mirror of
https://github.com/hanzoai/dns.git
synced 2026-10-30 18:40:55 +00:00
zeekayandHanzo Dev
0f95eb4d27
Both were A records at 134.199.138.27, the lux-k8s LB — a cluster with no config for either host. Every TLS handshake got CN=INGRESS DEFAULT CERT and browsers hard-failed. They had been that way since 2026-03-06, so nothing could ever have depended on them working. There is no iam.<brand> host in the design. Each brand has ONE identity origin serving the login SPA at / and the IAM API at /v1/iam, /oauth, /.well-known — zoolabs.id for Zoo, pars.id for Pars, each aliased by id.<brand>.network — and its discovery doc reports that same origin as the issuer. iam.hanzo.ai is the one legacy IAM host, kept because the shared Google/GitHub OAuth clients register exactly one callback against it. The one client that referenced iam.zoo.network — Zoo Exchange's SPA_IAM_HOST, shipped to browsers in zoo.exchange/config.json — now points at zoolabs.id (luxfi/universe 1b35b5d9). The orphaned hanzo/iam-multi Ingress that claimed these hosts, which never registered a router because it set spec.ingressClassName instead of the kubernetes.io/ingress.class annotation, is deleted from do-sfo3-hanzo-k8s. Retiring to NXDOMAIN follows this subsystem's own precedent for a host that should not exist (zoo.id, per hanzoai/universe crs/iam.yaml). Co-authored-by: Hanzo Dev <[email protected]>
91 lines
2.0 KiB
YAML
91 lines
2.0 KiB
YAML
# zoo-network.yaml — Cloudflare zone config for zoo.network
|
|
# Zone ID: d9c81c5b54f0f713105d483ddbd61656
|
|
# Source of truth for zoo.network DNS records
|
|
# Last synced: 2026-03-12
|
|
---
|
|
zone: zoo.network
|
|
zone_id: "d9c81c5b54f0f713105d483ddbd61656"
|
|
|
|
records:
|
|
- type: A
|
|
name: api-explore
|
|
content: "134.199.138.27"
|
|
proxied: false
|
|
|
|
- type: A
|
|
name: api-explorer
|
|
content: "67.205.158.227"
|
|
proxied: false
|
|
|
|
- type: A
|
|
name: api
|
|
content: "134.199.138.27"
|
|
proxied: false
|
|
|
|
- type: A
|
|
name: explore
|
|
content: "134.199.138.27"
|
|
proxied: false
|
|
|
|
# NO `iam` record. Zoo's identity origin is zoolabs.id (login SPA at / plus
|
|
# the IAM API at /v1/iam, /oauth, /.well-known; discovery reports
|
|
# issuer=https://zoolabs.id). id.zoo.network is its alias. There is no
|
|
# iam.<brand> host in the design — iam.hanzo.ai is the one legacy IAM host,
|
|
# kept because the shared Google/GitHub OAuth clients register exactly one
|
|
# callback against it.
|
|
#
|
|
# `iam` used to be an A record at the lux-k8s LB 134.199.138.27, a cluster
|
|
# that had no config for the host at all — so it answered every handshake
|
|
# with CN=INGRESS DEFAULT CERT and browsers hard-failed. Retired to NXDOMAIN,
|
|
# the same way zoo.id was. Do not re-add it.
|
|
|
|
- type: A
|
|
name: mpc-api
|
|
content: "134.199.138.27"
|
|
proxied: false
|
|
|
|
- type: A
|
|
name: mpc
|
|
content: "134.199.138.27"
|
|
proxied: false
|
|
|
|
- type: A
|
|
name: status
|
|
content: "134.199.138.27"
|
|
proxied: false
|
|
|
|
- type: A
|
|
name: "@"
|
|
content: "185.199.111.153"
|
|
proxied: false
|
|
|
|
- type: A
|
|
name: "@"
|
|
content: "185.199.110.153"
|
|
proxied: false
|
|
|
|
- type: A
|
|
name: "@"
|
|
content: "185.199.109.153"
|
|
proxied: false
|
|
|
|
- type: A
|
|
name: "@"
|
|
content: "185.199.108.153"
|
|
proxied: false
|
|
|
|
- type: CNAME
|
|
name: id
|
|
content: "hanzo-id.pages.dev"
|
|
proxied: true
|
|
|
|
- type: CNAME
|
|
name: www
|
|
content: "zoo-labs.github.io"
|
|
proxied: false
|
|
|
|
- type: TXT
|
|
name: "_acme-challenge.mpc"
|
|
content: '3xcQ9lIkiW2iU0lB1f2ZSjLTo7G9StXvLC6jKR59B7M'
|
|
ttl: 120
|