Wanjohi e3c9416170 docs(dns): the origin is a tunnel, and there is nothing to cut over from ...

`After the move off Workers` described proxied `A` records to the host and an
ordering to avoid a gap while Worker routes were removed. Both are wrong.

There is no `A` record because there is no address to publish: each name is a
proxied CNAME to the tunnel, and the machine's address appears nowhere. And
there is no ordering problem because `api.nestri.io` and `auth.nestri.io` have
no DNS records and do not resolve — only the sandbox pair was ever deployed, so
these names are created for the first time with no window to protect.

The `nestri.link` section promised an origin certificate as the one key on our
host. There is no key on our host at all. Measured 2026-09-16: a public HTTPS
request served correctly while nothing listened on 443 or 8443 and both origins
spoke plain HTTP on loopback; the certificate was Cloudflare's, covering the
apex and one level, and a two-label name was refused at the handshake with no
certificate presented.

2026-09-16 21:57:20 +03:00

..

deploy.md

fix(deploy): require every credential, and give sandbox its own domain

2026-09-05 15:58:21 +03:00

dns.md

docs(dns): the origin is a tunnel, and there is nothing to cut over from

2026-09-16 21:57:20 +03:00