@cryptotaxi247 / infra / commits / 6dfbfaf3

Kill DNS management over Terraform

Multiple issues led me to this decision: - We ran out of sync with what is shown in the Netlify UI and terraform doesn't notice - The provider has severe limitations: - No support for multiple values in an RRset - No support for MX priorities - No TTL configuration and likely others - The netlify provider we use for it is stale - A number of resources configured didn't even have any effect, like the `nixos_google_verification` at the end

Martin Weinelt committed Mar 29, 2025 at 03:50 UTC 6dfbfaf39de07057465be340657d462cad79afbb
1 file changed -510
terraform/dns.tf deleted
-510
@@ -1,510 +0,0 @@
1 -# Our DNS is managed by Netlify
2 -#
3 -# NOTES on the provider:
4 -#
5 -# * NETLIFY and NETLIFY6 resource types are missing because no support
6 -# * The TTL is 3600 everywhere because the "ttl" attribute is not supported
7 -# * The MX records both have 10 priority because no support
8 -
9 -locals {
10 - # Shortcut to keep this a bit leaner
11 - zone_id = netlify_dns_zone.nixos.id
12 -
13 - dns_records = [
14 - {
15 - hostname = "haumea.nixos.org"
16 - type = "A"
17 - value = "46.4.89.205"
18 - },
19 - {
20 - hostname = "haumea.nixos.org"
21 - type = "AAAA"
22 - value = "2a01:4f8:212:41c9::1"
23 - },
24 - {
25 - hostname = "makemake.ngi.nixos.org"
26 - type = "A"
27 - value = "116.202.113.248"
28 - },
29 - {
30 - hostname = "makemake.ngi.nixos.org"
31 - type = "AAAA"
32 - value = "2a01:4f8:231:4187::"
33 - },
34 - {
35 - hostname = "buildbot.ngi.nixos.org"
36 - type = "CNAME"
37 - value = "makemake.ngi.nixos.org"
38 - },
39 - {
40 - hostname = "hydra.ngi0.nixos.org"
41 - type = "CNAME"
42 - value = "makemake.ngi.nixos.org"
43 - },
44 - {
45 - hostname = "summer.nixos.org"
46 - type = "CNAME"
47 - value = "makemake.ngi.nixos.org"
48 - },
49 - {
50 - hostname = "ngi.nixos.org"
51 - type = "CNAME"
52 - value = "ngi-nix.github.io"
53 - },
54 - {
55 - hostname = "_github-pages-challenge-ngi-nix.ngi.nixos.org"
56 - type = "TXT"
57 - value = "4e8bffbb7ced2aec7be1f8cf3561d6"
58 - },
59 - {
60 - hostname = "hydra.nixos.org"
61 - type = "CNAME"
62 - value = "mimas.nixos.org"
63 - },
64 - {
65 - hostname = "staging-hydra.nixos.org"
66 - type = "A"
67 - value = "157.180.25.203"
68 - },
69 - {
70 - hostname = "staging-hydra.nixos.org"
71 - type = "AAAA"
72 - value = "2a01:4f9:c012:d5d3::1"
73 - },
74 - {
75 - hostname = "monitoring.nixos.org"
76 - type = "CNAME"
77 - value = "pluto.nixos.org"
78 - },
79 - {
80 - hostname = "pluto.nixos.org"
81 - type = "A"
82 - value = "37.27.99.100"
83 - },
84 - {
85 - hostname = "pluto.nixos.org"
86 - type = "AAAA"
87 - value = "2a01:4f9:3070:15e0::1"
88 - },
89 - {
90 - hostname = "alerts.nixos.org"
91 - type = "CNAME"
92 - value = "pluto.nixos.org"
93 - },
94 - {
95 - hostname = "prometheus.nixos.org"
96 - type = "CNAME"
97 - value = "pluto.nixos.org"
98 - },
99 - {
100 - hostname = "grafana.nixos.org"
101 - type = "CNAME"
102 - value = "pluto.nixos.org"
103 - },
104 - {
105 - hostname = "mimas.nixos.org"
106 - type = "AAAA"
107 - value = "2a01:4f8:2220:11c8::1"
108 - },
