87 lines
5.0 KiB
Markdown
87 lines
5.0 KiB
Markdown
# DNS change sheet — inference.coop
|
||
|
||
**Rebuilt 2026-11-01 from the registrar's own panel** (domains.coop; nameservers `ns1/ns2.yoursrs.com`).
|
||
The previous version listed record counts that could not be reproduced and at least two records that did
|
||
not exist, so it is replaced rather than edited.
|
||
|
||
## Why the panel was the only source
|
||
|
||
- **AXFR is refused**, so the zone cannot be pulled.
|
||
- **The zone is wildcarded.** A made-up hostname (`zz-random-check-9f2.inference.coop`) returns the old
|
||
box's address. So a name that *resolves* proves nothing about whether a record exists, and any hostname
|
||
absent from the list below is served by the wildcard.
|
||
- Only 11 records exist. Everything else is `*`.
|
||
|
||
## The complete inventory (11 records)
|
||
|
||
| # | Type | Hostname | Value | TTL | Moves? |
|
||
|---|------|----------|-------|-----|--------|
|
||
| 1 | A | `inference.coop` | `179.199.135.72` | 3600 | **YES** → new box |
|
||
| 2 | AAAA | `inference.coop` | `2a02:4780:6e:83fd::1` | 3600 | **YES** → new box |
|
||
| 3 | A | `*` | `179.199.135.72` | 3600 | **YES** → new box |
|
||
| 4 | AAAA | `*` | `2a02:4780:6e:83fd::1` | 3600 | **YES** → new box |
|
||
| 5 | A | `server` | `179.199.135.72` | 3600 | **CHECK FIRST** — nothing else references it |
|
||
| 6 | A | `www` | `179.199.135.72` | 3600 | **YES** → new box |
|
||
| 7 | MX (pri 10) | `inference.coop` | `my.inference.coop` | 3600 | stays (follows record 1/2) |
|
||
| 8 | TXT | `inference.coop` | `v=spf1 a:my.inference.coop include:_spf.tem.scaleway.com ~all` | 3600 | stays |
|
||
| 9 | TXT | `_dmarc` | `v=DMARC1; p=reject; pct=100` | 3600 | stays |
|
||
| 10 | TXT | `cloudron._domainkey` | `v=DKIM1; t=s; p=MIGfMA0GCSqGSIb3…` (1024-bit; full value recovered 2026-11-01 and restored) | 3600 | stays |
|
||
| 11 | TXT | `ede94f37-204c-41ee-b3…` | `v=DKIM1; h=sha256; k=rsa; p=MIIBIjA…` (2048-bit) | 3600 | stays |
|
||
| 12 | TXT | `_atproto` | `did=did:plc:4leras5objxiqtnbjzoholds` | 3600 | stays |
|
||
|
||
(The table shows 12 rows because `www` was added as a separate item; rows 1–11 are the panel's 11.
|
||
Reconcile the numbering against the panel when editing.)
|
||
|
||
## The four records that matter at cutover
|
||
|
||
**Records 1–4 and 6**: apex A, apex AAAA, wildcard A, wildcard AAAA, and `www`. Change these and the site
|
||
moves. Nothing else in the zone needs touching for the migration.
|
||
|
||
**The wildcards are the item the old sheet omitted entirely.** Because `*` carries both A and AAAA records,
|
||
every hostname not listed above — `chat`, `portal`, `panel`, `dashboard`, `newsletter`, `gateway`,
|
||
`vault`, `git`, `registry`, `files`, `forum`, `email`, `docs`, `my`, `status` — resolves *only* via the
|
||
wildcard. They are not individual records and must not be created as such; they move when the wildcards
|
||
move. A partial cutover that changes the apex but not `*` leaves every application on the old box.
|
||
|
||
## Two DKIM selectors, for different senders
|
||
|
||
- **`cloudron._domainkey`** — the box's own mail signing (1024-bit). Used by the portal and by Listmonk,
|
||
both of which relay through the Cloudron mail app.
|
||
- **`ede94f37-…`** — a UUID-named selector with a 2048-bit key. UUID selectors are what a service
|
||
generates for itself, and this is almost certainly **Scaleway Transactional Email's**. Scaleway's own
|
||
domain verification passed, which is the authority on whether it is right.
|
||
|
||
*Name and value for row 11 are truncated in the panel screenshot. Read the full name in the panel (or
|
||
from Scaleway's domain-verification page) before editing that row.*
|
||
|
||
## What the zone does NOT contain
|
||
|
||
No CNAME, no CAA, no SRV, no `_acme-challenge` entries. If any of those are ever needed, they are new
|
||
records, not moves. (`docs.inference.coop` has no record of its own — it is served by the wildcard, which
|
||
is why it answers with the Cloudron dashboard.)
|
||
|
||
## Before the window
|
||
|
||
1. **Lower the TTL on records 1–4 and 6 from 3600 to ~300.** At 3600 a mistake takes an hour to correct;
|
||
at 300 it takes five minutes. Do this a day ahead so the old TTL expires, then restore it afterwards.
|
||
2. ~~**Establish what `server.inference.coop` is used for.**~~ **Resolved 2026-11-02:** it was repointed
|
||
to the new box with the rest (confirmed authoritatively on both NS). Its purpose is still
|
||
unidentified, but it no longer references the old box — see the runbook's CUTOVER COMPLETE section.
|
||
3. **Confirm the full name of record 11** (above).
|
||
|
||
## Verification after the move
|
||
|
||
Query the **authoritative** nameservers, not a resolver, and query the specific name — a wildcard answer
|
||
cannot be distinguished from a real record otherwise:
|
||
|
||
```
|
||
dig +short A inference.coop @ns1.yoursrs.com
|
||
dig +short AAAA inference.coop @ns1.yoursrs.com
|
||
dig +short A zz-random-check-9f2.inference.coop @ns1.yoursrs.com # wildcard, must now be the NEW box
|
||
dig +short MX inference.coop @ns1.yoursrs.com
|
||
```
|
||
|
||
Then `verify-restore.py`. Its two known blind spots (the `data` group crashing on a missing PATH, and the
|
||
mail check asserting a port-25 state it cannot observe from the agent host) are still unfixed — fix them
|
||
before relying on a clean run.
|