Frank
9bfa0be85d
- 31 new managed skills (anubis/arr/authentik/hermes/freetoken/podman/llm-swap runbooks etc.) now tracked. - Removed superseded skills: omp_harness_config, peon_ping_integration (replaced by user-authored peon-ping-* managed skills), rocmfp4-strix-benchmark-orchestration. - New memory-root skills: niri_compositor_ops, omp_git_workflow, omp_model_config, quadlet-media-migration, homelab-service-triage, hermes-dankclaw-ops, frank-default-large-ops, caddy-auth-dns-playbook.
2.8 KiB
2.8 KiB
name, description
| name | description |
|---|---|
| porkbun-dns-ops | Runbook for mutating Porkbun DNS records for franksdank.cloud via API from the target host, covering the relative-name edit quirk, rate-limit failure shape, and verify steps. |
Porkbun DNS ops (franksdank.cloud)
Operate the public DNS zone for franksdank.cloud via the Porkbun API v3, run on Dankclaw so the API key/secret sourced from /home/dank/serverAppConfigs/.env (PORKBUN_API_KEY, PORKBUN_API_SECRET_KEY) never leaves the host. Pipe scripts to the target with ssh -o BatchMode=yes dankclaw 'bash -s' < /tmp/script.sh.
Endpoints (all POST, JSON body)
- List:
https://api.porkbun.com/api/json/v3/dns/retrieve/franksdank.cloud— auth via headersX-API-Key+X-Secret-API-Key(Bearer is wrong here). Response shape is top-level.records[], NOT.content.records[]as some docs claim — parse withjq -r '.records[] | [.id,.name,.type,.content,(.ttl|tostring)] | @tsv'. - Delete:
/dns/delete/{domain}/{id}(body carries apikey+secretapikey). - Edit:
/dns/edit/{domain}/{id}— pass the full record (id,name,type,content,ttl,prio).
Quirks that bite (verified live 2026-08-31)
nameis a RELATIVE label on edit. Passingai.franksdank.cloudyields the recordai.franksdank.cloud.franksdank.cloud. Pass the bare label (ai) and the API appends the zone itself. Verify after every rename with a retrieve before declaring done.- Rate limit answers as an HTML 404-style page, not JSON. A batch of rapid mutations makes some calls return
<!DOCTYPE html>...where jq then errors (Cannot iterate over null/Invalid numeric literal). Do not assume the call succeeded — sleep ~8 s and retry the failed ids; verify by re-listing the zone at the end. - Deletes/renames are per-record-id: always retrieve first, map name→id, then mutate by id.
Rename procedure (vhost rename = DNS + Caddy together)
retrieve→ collect ids for the renamed names.editeach id with the new relative label, preserving type/content/ttl.- Re-retrieve and confirm
<new>.franksdank.cloud A <ip>. - In-repo lockstep before deploy: rename the Caddyfile vhost block AND the Pi-hole
dankclaw/pihole/addn-hostsline in the same commit — test 178 (tests/pihole.bats) fails the suite if any Caddyfile vhost lacks an addn-hosts A record on 192.168.0.143. - Deploy via
scripts/deploy.sh dankclaw(plans pihole+caddy from changed paths). Capture the suite's true exit without=$(./tests/run.sh 2>&1); rc=$?— piping totailmasks the exit code behindtail's own status and has shipped untested commits here. - Verify live:
dig +short <name> @192.168.0.143thencurl -o /dev/null -w %{http_code} https://<new-name>(expect 200/302; first hit triggers dns-01 issuance, which works without inbound port 80).