No description
- Rust 100%
Jennifer
c5874707aa
All checks were successful
/ sync (push) Successful in 1m24s
- SSHFP records were leftover from sif pre-migration and no longer match hecate's host keys; since this zone is DNSSEC-signed, VerifyHostKeyDNS clients were validating cryptographically-confirmed wrong fingerprints. - _pop3s._tcp SRV pointed at port 995, which the Hetzner firewall has never had open; POP3 isn't used, so drop the record. - dns-gitops did exact-content matching on HTTPS records, so every push to main reverted Caddy's live ECH publisher (tls.ech + dns.providers.inwx) back to a bare alpn-only record, silently killing ECH. HTTPS is now skipped in sync (like SOA/NS/DNSSEC already are) across all 6 zones. - Updated the TLSA comment: the zone is DNSSEC-signed now, so DANE here is enforced, not opportunistic. |
||
|---|---|---|
| .forgejo/workflows | ||
| .idea | ||
| src | ||
| templates | ||
| zones | ||
| .gitignore | ||
| Cargo.lock | ||
| Cargo.toml | ||
| README.md | ||
dns-gitops
Manage DNS records as zone files in git and sync them to INWX via their API.
Commands
validate
Check zone file syntax without touching the remote.
cargo run -- validate --zonefile zones/example.com.zone
cargo run -- validate --zonefile zones/*.zone
Zone files
Zone files live in zones/ and use standard BIND format. The domain name is derived from the filename (e.g. zones/example.com.zone maps to example.com).
$ORIGIN example.com.
example.com. 86400 IN SOA ns.inwx.de. hostmaster.inwx.de. 2024010100 10800 3600 1209600 3600
example.com. 86400 IN NS ns.inwx.de.
example.com. 86400 IN NS ns2.inwx.de.
example.com. 86400 IN NS ns3.inwx.eu.
example.com. 3600 IN A 93.184.216.34
example.com. 3600 IN AAAA 2606:2800:220:1:248:1893:25c8:1946
SOA and NS records are skipped during sync (managed by the provider). Comments (;) and directives ($) are ignored.
To deploy changes, commit your zone files and push to main. The Forgejo CI workflow will automatically sync them to INWX.