zeekayandHanzo Dev
a25c1e3042
Three records added alongside the sweep still named a retired address. Same treatment as the rest of the zone: the origin the edge forwards to, proxied. Co-authored-by: Hanzo Dev <[email protected]>
106 lines
3.2 KiB
YAML
106 lines
3.2 KiB
YAML
# zoo-network.yaml — Cloudflare zone config for zoo.network
|
|
# Zone ID: d9c81c5b54f0f713105d483ddbd61656
|
|
# Source of truth for zoo.network DNS records
|
|
# Last synced: 2026-03-24 (apex + www moved off GitHub Pages; see runbook)
|
|
---
|
|
zone: zoo.network
|
|
zone_id: "d9c81c5b54f0f713105d483ddbd61656"
|
|
|
|
records:
|
|
- type: A
|
|
name: api-explore
|
|
content: "174.160.143.53"
|
|
proxied: true
|
|
|
|
- type: A
|
|
name: api-explorer
|
|
content: "174.160.143.53"
|
|
proxied: true
|
|
|
|
- type: A
|
|
name: api
|
|
content: "174.160.143.53"
|
|
proxied: true
|
|
|
|
- type: A
|
|
name: exchange
|
|
content: "174.160.143.53"
|
|
proxied: true
|
|
|
|
- type: A
|
|
name: explore
|
|
content: "174.160.143.53"
|
|
proxied: true
|
|
|
|
- type: A
|
|
name: iam
|
|
content: "174.160.143.53"
|
|
proxied: true
|
|
|
|
- type: A
|
|
name: mpc-api
|
|
content: "174.160.143.53"
|
|
proxied: true
|
|
|
|
- type: A
|
|
name: mpc
|
|
content: "174.160.143.53"
|
|
proxied: true
|
|
|
|
- type: A
|
|
name: status
|
|
content: "174.160.143.53"
|
|
proxied: true
|
|
|
|
# THE APEX. One A record at the hanzo-k8s ingress load balancer, which serves
|
|
# zoo.network from the Zoo site prefix in object storage. It replaced FOUR A
|
|
# records at GitHub Pages (185.199.108-111.153).
|
|
#
|
|
# ONE record, not four. Cloudflare round-robins every A record at a name, so
|
|
# leaving even one Pages address behind sends a fraction of visitors to the old
|
|
# origin — a site that is right three times out of four is the hardest kind of
|
|
# break to see, because every check passes on some attempts.
|
|
#
|
|
# proxied: false, matching what this apex has always been. Orange-clouding it
|
|
# would be a second change riding along with the cutover: it swaps which
|
|
# certificate the visitor sees and puts a cache in front of the origin, neither
|
|
# of which can be verified ahead of time from outside the Cloudflare account.
|
|
# The Let's Encrypt certificate at the edge already covers this exact name.
|
|
#
|
|
# ⚠ sync.sh CANNOT APPLY THIS RECORD. It skips the apex outright
|
|
# (`if name == "@": continue`), it never deletes anything, and when several
|
|
# records share a name it patches only the first. Running it here reports
|
|
# "Checked: N, Drifted: 0" and changes nothing, which reads like a successful
|
|
# sync. The apex cutover is the explicit Cloudflare API call in the runbook;
|
|
# this file records the intended state, and sync.sh keeps the SUBDOMAINS honest.
|
|
- type: A
|
|
name: "@"
|
|
content: "174.160.143.53"
|
|
proxied: true
|
|
|
|
# A staging name for the same origin, so the new serving path can be driven
|
|
# with real DNS, real SNI and a real browser before the apex moves. Covered by
|
|
# the existing *.zoo.network certificate. Delete it, and its route, once the
|
|
# apex is settled.
|
|
- type: A
|
|
name: preview
|
|
content: "174.160.143.53"
|
|
proxied: true
|
|
|
|
- type: CNAME
|
|
name: id
|
|
content: "hanzo-id.pages.dev"
|
|
proxied: true
|
|
|
|
# www follows the apex to the same origin. The route matches both names, so
|
|
# they serve identically rather than one redirecting to the other.
|
|
- type: A
|
|
name: www
|
|
content: "174.160.143.53"
|
|
proxied: true
|
|
|
|
- type: TXT
|
|
name: "_acme-challenge.mpc"
|
|
content: '3xcQ9lIkiW2iU0lB1f2ZSjLTo7G9StXvLC6jKR59B7M'
|
|
ttl: 120
|