Fix 521: add missing dofek.asherlc.com DNS record + CI check - #896
Conversation
The dofek.asherlc.com A record was managed by the homelab repo's OpenTofu with a wrong hardcoded IP (159.69.3.40 instead of 157.90.25.125), causing Cloudflare to return 521. - Add dofek.asherlc.com A record to deploy/dns.tf pointing to the Hetzner server dynamically via hcloud_server.dofek.ipv4_address - Add scripts/check-dns-records.sh CI check that validates every Traefik Host() domain has a matching DNS record in dns.tf - Wire check into quality-gate in test.yml Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Storybook previews for This comment updates automatically on each PR push. |
Mobile PreviewScan to open on device:
To test on device:
|
There was a problem hiding this comment.
Pull request overview
Adds missing Cloudflare DNS coverage for dofek.asherlc.com and introduces a CI guard to prevent future drift between Traefik Host() rules and Terraform-managed DNS records.
Changes:
- Add Cloudflare A record for
dofek.asherlc.compointing to the Hetzner server IPv4 (proxied). - Add
scripts/check-dns-records.shto ensure every TraefikHost(\...`)domain appears indeploy/dns.tf`. - Add a new
check-dns-recordsjob to the GitHub Actions workflow and include it in the quality-gate dependencies.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
scripts/check-dns-records.sh |
New CI script to cross-check Traefik Host() domains against Terraform DNS records. |
deploy/dns.tf |
Adds the missing dofek.asherlc.com Cloudflare DNS record to be Terraform-managed. |
.github/workflows/test.yml |
Adds a dedicated CI job to run the DNS coverage check and wires it into the workflow’s quality-gate dependencies. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # Extract all hostnames from Traefik Host(`...`) labels (portable, no -P flag) | ||
| hosts=$(sed -n 's/.*Host(`\([^`]*\)`).*/\1/p' "$COMPOSE" | tr '|' '\n' | sed -n 's/.*Host(`\([^`]*\)`).*/\1/p; s/^[[:space:]]*//p' | sort -u) | ||
| # The compose file uses || between Host() rules on a single line, so also split those |
There was a problem hiding this comment.
hosts is assigned twice; the first extraction pipeline is immediately overwritten by the second assignment, so those lines are dead code and can drift from the real behavior. Remove the unused assignment/comment and keep a single, correct Host() extraction implementation.
| # Extract all hostnames from Traefik Host(`...`) labels (portable, no -P flag) | |
| hosts=$(sed -n 's/.*Host(`\([^`]*\)`).*/\1/p' "$COMPOSE" | tr '|' '\n' | sed -n 's/.*Host(`\([^`]*\)`).*/\1/p; s/^[[:space:]]*//p' | sort -u) | |
| # The compose file uses || between Host() rules on a single line, so also split those | |
| # Extract all hostnames from Traefik Host(`...`) labels and deduplicate them |
There was a problem hiding this comment.
Fixed in 9c9330c6. Removed the dead first hosts= assignment that was immediately overwritten by the second one.
| # Check dns.tf has a record whose name matches this host (literal string or via zone reference) | ||
| # For bare domains like "dofek.fit", the name field is just "dofek.fit" | ||
| # For subdomains like "dofek.asherlc.com", the name field is "dofek.asherlc.com" | ||
| if ! grep -q "\"$host\"" "$DNS_TF"; then |
There was a problem hiding this comment.
grep -q "\"$host\"" treats the pattern as a regex, so dots in hostnames are wildcards and can create false matches. Use fixed-string matching (e.g., grep -Fq) to ensure each Host() domain is checked literally against dns.tf.
| if ! grep -q "\"$host\"" "$DNS_TF"; then | |
| if ! grep -Fq "\"$host\"" "$DNS_TF"; then |
There was a problem hiding this comment.
Fixed in 9c9330c6. Switched to grep -Fq for fixed-string matching.
| quality-gate: | ||
| name: Lint & Static Analysis | ||
| needs: [actionlint, lint, typecheck, sherif, knip, spellcheck, import-boundaries, python-checks, hadolint, terraform-validate, swiftlint, periphery] | ||
| needs: [actionlint, lint, typecheck, sherif, knip, spellcheck, import-boundaries, python-checks, hadolint, terraform-validate, check-dns-records, swiftlint, periphery] | ||
| if: always() |
There was a problem hiding this comment.
quality-gate now depends on check-dns-records, but the "Check results" loop does not include ${{ needs.check-dns-records.result }}. If branch protection only requires the quality-gate job, a failing DNS coverage check could be missed; add that result to the loop (or otherwise assert it) so it truly gates.
There was a problem hiding this comment.
Fixed in 9c9330c6. Added ${{ needs.check-dns-records.result }} to the quality-gate check loop.
- Remove dead first `hosts=` assignment that was immediately overwritten - Use `grep -Fq` instead of `grep -q` to avoid regex dot-matching in hostnames - Add `check-dns-records` result to the quality-gate check loop Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Summary
dofek.asherlc.comA record todeploy/dns.tfpointing tohcloud_server.dofek.ipv4_address(proxied)scripts/check-dns-records.shCI check that validates every TraefikHost()domain has a matching DNS record indns.tftest.ymlRoot cause
The
dofek.asherlc.comDNS record was managed by the homelab repo's OpenTofu with a hardcoded wrong IP (159.69.3.40instead of157.90.25.125). Cloudflare proxied traffic to the dead IP → 521.The record was missing from this repo's Terraform because it was assumed to be managed by the homelab. The homelab commit on Apr 12 (Portainer + Authentik) ran
tofu applywhich reasserted the wrong IP.Fix
159.69.3.40→157.90.25.125) — site is live againterraform/main.tf(separate PR)Test plan
scripts/check-dns-records.shpasses with the new recorddns.tf(verified withgit stash)pnpm lintpassescurl https://dofek.asherlc.com/settingsreturns 200🤖 Generated with Claude Code