0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-10 04:36:40 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 5 da09ee575b fix(coredns): answer every record type for the test zone instead of forwarding it

The CI zone served A and AAAA for INFINITO_DOMAIN and let every other type fall through to the public resolvers, which return NXDOMAIN for the reserved .test TLD. Per RFC 2308 that denial covers the whole name, not the queried type, so any caching resolver in front of CoreDNS applies it to the A record the deployment depends on.

Without such a cache nobody noticed: Mastodon's EmailMxValidator asks MX, takes the NXDOMAIN, then asks A anyway and gets the address. On a Tor node svc-net-tor puts dnsmasq in front, the denial is cached, and tootctl accounts create ends on 'Failure/Error: email unreachable'. It cost Fediwall#0 and Fediwall#2 in run 34653542922 and Fediwall#2 in run 34653754175, all three compose plus tor; the same two jobs passed in run 34614940508 as compose without tor, same command, same administrator@infinito.test, rc 0.

A template with no answer returns NOERROR with an empty answer section and the SOA in authority, so the zone denies a type without denying the name. It sits after the A and AAAA templates, which would otherwise have their names answered NODATA, and before forward, so no type escapes.

Measured against 172.30.0.53 in the running stack: infinito.test MX went from NXDOMAIN with an authority record to NOERROR with zero answers and the aa flag, infinito.test A and auth.infinito.test A still return 172.30.0.10, and deb.debian.org still resolves through the forward.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-12 09:35:58 +02:00

coredns

fix(coredns): answer every record type for the test zone instead of forwarding it

2026-09-12 09:35:58 +02:00

package-cache

fix(package-cache): survive a flaky apt mirror

2026-08-04 19:33:04 +02:00

package-cache-frontend

feat(apt): one Ubuntu mirror list for the package cache and image builds, with failover, a short timeout and a health test

2026-09-11 17:13:54 +02:00

registry-cache

…

swarm

feat(diagnostics): sample what the resolver answers, not just its socket

2026-08-22 17:55:05 +02:00

.gitignore

…

cache.override.yml

fix(cache): give the package-cache a static address on the bridge

2026-08-10 18:00:56 +02:00

cache.shared.override.yml

feat(worktree): isolated per-branch checkouts sharing one cache stack

2026-07-28 16:15:59 +02:00

noports.override.yml

fix(svc-runner): publish no dev-stack ports in nested DooD deploys

2026-07-10 18:43:34 +02:00

README.md

…

worktree.override.yml

feat(worktree): isolated per-branch checkouts sharing one cache stack

2026-07-28 16:15:59 +02:00

README.md

Compose Configuration 🧩

This directory holds the static configuration assets consumed by the top-level compose.yml of the local development and CI testing stack.

Scope 📋

The directory MUST contain only files that are bind-mounted into a service defined in compose.yml.
The directory MUST NOT host application configuration that belongs to an Ansible role. Per-role compose payloads live under roles/<role>/templates/.
The directory MUST NOT host workflow scripts, test fixtures, or build helpers. Those belong under scripts/ or tests/.

Layout 🗂️

Each compose service that needs static configuration owns a sub-directory whose name matches the service. New service-specific config MUST go into the matching sub-directory rather than at the compose/ root.

For the rules that govern compose.yml itself (env-variable contract, profile gating, resource caps), see compose.yml.md.