109 - {
110 - hostname = "mimas.nixos.org"
111 - type = "A"
112 - value = "157.90.104.34"
113 - },
114 - {
115 - hostname = "reproducible.nixos.org"
116 - type = "CNAME"
117 - value = "nixos.github.io"
118 - },
119 - {
120 - hostname = "_293364b7f7ebb076ac287cd132f8b316.cache.ngi0.nixos.org"
121 - type = "CNAME"
122 - value = "_6a75cfb0c20f4eaac96b72afaffb489b.auiqqraehs.acm-validations.aws"
123 - },
124 - {
125 - hostname = "_acme-challenge.channels.nixos.org"
126 - type = "CNAME"
127 - value = "9u55qij5w2odiwqxfi.fastly-validations.com"
128 - },
129 - {
130 - hostname = "_acme-challenge.releases.nixos.org"
131 - type = "CNAME"
132 - value = "s731ezp9ameh5f349b.fastly-validations.com"
133 - },
134 - {
135 - hostname = "_acme-challenge.tarballs.nixos.org"
136 - type = "CNAME"
137 - value = "vnqm62k5sjx9jogeqg.fastly-validations.com"
138 - },
139 - {
140 - hostname = "cache.ngi0.nixos.org"
141 - type = "CNAME"
142 - value = "d2tu257wv37zz1.cloudfront.net"
143 - },
144 - {
145 - hostname = "cache.nixos.org"
146 - type = "CNAME"
147 - value = "dualstack.v2.shared.global.fastly.net"
148 - },
149 - {
150 - hostname = "cache-staging.nixos.org"
151 - type = "CNAME"
152 - value = "dualstack.v2.shared.global.fastly.net"
153 - },
154 - {
155 - hostname = "channels.nixos.org"
156 - type = "CNAME"
157 - value = "dualstack.v2.shared.global.fastly.net"
158 - },
159 - {
160 - hostname = "discourse.nixos.org"
161 - type = "A"
162 - value = "195.62.126.31"
163 - },
164 - {
165 - hostname = "discourse.nixos.org"
166 - type = "AAAA"
167 - value = "2a02:248:101:62::146f"
168 - },
169 - {
170 - hostname = "discourse.nixos.org"
171 - type = "MX"
172 - value = "mail.nixosdiscourse.fcio.net."
173 - },
174 - {
175 - hostname = "discourse.nixos.org"
176 - type = "TXT"
177 - value = "v=spf1 ip4:185.105.252.151 ip6:2a02:248:101:62::1479 ~all"
178 - },
179 - {
180 - hostname = "_dmarc.discourse.nixos.org"
181 - type = "TXT"
182 - value = "v=DMARC1; p=none"
183 - },
184 - {
185 - hostname = "mail._domainkey.discourse.nixos.org"
186 - type = "TXT"
187 - value = "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDmxDhMfDl6lnueSRCjYiWIDeTAJXR9Yw0PfpBfG7GPUIkMyqy9jVGpb4ECVTt9S1zfpr4dbtCgir781oVwZiwGIWzC8y8XsD37wernQIPN4Yubnrnpw+6lill4uA/AuyU/ghbeZ5lW03pHD//2EW4YEu+Jw4aS4rF0Wtk+BlJRCwIDAQAB"
188 - },
189 - {
190 - hostname = "mobile.nixos.org"
191 - type = "CNAME"
192 - value = "nixos.github.io"
193 - },
194 - {
195 - hostname = "planet.nixos.org"
196 - type = "CNAME"
197 - value = "nixos-planet.netlify.app"
198 - },
199 - {
200 - hostname = "releases.nixos.org"
201 - type = "CNAME"
202 - value = "dualstack.v2.shared.global.fastly.net"
203 - },
204 - {
205 - hostname = "status.nixos.org"
206 - type = "CNAME"
207 - value = "nixos-status.netlify.app"
208 - },
209 - {
210 - hostname = "tarballs.nixos.org"
211 - type = "CNAME"
212 - value = "dualstack.v2.shared.global.fastly.net"
213 - },
214 - {
215 - hostname = "weekly.nixos.org"
216 - type = "CNAME"
217 - value = "nixos-weekly.netlify.com"
218 - },
219 - {
220 - hostname = "_github-challenge-nixos.nixos.org"
221 - type = "TXT"
222 - value = "9e10a04a4b"
