0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 02:54:26 +00:00

Files

T

History

kevinveenbirkenbachandClaude Opus 5 da09ee575b fix(coredns): answer every record type for the test zone instead of forwarding it

The CI zone served A and AAAA for INFINITO_DOMAIN and let every other type fall through to the public resolvers, which return NXDOMAIN for the reserved .test TLD. Per RFC 2308 that denial covers the whole name, not the queried type, so any caching resolver in front of CoreDNS applies it to the A record the deployment depends on.

Without such a cache nobody noticed: Mastodon's EmailMxValidator asks MX, takes the NXDOMAIN, then asks A anyway and gets the address. On a Tor node svc-net-tor puts dnsmasq in front, the denial is cached, and tootctl accounts create ends on 'Failure/Error: email unreachable'. It cost Fediwall#0 and Fediwall#2 in run 34653542922 and Fediwall#2 in run 34653754175, all three compose plus tor; the same two jobs passed in run 34614940508 as compose without tor, same command, same administrator@infinito.test, rc 0.

A template with no answer returns NOERROR with an empty answer section and the SOA in authority, so the zone denies a type without denying the name. It sits after the A and AAAA templates, which would otherwise have their names answered NODATA, and before forward, so no type escapes.

Measured against 172.30.0.53 in the running stack: infinito.test MX went from NXDOMAIN with an authority record to NOERROR with zero answers and the aa flag, infinito.test A and auth.infinito.test A still return 172.30.0.10, and deb.debian.org still resolves through the forward.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-12 09:35:58 +02:00

Corefile.tmpl

fix(coredns): answer every record type for the test zone instead of forwarding it

2026-09-12 09:35:58 +02:00

README.md

docs(coredns): describe the substitution the code actually does

2026-09-01 18:02:57 +02:00

README.md

CoreDNS Sidecar Config 🛰️

Static configuration for the coredns service in compose.yml. The sidecar resolves the dev/CI stack's internal hostnames so the infinito runner can reach its own applications without hitting an external resolver.

Scope 📋

This directory MUST contain only files consumed by the coredns compose service.
The Corefile.tmpl MUST be the source of truth. It is rendered to Corefile by coredns.py, which substitutes its ${VAR} placeholders in-process, using values from .env (generated from default.env, overridable through the CLI's environment).
The rendered Corefile is build artefact and MUST stay in .gitignore.

Files 📄

Corefile.tmpl: ${VAR} template processed at stack start.
Corefile: rendered output, bind-mounted read-only into the coredns container at /Corefile.