mirror of
https://github.com/hanzoai/dns.git
synced 2026-10-30 18:40:55 +00:00
zeekayandHanzo Dev
0f95eb4d27
Both were A records at 134.199.138.27, the lux-k8s LB — a cluster with no config for either host. Every TLS handshake got CN=INGRESS DEFAULT CERT and browsers hard-failed. They had been that way since 2026-03-06, so nothing could ever have depended on them working. There is no iam.<brand> host in the design. Each brand has ONE identity origin serving the login SPA at / and the IAM API at /v1/iam, /oauth, /.well-known — zoolabs.id for Zoo, pars.id for Pars, each aliased by id.<brand>.network — and its discovery doc reports that same origin as the issuer. iam.hanzo.ai is the one legacy IAM host, kept because the shared Google/GitHub OAuth clients register exactly one callback against it. The one client that referenced iam.zoo.network — Zoo Exchange's SPA_IAM_HOST, shipped to browsers in zoo.exchange/config.json — now points at zoolabs.id (luxfi/universe 1b35b5d9). The orphaned hanzo/iam-multi Ingress that claimed these hosts, which never registered a router because it set spec.ingressClassName instead of the kubernetes.io/ingress.class annotation, is deleted from do-sfo3-hanzo-k8s. Retiring to NXDOMAIN follows this subsystem's own precedent for a host that should not exist (zoo.id, per hanzoai/universe crs/iam.yaml). Co-authored-by: Hanzo Dev <[email protected]>