KNEL/PFVCluster
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(dns): zone-snapshot tooling + sync rule; refresh stale snapshots [#630][#728]

Browse Source 
Founder rule: every Technitium/DNS/DHCP change ends with a same-session
SoR sync — zone-snapshot.sh then drift-check green, then commit. Added
the tool (tar-pulls the DZ store from the primary via the chokepoint),
wrote the rule into AGENTS.md (DNS change discipline + Key Scripts rows),
refreshed 4 stale snapshots (knel.net, 1/3.168.192 reverse, 119.70.100
— incl. the deleted ultix-offstage PTR). drift-check: ALL IN SYNC.
Also: last tsrouter mentions retired (AGENTS.md, setup.sh header).
This commit is contained in:
mrcharles
2026-09-02 20:19:23 -05:00
parent c2b7c91079
commit 1dbf16c9df
7 changed files with 76 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AGENTS.md
+17 -2
View File
@@ -378,7 +378,7 @@ vendor/ Vendored KNELShellFramework
through the chokepoint scripts — [`tests/remote.sh`](tests/remote.sh)
(Proxmox hosts + all VMs) or
[`netinfra/dns-cluster-setup/remote-dns.sh`](netinfra/dns-cluster-setup/remote-dns.sh)
(DNS infra hosts: netinfra-01/02, tsrouter, netboot). NEVER call
(DNS infra hosts: netinfra-01/02, netboot). NEVER call
`ssh`/`scp` directly — the harness blocks raw ssh and the command scanner
rejects it. There are no exceptions.
- **DNS names ONLY (NON-NEGOTIABLE):** NEVER use IP address literals
@@ -444,6 +444,19 @@ an AWX playbook item.** The fleet converges to 100% IaC (founder mandate,
- New manual fixes during incidents: fix first, codify immediately after.
- Playbooks live in this repo, tested through the `sectestbed-*` fleet.
## DNS change discipline (NON-NEGOTIABLE)
**Any change to Technitium records/zones (dns-cli or API), dhcpd, or the
live DNS/DHCP configs MUST end with a same-session git SoR sync.**
Founder rule, 2026-09-02 — drift-check exists because git went stale; do
not reopen that gap:
1. Make the change (serial + health-gated across the redundant pair).
2. `bash netinfra/dns/technitium/zone-snapshot.sh` — refresh the DZ
snapshots from the primary.
3. `bash netinfra/dns/drift-check.sh` — must print `ALL IN SYNC`.
4. Commit + push the refreshed snapshots in the same session.
## Redmine Tracking Policy
**Redmine is the system of record for all work.** Do not track status,
@@ -570,7 +583,9 @@ live in the centralized store at `~/.creds/discourse.env`.
| [`scripts/check-rules.sh`](scripts/check-rules.sh) | Rule audit engine (shellcheck, image pinning, Discourse pointers, required files) |
| [`scripts/setup-hooks.sh`](scripts/setup-hooks.sh) | Install git hooks (pre-commit, pre-push) |
| [`tests/remote.sh`](tests/remote.sh) | **SSH chokepoint** — all Proxmox host + sandbox VM access routes here |
| [`netinfra/dns-cluster-setup/remote-dns.sh`](netinfra/dns-cluster-setup/remote-dns.sh) | SSH chokepoint for DNS infra hosts (netinfra-01/02, tsrouter, netboot) |
| [`netinfra/dns-cluster-setup/remote-dns.sh`](netinfra/dns-cluster-setup/remote-dns.sh) | SSH chokepoint for DNS infra hosts (netinfra-01/02, netboot) |
| [`netinfra/dns/technitium/zone-snapshot.sh`](netinfra/dns/technitium/zone-snapshot.sh) | Refresh git SoR Technitium zone snapshots from the primary — **required after every DNS change** |
| [`netinfra/dns/drift-check.sh`](netinfra/dns/drift-check.sh) | Live-vs-git drift audit for DHCP/DNS/NTP/zones — must be green before any DNS-adjacent push |
| `redmine-cli` container | Redmine CLI (ticket read/write via `docker run`; see `tooling-cli/redmine/`) |
| `discourse-cli` container | Discourse CLI (wiki topic read/write via `docker run`; see `tooling-cli/discourse/`) |
| `dns-cli` container | Technitium DNS CLI (zones, list, add, delete, search, flush; see `tooling-cli/dns/`) |