798c382a4e6e6f2e9ecaf6c47300f8cc2a6e0074
braney
  Mon Aug 24 08:54:58 2026 -0700
ts: add a conf subcommand to rewrite httpd.conf without re-freezing, refs #37867

The CORS scoping fix in 4d9755a1 changed the httpd.conf template, but a
parked instance keeps the conf it was created with.  All three parked
instances therefore still set Access-Control-Allow-Origin at server
scope, including on cgi-bin.  That is the hole 4d9755a1 closed in the
template only.

The one way to pick up a template change was "ts sync", and cmd_sync
calls freeze before writeConf.  For a park whose whole point is the
frozen code, re-freezing to the current live sandbox throws away the
thing being kept.  There was no way to update only the config.

"ts conf NNNNN" rewrites httpd.conf from the current template, leaves
the frozen cgi-bin and htdocs alone, and restarts the httpd if it was
running.  Ran it on all three parked instances: cgi-bin now sends no
Access-Control header, htdocs and trash send both.

diff --git src/utils/ts/README src/utils/ts/README
index 0bb10fc7f01..9a42a44631a 100644
--- src/utils/ts/README
+++ src/utils/ts/README
@@ -18,30 +18,31 @@
            opens the local ssh -L tunnel.  Install it as "ts" on the laptop.
 
 Setup on hgwdev.  A freeze uses a few gigabytes per ticket, so keep the parked
 instances on a large local pool instead of your home directory:
 
   mkdir -p /data/home/$USER/ticketSandboxes
   ln -s /data/home/$USER/ticketSandboxes ~/ticketSandboxes
 
 Set TS_ROOT if you want them somewhere else.  Run "ts" with no arguments for the
 subcommand list.
 
 Typical use:
 
   ts create 37867 "some note"     freeze the live sandbox and start the httpd
   ts sync 37867                   re-freeze after more work on the live sandbox
+  ts conf 37867                   rewrite httpd.conf only, keeping the freeze
   ts list                         show every parked ticket and its status
   ts tunnel 37867                 open the tunnel and print the browser URL
   ts remove 37867                 stop the httpd and delete the instance
 
 Any hgwdev account can reach a parked instance, because all hgwdev users share
 the machine's loopback:
 
   ssh -N -L PORT:localhost:PORT you@hgwdev.gi.ucsc.edu
   # then open http://localhost:PORT/cgi-bin/hgTracks
 
 There is no password on a parked instance.  It shows only what any hgwdev user
 can already build and query.
 
 Notes
 -----