dns: add the migration change sheet; correct AAAA scope, close the mount unknown
Live zone inventory: 19 A + 18 AAAA records, all TTL 3600 (the lower values seen on some answers are cache countdowns). The AAAA scope was understated in the runbook - it is 18 hostnames, not 3. No CAA records, so no CA restriction to update. The /var/lib/nextcloud host mount resolves to 3 MB of regenerable thumbnails, so it is no longer an open unknown.
This commit is contained in:
inference-bot committed
1 parent
a2088e3976
commit
d1ff7fb0ff
2 files changed
+90
-5
No files matched your search
@@ -42,6 +42,8 @@ and the agent's own state (different machine).
|
||||
|
||||
## 3. Pre-flight
|
||||
|
||||
Companion sheet: `dns-change-sheet.md` (every record, current value, target value).
|
||||
|
||||
**Blocker — do this first.** The Vault app (`vault.inference.coop`) runs *on the server
|
||||
being migrated*, and the backup passphrase is believed to live there. The credentials
|
||||
needed to restore are inside the thing being restored.
|
||||
@@ -57,8 +59,9 @@ needed to restore are inside the thing being restored.
|
||||
old box's (9.0.4).
|
||||
- [ ] Confirm the Cloudron subscription can be moved to a new server.
|
||||
- [ ] **Decide the IPv6 question before anything else DNS-related.** The zone carries
|
||||
**AAAA records**: `inference.coop`, `my`, `matrix` all point to
|
||||
`2a02:4780:6e:83fd::1` (Hostinger's range). If the new box has IPv6, repoint them;
|
||||
**AAAA records on 18 hostnames** — everything that has an A record — all pointing to
|
||||
`2a02:4780:6e:83fd::1` (Hostinger's range). Counted 2026-10-30; the full list is in
|
||||
`dns-change-sheet.md`. This is 18 deletions or repoints, not a footnote. If the new box has IPv6, repoint them;
|
||||
if it does not, **delete the AAAA records** as part of the switch. Changing only
|
||||
the A records leaves every IPv6-capable client — including other Matrix
|
||||
homeservers and mail senders — still reaching the old box.
|
||||
@@ -82,8 +85,9 @@ needed to restore are inside the thing being restored.
|
||||
--format '{{.Name}} {{range .Mounts}}{{.Source}}=>{{.Destination}} {{end}}' \
|
||||
| tr ' ' '\n' | grep -v /app/data
|
||||
|
||||
A container showed `/var/lib/nextcloud` mounted from the host. Identify its owner and
|
||||
size; if it holds real data, copy it separately.
|
||||
**RESOLVED 2026-10-30:** the host mount is Nextcloud's `/var/lib/nextcloud`, **3 MB**,
|
||||
holding only `preview/` (regenerable thumbnails) — not a data-loss risk. Re-run this
|
||||
audit only if apps change before the cutover; it is now a confirm, not an unknown.
|
||||
- [ ] Record the highest backup run number before the freeze. (As of 2026-10-30 the
|
||||
newest run is healthy at ~4.6 GB and the backup space was enlarged, so the quota
|
||||
pressure that produced the `EntityTooLarge` failures is relieved — but run growth
|
||||
@@ -161,7 +165,6 @@ needed to restore are inside the thing being restored.
|
||||
## 7. Open unknowns — resolve before cutover
|
||||
|
||||
- Whether the Vault export (§3 blocker) has actually been done.
|
||||
- Which app owns the `/var/lib/nextcloud` host mount, and how much data is in it.
|
||||
- The Cloudron host's OS version, disk and RAM (not visible over the API).
|
||||
- Whether the S3 access key is in the off-box JSON or only inside Cloudron.
|
||||
- Whether any provider API key is bound to our current IP.
|
||||
|
||||
@@ -0,0 +1,82 @@
|
||||
# DNS change sheet — Cloudron migration (Hostinger → Infomaniak)
|
||||
|
||||
Prepared 2026-10-30 from a live zone inventory (`zone_inventory.json`, 41 records).
|
||||
Registrar: **yoursrs.com** (NS for domains.coop). Cloudron cannot manage these records;
|
||||
every change below is manual. **Nothing here is time-sensitive except the TTL lowering.**
|
||||
|
||||
## Counts, so the switch is not underestimated
|
||||
|
||||
- **19 A records** → `179.199.135.72`
|
||||
- **18 AAAA records** → `2a02:4780:6e:83fd::1` (Hostinger's range)
|
||||
- 1 MX, 1 SPF TXT, 1 DKIM TXT, 1 DMARC TXT
|
||||
- **No CAA records**, so no certificate-authority restriction to update.
|
||||
- **Configured TTL is 3600 s on every record.** (Lower these a day early; the 1090–1204 s
|
||||
seen on some answers are cache countdowns, not zone values.)
