dns: declare mpc.zoo.cloud, and let the sync use the credential we have

The zoo MPC nodes have served their API for as long as they have been up, with no name pointing at them. Nothing in an Ingress creates a record and no external-dns runs here, so the host existed only as far as the cluster. dns-sync.sh could not have created it either: it spoke only Bearer tokens, and what the estate has deployed for cert-manager is a global key with an email. It now takes whichever is present, preferring the token, so one credential serves both jobs instead of a second one being minted to do the same work. Proxied, like every other zoo.cloud host that resolves. The origin serves the ingress default certificate, so a direct record reaches a server whose certificate no client accepts -- on this zone TLS is terminated at the edge or it is not terminated at all. Co-authored-by: Hanzo Dev <[email protected]>
2026-08-28 12:41:42 -07:00
parent 5112622eb2
commit fef1df83d9
2 changed files with 25 additions and 4 deletions
@@ -48,6 +48,15 @@ records:
    content: "129.212.164.5"
    proxied: false

+  # proxied, like api: every zoo.cloud host that works is. The origin serves the
+  # ingress default certificate, so an unproxied name here reaches a server whose
+  # certificate no client will accept — TLS is terminated at the edge on this zone
+  # or it is not terminated by anything.
+  - type: A
+    name: mpc
+    content: "209.38.118.103"
+    proxied: true
+
  - type: A
    name: pay
    content: "129.212.164.5"
@@ -28,8 +28,10 @@ for arg in "$@"; do
 done

 CF_TOKEN="${CF_API_TOKEN:-${CLOUDFLARE_DNS_TOKEN:-}}"
-if [ -z "$CF_TOKEN" ] && [ "$DRY_RUN" = false ]; then
-  echo "ERROR: CF_API_TOKEN or CLOUDFLARE_DNS_TOKEN required for --apply"
+CF_EMAIL="${CF_API_EMAIL:-}"
+CF_KEY="${CF_API_KEY:-}"
+if [ -z "$CF_TOKEN" ] && [ -z "$CF_KEY" ] && [ "$DRY_RUN" = false ]; then
+  echo "ERROR: --apply needs either CF_API_TOKEN, or CF_API_EMAIL with CF_API_KEY"
  exit 1
 fi

@@ -79,6 +81,8 @@ zone_id = data['zone_id']
 records = data.get('records', [])
 dry_run = '$DRY_RUN' == 'true'
 token = '$CF_TOKEN'
+cf_email = '$CF_EMAIL'
+cf_key = '$CF_KEY'

 checked = 0
 drifted = 0
@@ -115,10 +119,18 @@ for r in records:
    drifted += 1
    print(f'  DRIFT: {fqdn} live={live or \"(none)\"} yaml={content}')

-    if not dry_run and token:
+    if not dry_run and (token or (cf_email and cf_key)):
        # Find existing record ID
        import urllib.request
-        headers = {'Authorization': f'Bearer {token}', 'Content-Type': 'application/json'}
+        # Cloudflare takes either a scoped API token or the account's global key,
+        # and which one the estate has is not this script's choice to make. A token
+        # is preferred because it can be scoped to one zone; the global key is
+        # accepted so the credential already deployed for cert-manager can drive a
+        # sync without a second credential being minted to do the same job.
+        if token:
+            headers = {'Authorization': f'Bearer {token}', 'Content-Type': 'application/json'}
+        else:
+            headers = {'X-Auth-Email': cf_email, 'X-Auth-Key': cf_key, 'Content-Type': 'application/json'}

        # List records matching this name
        url = f'https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records?type={rtype}&name={fqdn}'