Repository navigation
Resolve W3BS as a separate configured Moshpit instance - #146
Merged
Merged
Conversation
Signed-off-by: Anthony Ettinger <anthony@chovy.com>
ThreatCrush Security Scan31 finding(s) HIGH/CRITICAL: 3 | MEDIUM: 26 | LOW: 2
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The running Moshpit DNS bridge only queried the primary registry, so an active W3BS name under dumb.fuck.w3bs.org fell through to public parking. Add explicit instance realm configuration and a W3BS default: query its own name and DNS-record APIs, keep bare primary-network names separate, and route active instance names to their gateway or custom AAAA/CNAME/MX/TXT records. Instance authority applies before public parking in that configured realm. Suspended names return NXDOMAIN and instance outages SERVFAIL; no ownership is imported into the primary registry. Bound CNAME recursion and coalesce/cache instance reads.
Validation: 293 tests passed, including 67 DNS tests; TypeScript passed. Regression covers gateway resolution over a parked public answer, realm/registry isolation, custom AAAA/MX/multibyte TXT/CNAME, suspension, instance outage and CNAME loops. Existing primary resolver behavior remains covered. Public registrar DNS and trusted HTTPS certificates remain separate deployment gates.
Deployment note: dev2's DNS service runs an unversioned snapshot in /home/anthony/moshpit-dns. Apply the narrow server/entrypoint patch after context checks and back up the snapshot; preserve its unrelated server changes.