grenadeandClaude Opus 5
a91aaf3d1c
Publishing the name was a block of printed instructions, which put the knowledge in whoever last read them. It is now a step like every other: absent records are created, correct ones are reported, and a name that points somewhere else is left alone with a pointer to public-dns.md §4. `--skip-dns` opts out. The apex takes a CNAME to the site indirection, not an A record. Cloudflare flattens it, and it buys the property §2 is about -- a WAN address change is one record rather than a hunt across zones. bansko.io already does this; the claim in public-dns.md §3 that the fleet's apexes use A records was wrong and is corrected there. Note that `dig` cannot tell you which a zone uses, because flattening makes both answer with an A; only the API can. The script lives in script/publish-dns.sh and is piped to the proxy rather than embedded as a heredoc. Quoting shell through an unquoted heredoc silently mangled two earlier versions of this same code -- once producing `tr -d "'" ")` -- and a file can be linted and run directly. It executes on the proxy because that is where the Cloudflare token is, and the token is never copied off that host: it can rewrite DNS for every zone on the account. Token parsing uses awk rather than a PCRE lookbehind. Widening the lookbehind to tolerate variable spacing made grep fail outright -- lookbehinds must be fixed-length -- so the fixed-width form would have broken silently the day someone reformatted the credentials file. Verified: first run created both records, second reported them ok, rustingface.com and www both resolve to the site address, and the Let's Encrypt chain validates against the public trust store. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XZG2i4AmfSqE97EJGBVb64