, sent to OpenVibe AI, where the models live today (AI models first) until its own vhost takes the name (2026-11-10).
++# openvibe.compare: parked, sent to OpenVibe.Exchange, where the models and their prices live today (AI models first), until its own vhost
++# takes the name (2026-11-10). Never to openvibe.ai: that name is not ours.
  server {
      listen 80;
      listen [::]:80;
      server_name openvibe.compare www.openvibe.compare;
--    return 302 https://openvibe.ai/;
++    return 302 https://openvibe.exchange/;
  }
  
  server {
@@@ -310,7 +311,7 @@ server {
      ssl_certificate     /etc/letsencrypt/live/openvibe.compare/fullchain.pem;
      ssl_certificate_key /etc/letsencrypt/live/openvibe.compare/privkey.pem;
      access_log off;
--    return 302 https://openvibe.ai/;
++    return 302 https://openvibe.exchange/;
  }
  
  # openvibe.directory: parked, sent to the network's front door (no directory capability yet) until its own vhost takes the name (2026-11-10).
ddiff --git a/test/security-redirects.test.js b/test/security-redirects.test.js
iindex 9d81a155..dc882a54 100644
---- a/test/security-redirects.test.js
++++ b/test/security-redirects.test.js
@@@ -74,4 +74,15 @@ for (const check of [allowedOrigin, rpOrigin]) {
      assert.strictEqual(check('https://evilopenvibe.live', { NODE_ENV: 'production' }), null);
  }
  
++// A parked name sends its visitors only to a name that is ours (2026-11-10: openvibe.compare was parked onto
++// openvibe.ai, which belongs to someone else, for an hour).
++{
++    const conf = require('fs').readFileSync(require('path').join(__dirname, '..', 'deploy', 'nginx', 'parked-domains.conf'), 'utf8');
++    const targets = [...conf.matchAll(/^\s*return\s+30[1278]\s+(\S+?);/gm)].map((m) => m[1]);
++    assert.ok(targets.length >= 4, 'the parked file names its targets');
++    const ours = (host) => OWNED_ZONES.some((z) => host === z || host.endsWith('.' + z));
++    const foreign = targets.filter((t) => { const m = /^https:\/\/([a-z0-9.-]+|\$host|\$server_name)(?=[/$:]|$)/.exec(t); return !m || (!m[1].startsWith('$') && !ours(m[1])); });
++    assert.deepStrictEqual([...new Set(foreign)], [], 'every parked name redirects to an owned zone');
++}
++
  console.log('post-sign-in redirects and owned-zone trust: all checks passed');