zeekayandHanzo Dev
e8aa0c89b3
Records across these zones named an address this estate does not answer on. Each now names the origin the edge forwards to. They are proxied deliberately: Cloudflare answers, the origin is reached only from Cloudflare, and the address never appears in a public answer. Unproxied, a record both publishes the origin and makes a reassigned address a live takeover of the name. Co-authored-by: Hanzo Dev <[email protected]>
79 lines
2.0 KiB
YAML
79 lines
2.0 KiB
YAML
# zoo-cloud.yaml — Cloudflare zone config for zoo.cloud
|
|
# Zone ID: 5f505170d0c1aedfee20dd20c2eeb413
|
|
# Source of truth for zoo.cloud DNS records
|
|
#
|
|
# The .cloud zones had no file here at all, which is how exchange.zoo.cloud came
|
|
# to be a host with an Ingress, a certificate and a green CD sync and no way to
|
|
# reach it: this zone has no wildcard, so the name simply did not resolve. There
|
|
# is nothing in an Ingress that creates a record — no external-dns runs on this
|
|
# cluster — so a new .cloud host is not live until it appears below AND in
|
|
# Cloudflare.
|
|
#
|
|
# exchange -> 134.199.138.27 is lux-system/hanzo-ingress, the lux-k8s
|
|
# LoadBalancer, the same address exchange.lux.cloud points at. Unproxied, like
|
|
# its Lux counterpart: the exchange-api sends its own CORS headers and an edge
|
|
# in front of it is one more thing that can write them a second time.
|
|
---
|
|
zone: zoo.cloud
|
|
zone_id: "5f505170d0c1aedfee20dd20c2eeb413"
|
|
|
|
records:
|
|
- type: A
|
|
name: admin
|
|
content: "174.160.143.53"
|
|
proxied: true
|
|
|
|
- type: A
|
|
name: api
|
|
content: "209.38.118.103"
|
|
proxied: true
|
|
|
|
- type: AAAA
|
|
name: api
|
|
content: "2604:a880:4:1d0:0:2:9994:3000"
|
|
proxied: true
|
|
|
|
- type: A
|
|
name: console
|
|
content: "174.160.143.53"
|
|
proxied: true
|
|
|
|
- type: A
|
|
name: exchange
|
|
content: "174.160.143.53"
|
|
proxied: true
|
|
|
|
- type: A
|
|
name: kms
|
|
content: "174.160.143.53"
|
|
proxied: true
|
|
|
|
# mpc.zoo.cloud is served by lux-mpc on the lux cluster, exactly like
|
|
# mpc.zoo.network and mpc.pars.network — one MPC deployment answering for
|
|
# every org rather than one per cluster. Unproxied, because that ingress
|
|
# terminates TLS itself.
|
|
- type: A
|
|
name: mpc
|
|
content: "174.160.143.53"
|
|
proxied: true
|
|
|
|
- type: A
|
|
name: pay
|
|
content: "174.160.143.53"
|
|
proxied: true
|
|
|
|
- type: A
|
|
name: s3
|
|
content: "174.160.143.53"
|
|
proxied: true
|
|
|
|
- type: CNAME
|
|
name: www
|
|
content: "web3.zoo.ngo"
|
|
proxied: true
|
|
|
|
- type: A
|
|
name: zoo.cloud
|
|
content: "174.160.143.53"
|
|
proxied: true
|