inference-bot
86e2afe5d0
docs.inference.coop does not exist — it resolved only because *.inference.coop answers, which is how it got into this sheet (and into the digest footer, since fixed to point at git.inference.coop/co-op/docs). Adds the consequence that matters for cutover: a resolving name proves nothing here, so reconcile against the registrar's record list rather than by resolution.
103 lines
6.3 KiB
Markdown
103 lines
6.3 KiB
Markdown
# DNS change sheet — Cloudron migration (Hostinger → Infomaniak)
|
||
|
||
Prepared 2026-10-30 from a live zone inventory (`zone_inventory.json`, 41 records).
|
||
Registrar: **yoursrs.com** (NS for domains.coop). Cloudron cannot manage these records;
|
||
every change below is manual. **Nothing here is time-sensitive except the TTL lowering.**
|
||
|
||
## Counts, so the switch is not underestimated
|
||
|
||
- **19 A records** → `179.199.135.72`
|
||
- **18 AAAA records** → `2a02:4780:6e:83fd::1` (Hostinger's range)
|
||
- 1 MX, 1 SPF TXT, 1 DKIM TXT, 1 DMARC TXT
|
||
- **No CAA records**, so no certificate-authority restriction to update.
|
||
- **The zone is wildcarded.** A nonsense name (`definitely-not-a-real-host-xyz`.
|
||
`inference.coop`) resolves to the same A/AAAA as `inference.coop` itself, so *any* name
|
||
answers. Two consequences: (a) a name that resolves is **not** evidence that a record
|
||
exists — `docs.inference.coop` was listed in this sheet on exactly that mistake, and does
|
||
not exist; (b) **DNS cannot verify the cutover per-name.** Check the registrar's record
|
||
list against this sheet rather than resolving hostnames. If the wildcard is a real edge
|
||
record, it must be repointed at cutover too, or every name relying on it stays on the old
|
||
box while the named records move.
|
||
- **Configured TTL is 3600 s on every record.** (Lower these a day early; the 1090–1204 s
|
||
seen on some answers are cache countdowns, not zone values.)
|
||
|
||
## Records to change at cutover
|
||
|
||
| Name | Type | Current | Set to |
|
||
|---|---|---|---|
|
||
| `chat-legacy.inference.coop` | A | `179.199.135.72` | `179.237.86.116` |
|
||
| `chat.inference.coop` | A | `179.199.135.72` | `179.237.86.116` |
|
||
| `cloud.inference.coop` | A | `179.199.135.72` | `179.237.86.116` |
|
||
| `dashboard.inference.coop` | A | `179.199.135.72` | `179.237.86.116` |
|
||
| `email.inference.coop` | A | `179.199.135.72` | `179.237.86.116` |
|
||
| `forum.inference.coop` | A | `179.199.135.72` | `179.237.86.116` |
|
||
| `gateway.inference.coop` | A | `179.199.135.72` | `179.237.86.116` |
|
||
| `git.inference.coop` | A | `179.199.135.72` | `179.237.86.116` |
|
||
| `inference.coop` | A | `179.199.135.72` | `179.237.86.116` |
|
||
| `matrix.inference.coop` | A | `179.199.135.72` | `179.237.86.116` |
|
||
| `my.inference.coop` | A | `179.199.135.72` | `179.237.86.116` |
|
||
| `newsletter.inference.coop` | A | `179.199.135.72` | `179.237.86.116` |
|
||
| `panel.inference.coop` | A | `179.199.135.72` | `179.237.86.116` |
|
||
| `portal.inference.coop` | A | `179.199.135.72` | `179.237.86.116` |
|
||
| `search.inference.coop` | A | `179.199.135.72` | `179.237.86.116` |
|
||
| `status.inference.coop` | A | `179.199.135.72` | `179.237.86.116` |
|
||
| `vault.inference.coop` | A | `179.199.135.72` | `179.237.86.116` |
|
||
| `www.inference.coop` | A | `179.199.135.72` | `179.237.86.116` |
|
||
| `chat-legacy.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` |
|
||
| `chat.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` |
|
||
| `cloud.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` |
|
||
| `dashboard.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` |
|
||
| `email.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` |
|
||
| `forum.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` |
|
||
| `gateway.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` |
|
||
| `git.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` |
|
||
| `inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` |
|
||
| `matrix.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` |
|
||
| `my.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` |
|
||
| `newsletter.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` |
|
||
| `panel.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` |
|
||
| `portal.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` |
|
||
| `search.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` |
|
||
| `status.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` |
|
||
| `vault.inference.coop` | AAAA | `2a02:4780:6e:83fd::1` | `2001:1600:18:206::89` |
|
||
|
||
`www` has no app behind it in the Cloudron inventory — confirm whether it is an alias,
|
||
a redirect, or stale before touching it.
|
||
|
||
## Records that must NOT change, but must be re-verified after the restore
|
||
|
||
| Name | Type | Value | Why |
|
||
|---|---|---|---|
|
||
| `inference.coop` | MX | `10 my.inference.coop.` | Follows the A record; no MX edit needed. |
|
||
| `inference.coop` | TXT (SPF) | `v=spf1 a:my.inference.coop ~all` | Hostname-based — survives the IP change. |
|
||
| `cloudron._domainkey` | TXT (DKIM) | `v=DKIM1; t=s; p=MIGfMA0…` | **Must match the key inside the restored mail app's data.** Mismatch + DMARC below = silently discarded mail. |
|
||
| `_dmarc` | TXT | `v=DMARC1; p=reject; pct=100` | Reject policy: misaligned mail is DISCARDED, not junked. |
|
||
|
||
## Sequence (see the main runbook §4)
|
||
|
||
1. A day early: set every A and AAAA TTL to 300 s.
|
||
2. At cutover: point A records at **`179.237.86.116`**; repoint every AAAA record to **`2001:1600:18:206::89`**
|
||
(the new box has IPv6, so this is a repoint, not a delete — but it must happen in
|
||
the same pass: an IPv6-capable client or homeserver left on Hostinger's address
|
||
reaches the old box even after the A switch).
|
||
3. Verify with the resolver set below, not one resolver.
|
||
|
||
```
|
||
for h in inference.coop my.inference.coop matrix.inference.coop gateway.inference.coop; do
|
||
dig +short A $h @1.1.1.1; dig +short A $h @8.8.8.8; dig +short AAAA $h @1.1.1.1
|
||
done
|
||
```
|
||
|
||
## The new box (given 2026-10-30)
|
||
|
||
- **IPv4** `179.237.86.116` · **IPv6** `2001:1600:18:206::89`
|
||
- 4 CPU · 12 GB RAM · **250 GB disk** · unlimited traffic
|
||
- **1 snapshot slot free** — take a snapshot *after* a clean restore and *before* the DNS
|
||
switch, so a bad restore is a revert rather than a rebuild.
|
||
- Location Plan-les-Ouates, Switzerland (same provider as the backup target, so the
|
||
restore reads from inside Infomaniak's network).
|
||
- Ubuntu **26.04 LTS** — confirm Cloudron 9.x supports it before installing.
|
||
- **Reverse DNS is listed as "configure" for BOTH addresses.** Set PTR → `my.inference.coop`
|
||
on the IPv4 *and* the IPv6. A sending IP without matching PTR is the classic cause of
|
||
fresh-IP mail landing in spam, and DMARC here is `p=reject` on our own domain.
|