f30a1432f8
Three things review caught, and one shape correction. **No credential has a default any more.** The compose file shipped `ADMIN_SHARED_SECRET` falling back to a value written in this repository — and that header bypasses token verification entirely, so anyone reading the file could act as an operator against any deployment that had not overridden it. A default is worth less than it looks here: the deployment that never set the variable is exactly the one where the default is public. Every credential now comes from `.env`, and compose refuses to start naming the variable it wanted. That also takes the last literal password out of a tracked file. **The origin ports are on loopback.** Both services speak plain HTTP and mark no cookie `Secure`, because both expect to sit behind something that terminates TLS. Published on every interface they were a way to reach the issuer around that proxy, with sign-in codes and tokens in clear text. **Mail settings are passed through rather than fixed.** The issuer was pinned to printing sign-in codes to its log, and the three delivery settings never reached it — so the documented way to configure mail could not work, and every code and recipient went to the container log instead. Printing codes is now asked for in `.env` like everything else, and with nothing configured the issuer refuses to send rather than logging. **Sandbox becomes a domain rather than a prefix.** `api.sandbox.nestri.io` and `auth.sandbox.nestri.io`, because sandbox holds whatever is not production and that set grows. One certificate for `*.sandbox.nestri.io` then covers all of it, including unpredictable per-pull-request names, and cannot be presented for production's own domain — which the zone-wide wildcard the previous shape leaned on could. Also drops `STEAM_API_KEY`. It was declared in two type definitions and read by nothing: linking an account makes no outbound call that needs it.
4.9 KiB
DNS
Cloudflare holds the zones. Once the control plane moves off Workers that is the only thing it holds, so this file is deliberately written to survive the move: it says what each name is for, and treats what currently answers it as a detail that changes.
There is no infrastructure-as-code here, on purpose. There are six records.
They change roughly never, they outlive several generations of whatever serves
them, and the failure mode of getting one wrong is that sign-in stops working
for everybody — which is a thing to do slowly, by hand, having read this table,
rather than as a side effect of a deploy. What is automated is only the part
that must stay in step with a deploy: while the control plane is a set of
Workers, wrangler creates and owns the four control-plane records itself,
because a route and its hostname are one fact and splitting them across two
tools is how they drift.
The rule
A domain gets one certificate, obtained once, and it covers that domain and
nothing else. Names are then grouped so that the grouping is the same shape
as the certificate: production sits directly under nestri.io, and everything
that is not production sits under sandbox.nestri.io.
That is why the sandbox names are nested rather than hyphenated. sandbox is a
domain, not a prefix — it holds whatever is not production, which today is the
API and the issuer and later is more. Once the shape is a domain, a single
certificate for *.sandbox.nestri.io covers all of it, including per-pull-
request deployments at pr-<id>.sandbox.nestri.io if those ever arrive; those
would be unbounded and unpredictable names, which is precisely the case that a
name-by-name certificate cannot serve and a domain-wide one can.
It also means a certificate that can be presented for a sandbox name cannot be
presented for api.nestri.io. Leaning on the zone-wide *.nestri.io instead
would have given every scratch deployment a certificate for production's own
domain, which is the opposite of what a sandbox is for.
Nothing extra is needed while these are Workers — a custom domain is issued its own certificate for the exact hostname, at any depth. The rule binds on the day they become origins, and it is written down now because that is the day it is expensive to have got wrong.
nestri.io
| Name | What it is | Answered today by |
|---|---|---|
nestri.io |
The website, and ssh nestri.io |
Website |
api.nestri.io |
The API, production | Worker custom domain |
auth.nestri.io |
The issuer, production | Worker custom domain |
doctor.nestri.io |
Where nesdoctor is downloaded |
Static site |
sandbox.nestri.io
Everything that is not production, under one domain and one certificate.
| Name | What it is | Answered today by |
|---|---|---|
api.sandbox.nestri.io |
The API, sandbox | Worker custom domain |
auth.sandbox.nestri.io |
The issuer, sandbox | Worker custom domain |
auth.nestri.io is the one name in either table that cannot be changed
casually. A token carries the address it was minted through in its iss claim,
and every API request verifies that claim literally — so renaming the issuer
invalidates every token in circulation at once, including the refresh tokens
that would otherwise have recovered from it. The sandbox issuer has the same
property and none of the consequences, which is the point of having one.
After the move off Workers
Each of the four control-plane names becomes a proxied A record pointing at
the host running the containers, and nothing else about them changes: same
names, same iss claim. Cloudflare keeps terminating public TLS, so there is
no certificate on our own host to renew, and the origin is not addressable
except through the proxy.
The order that matters, on the day: create the A records with the proxy on,
confirm the containers answer through them, then remove the Worker routes.
Doing it the other way leaves a window where the name resolves to nothing.
nestri.link
A second zone, reserved and not yet serving anything. It exists so that a
per-box hostname — one name, one box, the address a person opens to set their
box up — never has to live under nestri.io beside the control plane. Two
reasons, both of which get worse to fix later than to decide now: a box serves
content we do not write, and cookie scope is a property of the registrable
domain, so a name under nestri.io would put that content inside the same
cookie boundary as sign-in.
*.nestri.link will be proxied for the same reason the control plane is: the
public certificate stays Cloudflare's, and the only key on our own host is an
origin certificate that is useless anywhere else.