From ee63939151cd654771b6986e5d0683a8317274b6 Mon Sep 17 00:00:00 2001 From: rob thijssen Date: Wed, 8 Jul 2026 12:41:43 +0300 Subject: [PATCH] docs(infra-setup): print required DNS records + public-name override warning MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Deployment needs two DNS records this script doesn't manage: a split-horizon newsfeed.internal -> oolon (the mesh access path), and NO internal override for the public rob.fyi (an internal record pointing it elsewhere makes mesh clients land on the wrong vhost/cert — which is exactly what happened: rob.fyi resolved internally to the office proxy 10.6.0.46 and served admin.zap.pics). Surface both at the end of every run so the gap is visible. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_016fKZzDpvjiJ9eYbPGgJvUP --- script/infra-setup.sh | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/script/infra-setup.sh b/script/infra-setup.sh index 17947c4..4f322ec 100755 --- a/script/infra-setup.sh +++ b/script/infra-setup.sh @@ -263,11 +263,27 @@ mint_internal_cert() { run_remote "$host" "systemctl enable --now step@${CERT_NAME}.timer" } +# DNS is not managed by this script, but the deployment doesn't work without two records. +# Print them explicitly — a missing or wrong split-horizon record is the classic reason a +# mesh client gets the wrong site/cert (reverse-proxies.md §2, external-tls.md §5). +dns_reminders() { + local web_ip; web_ip="$(getent hosts "$WEB_HOST" | awk '{print $1}' | head -1)" + web_ip="${web_ip:-}" + info "DNS (manage separately — not done by this script):" + info " • add split-horizon ${CERT_NAME}.internal -> ${web_ip} (mesh access path)" + if [[ -n "$PUBLIC_FQDN" ]]; then + info " • ${PUBLIC_FQDN}: public A -> kosherinata WAN only. Do NOT add an internal" + info " override for it — an internal record pointing elsewhere (e.g. the office" + info " proxy) makes mesh clients hit the wrong vhost. Mesh users use ${CERT_NAME}.internal." + fi +} + main() { require_files info "newsfeed infra-setup (api=$API_HOST web=$WEB_HOST)$([[ $DRY_RUN == 1 ]] && echo ' [dry-run]')" provision_api_host provision_web_host + dns_reminders info "done" }