inference-bot
48c4827957
The previous sheet's record counts could not be reproduced and at least two listed records did not exist, so it was replaced rather than corrected. Rebuilt from a screenshot of the domains.coop panel: 11 records total, of which two are wildcards carrying both A and AAAA. That is the item the old sheet omitted, and it is the one that matters most — every application hostname (chat, portal, panel, dashboard, newsletter, gateway, vault, git, registry, files, forum, email, docs, my, status) resolves ONLY via the wildcard and is not an individual record. A cutover that moves the apex but not the wildcards leaves all of them behind. Also recorded: the second DKIM selector (UUID-named, 2048-bit) that is almost certainly Scaleway TEM's, and which explains why probing plausible selector names never found it; the absence of any CNAME, CAA, SRV or ACME records; an unexplained server.inference.coop A record that must be identified before it is moved; and the pre-window TTL reduction. Known gap: row 11's full name and value are truncated in the panel screenshot and must be read in the panel before that row is edited.
86 lines
4.9 KiB
Markdown
86 lines
4.9 KiB
Markdown
# DNS change sheet — inference.coop
|
||
|
||
**Rebuilt 2026-11-01 from the registrar's own panel** (domains.coop; nameservers `ns1/ns2.yoursrs.com`).
|
||
The previous version listed record counts that could not be reproduced and at least two records that did
|
||
not exist, so it is replaced rather than edited.
|
||
|
||
## Why the panel was the only source
|
||
|
||
- **AXFR is refused**, so the zone cannot be pulled.
|
||
- **The zone is wildcarded.** A made-up hostname (`zz-random-check-9f2.inference.coop`) returns the old
|
||
box's address. So a name that *resolves* proves nothing about whether a record exists, and any hostname
|
||
absent from the list below is served by the wildcard.
|
||
- Only 11 records exist. Everything else is `*`.
|
||
|
||
## The complete inventory (11 records)
|
||
|
||
| # | Type | Hostname | Value | TTL | Moves? |
|
||
|---|------|----------|-------|-----|--------|
|
||
| 1 | A | `inference.coop` | `179.199.135.72` | 3600 | **YES** → new box |
|
||
| 2 | AAAA | `inference.coop` | `2a02:4780:6e:83fd::1` | 3600 | **YES** → new box |
|
||
| 3 | A | `*` | `179.199.135.72` | 3600 | **YES** → new box |
|
||
| 4 | AAAA | `*` | `2a02:4780:6e:83fd::1` | 3600 | **YES** → new box |
|
||
| 5 | A | `server` | `179.199.135.72` | 3600 | **CHECK FIRST** — nothing else references it |
|
||
| 6 | A | `www` | `179.199.135.72` | 3600 | **YES** → new box |
|
||
| 7 | MX (pri 10) | `inference.coop` | `my.inference.coop` | 3600 | stays (follows record 1/2) |
|
||
| 8 | TXT | `inference.coop` | `v=spf1 a:my.inference.coop include:_spf.tem.scaleway.com ~all` | 3600 | stays |
|
||
| 9 | TXT | `_dmarc` | `v=DMARC1; p=reject; pct=100` | 3600 | stays |
|
||
| 10 | TXT | `cloudron._domainkey` | `v=DKIM1; t=s; p=MIGfMA0GCSqGSIb3…` (1024-bit; full value recovered 2026-11-01 and restored) | 3600 | stays |
|
||
| 11 | TXT | `ede94f37-204c-41ee-b3…` | `v=DKIM1; h=sha256; k=rsa; p=MIIBIjA…` (2048-bit) | 3600 | stays |
|
||
| 12 | TXT | `_atproto` | `did=did:plc:4leras5objxiqtnbjzoholds` | 3600 | stays |
|
||
|
||
(The table shows 12 rows because `www` was added as a separate item; rows 1–11 are the panel's 11.
|
||
Reconcile the numbering against the panel when editing.)
|
||
|
||
## The four records that matter at cutover
|
||
|
||
**Records 1–4 and 6**: apex A, apex AAAA, wildcard A, wildcard AAAA, and `www`. Change these and the site
|
||
moves. Nothing else in the zone needs touching for the migration.
|
||
|
||
**The wildcards are the item the old sheet omitted entirely.** Because `*` carries both A and AAAA records,
|
||
every hostname not listed above — `chat`, `portal`, `panel`, `dashboard`, `newsletter`, `gateway`,
|
||
`vault`, `git`, `registry`, `files`, `forum`, `email`, `docs`, `my`, `status` — resolves *only* via the
|
||
wildcard. They are not individual records and must not be created as such; they move when the wildcards
|
||
move. A partial cutover that changes the apex but not `*` leaves every application on the old box.
|
||
|
||
## Two DKIM selectors, for different senders
|
||
|
||
- **`cloudron._domainkey`** — the box's own mail signing (1024-bit). Used by the portal and by Listmonk,
|
||
both of which relay through the Cloudron mail app.
|
||
- **`ede94f37-…`** — a UUID-named selector with a 2048-bit key. UUID selectors are what a service
|
||
generates for itself, and this is almost certainly **Scaleway Transactional Email's**. Scaleway's own
|
||
domain verification passed, which is the authority on whether it is right.
|
||
|
||
*Name and value for row 11 are truncated in the panel screenshot. Read the full name in the panel (or
|
||
from Scaleway's domain-verification page) before editing that row.*
|
||
|
||
## What the zone does NOT contain
|
||
|
||
No CNAME, no CAA, no SRV, no `_acme-challenge` entries. If any of those are ever needed, they are new
|
||
records, not moves. (`docs.inference.coop` has no record of its own — it is served by the wildcard, which
|
||
is why it answers with the Cloudron dashboard.)
|
||
|
||
## Before the window
|
||
|
||
1. **Lower the TTL on records 1–4 and 6 from 3600 to ~300.** At 3600 a mistake takes an hour to correct;
|
||
at 300 it takes five minutes. Do this a day ahead so the old TTL expires, then restore it afterwards.
|
||
2. **Establish what `server.inference.coop` is used for.** Nothing in the co-op's documented set refers to
|
||
it, and it is not covered by the wildcard. Do not move or delete it until that is known.
|
||
3. **Confirm the full name of record 11** (above).
|
||
|
||
## Verification after the move
|
||
|
||
Query the **authoritative** nameservers, not a resolver, and query the specific name — a wildcard answer
|
||
cannot be distinguished from a real record otherwise:
|
||
|
||
```
|
||
dig +short A inference.coop @ns1.yoursrs.com
|
||
dig +short AAAA inference.coop @ns1.yoursrs.com
|
||
dig +short A zz-random-check-9f2.inference.coop @ns1.yoursrs.com # wildcard, must now be the NEW box
|
||
dig +short MX inference.coop @ns1.yoursrs.com
|
||
```
|
||
|
||
Then `verify-restore.py`. Its two known blind spots (the `data` group crashing on a missing PATH, and the
|
||
mail check asserting a port-25 state it cannot observe from the agent host) are still unfixed — fix them
|
||
before relying on a clean run.
|