|
||||
|
||||
## Records to change at cutover
|
||||
|
||||
| Name | Type | Current | Set to |
|
||||
|---|---|---|---|
|
||||
| `chat-legacy.inference.coop` | A | `179.199.135.72` | `<new Infomaniak IPv4>` |
|
||||
| `chat.inference.coop` | A | `179.199.135.72` | `<new Infomaniak IPv4>` |
|
||||
| `cloud.inference.coop` | A | `179.199.135.72` | `<new Infomaniak IPv4>` |
|
||||
| `dashboard.inference.coop` | A | `179.199.135.72` | `<new Infomaniak IPv4>` |
|
||||
| `docs.inference.coop` | A | `179.199.135.72` | `<new Infomaniak IPv4>` |
|
||||
| `email.inference.coop` | A | `179.199.135.72` | `<new Infomaniak IPv4>` |
|
||||
| `forum.inference.coop` | A | `179.199.135.72` | `<new Infomaniak IPv4>` |
|
||||
| `gateway.inference.coop` | A | `179.199.135.72` | `<new Infomaniak IPv4>` |
|
||||
| `git.inference.coop` | A | `179.199.135.72` | `<new Infomaniak IPv4>` |
|
||||
| `inference.coop` | A | `179.199.135.72` | `<new Infomaniak IPv4>` |
|
||||
| `matrix.inference.coop` | A | `179.199.135.72` | `<new Infomaniak IPv4>` |
|
||||
| `my.inference.coop` | A | `179.199.135.72` | `<new Infomaniak IPv4>` |
|
||||
| `newsletter.inference.coop` | A | `179.199.135.72` | `<new Infomaniak IPv4>` |
|
||||
| `panel.inference.coop` | A | `179.199.135.72` | `<new Infomaniak IPv4>` |
|
||||
| `portal.inference.coop` | A | `179.199.135.72` | `<new Infomaniak IPv4>` |
|
||||
| `search.inference.coop` | A | `179.199.135.72` | `<new Infomaniak IPv4>` |
|
||||
| `status.inference.coop` | A | `179.199.135.72` | `<new Infomaniak IPv4>` |
|
||||
| `vault.inference.coop` | A | `179.199.135.72` | `<new Infomaniak IPv4>` |
|
||||
| `www.inference.coop` | A | `179.199.135.72` | `<new Infomaniak IPv4>` |
|
||||
| `chat-legacy.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `<new IPv6 — or delete every AAAA>` |
|
||||
| `chat.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `<new IPv6 — or delete every AAAA>` |
|
||||
| `cloud.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `<new IPv6 — or delete every AAAA>` |
|
||||
| `dashboard.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `<new IPv6 — or delete every AAAA>` |
|
||||
| `docs.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `<new IPv6 — or delete every AAAA>` |
|
||||
| `email.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `<new IPv6 — or delete every AAAA>` |
|
||||
| `forum.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `<new IPv6 — or delete every AAAA>` |
|
||||
| `gateway.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `<new IPv6 — or delete every AAAA>` |
|
||||
| `git.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `<new IPv6 — or delete every AAAA>` |
|
||||
| `inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `<new IPv6 — or delete every AAAA>` |
|
||||
| `matrix.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `<new IPv6 — or delete every AAAA>` |
|
||||
| `my.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `<new IPv6 — or delete every AAAA>` |
|
||||
| `newsletter.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `<new IPv6 — or delete every AAAA>` |
|
||||
| `panel.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `<new IPv6 — or delete every AAAA>` |
|
||||
| `portal.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `<new IPv6 — or delete every AAAA>` |
|
||||
| `search.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `<new IPv6 — or delete every AAAA>` |
|
||||
| `status.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `<new IPv6 — or delete every AAAA>` |
|
||||
| `vault.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `<new IPv6 — or delete every AAAA>` |
|
||||
|
||||
`www` has no app behind it in the Cloudron inventory — confirm whether it is an alias,
|
||||
a redirect, or stale before touching it.
|
||||
|
||||
## Records that must NOT change, but must be re-verified after the restore
|
||||
|
||||
| Name | Type | Value | Why |
|
||||
|---|---|---|---|
|
||||
| `inference.coop` | MX | `10 my.inference.coop.` | Follows the A record; no MX edit needed. |
|
||||
| `inference.coop` | TXT (SPF) | `v=spf1 a:my.inference.coop ~all` | Hostname-based — survives the IP change. |
|
||||
| `cloudron._domainkey` | TXT (DKIM) | `v=DKIM1; t=s; p=MIGfMA0…` | **Must match the key inside the restored mail app's data.** Mismatch + DMARC below = silently discarded mail. |
|
||||
| `_dmarc` | TXT | `v=DMARC1; p=reject; pct=100` | Reject policy: misaligned mail is DISCARDED, not junked. |
|
||||
|
||||
## Sequence (see the main runbook §4)
|
||||
|
||||
1. A day early: set every A and AAAA TTL to 300 s.
|
||||
2. At cutover: point A records at the new IP; repoint or **delete** every AAAA record
|
||||
(decide in advance — an IPv6-capable client or homeserver left on Hostinger's address
|
||||
reaches the old box even after the A switch).
|
||||
3. Verify with the resolver set below, not one resolver.
|
||||
|
||||
```
|
||||
for h in inference.coop my.inference.coop matrix.inference.coop gateway.inference.coop; do
|
||||
dig +short A $h @1.1.1.1; dig +short A $h @8.8.8.8; dig +short AAAA $h @1.1.1.1
|
||||
done
|
||||
```
|
||||
Reference in new issue
Block a user