223 - },
224 - {
225 - hostname = "nixos.org"
226 - type = "TXT"
227 - value = "apple-domain-verification=OvacO4lGB9A6dBFg"
228 - },
229 - {
230 - # hetzner ax162-r 2548595
231 - hostname = "elated-minsky.builder.nixos.org"
232 - type = "A"
233 - value = "167.235.95.99"
234 - },
235 - {
236 - hostname = "elated-minsky.builder.nixos.org"
237 - type = "AAAA"
238 - value = "2a01:4f8:2220:1b03::1"
239 - },
240 - {
241 - # hetzner ax162-r 2566166
242 - hostname = "sleepy-brown.builder.nixos.org"
243 - type = "A"
244 - value = "162.55.130.51"
245 - },
246 - {
247 - hostname = "sleepy-brown.builder.nixos.org"
248 - type = "AAAA"
249 - value = "2a01:4f8:271:5c14::1"
250 - },
251 - {
252 - hostname = "goofy-hopcroft.builder.nixos.org"
253 - type = "A"
254 - value = "135.181.225.104"
255 - },
256 - {
257 - hostname = "goofy-hopcroft.builder.nixos.org"
258 - type = "AAAA"
259 - value = "2a01:4f9:3071:2d8b::1"
260 - },
261 - {
262 - # hetzner m1 1638981
263 - hostname = "intense-heron.mac.nixos.org"
264 - type = "A"
265 - value = "23.88.75.215"
266 - },
267 - {
268 - # hetzner m1 1640609
269 - hostname = "sweeping-filly.mac.nixos.org"
270 - type = "A"
271 - value = "142.132.141.35"
272 - },
273 - {
274 - # hetzner m1 1640635
275 - hostname = "maximum-snail.mac.nixos.org"
276 - type = "A"
277 - value = "23.88.76.161"
278 - },
279 - {
280 - # hetzner m1 1643080
281 - hostname = "growing-jennet.mac.nixos.org"
282 - type = "A"
283 - value = "23.88.76.75"
284 - },
285 - {
286 - # hetzner m1 1643228
287 - hostname = "enormous-catfish.mac.nixos.org"
288 - type = "A"
289 - value = "142.132.140.199"
290 - },
291 -
292 - # oakhost m2
293 - {
294 - hostname = "eager-heisenberg.mac.nixos.org"
295 - type = "AAAA"
296 - value = "2a01:4f8:d1:a027::2"
297 - },
298 -
299 - # oakhost m2
300 - {
301 - hostname = "kind-lumiere.mac.nixos.org"
302 - type = "AAAA"
303 - value = "2a09:9340:808:60a::1"
304 - },
305 -
306 - {
307 - hostname = "20th.nixos.org"
308 - type = "CNAME"
309 - value = "20th-nix.pages.dev"
310 - },
311 - {
312 - hostname = "caliban.nixos.org"
313 - type = "AAAA"
314 - value = "2a01:4f9:5a:186c::2"
315 - },
316 - {
317 - hostname = "caliban.nixos.org"
318 - type = "A"
319 - value = "65.109.26.213"
320 - },
321 - {
322 - hostname = "chat.nixos.org"
323 - type = "CNAME"
324 - value = "caliban.nixos.org."
325 - },
326 - {
327 - hostname = "live.nixos.org"
328 - type = "CNAME"
329 - value = "caliban.nixos.org."
330 - },
331 - {
332 - hostname = "matrix.nixos.org"
333 - type = "CNAME"
334 - value = "caliban.nixos.org."
335 - },
336 - {
337 - hostname = "vault.nixos.org"
338 - type = "CNAME"
339 - value = "caliban.nixos.org"
340 - },
341 - {
342 - hostname = "tracker.security.nixos.org"
343 - type = "A"
344 - value = "188.245.41.195"
345 - },
346 - {
347 - hostname = "tracker.security.nixos.org"
348 - type = "AAAA"
349 - value = "2a01:4f8:1c1b:b87b::1"
350 - },
351 - {
352 - hostname = "caliban.nixos.org"
353 - type = "TXT"
354 - value = "v=spf1 ip4:65.109.26.213 ip6:2a01:4f9:5a:186c::2 ~all"
355 - },
356 - {
357 - hostname = "mail._domainkey.caliban.nixos.org"
358 - type = "TXT"
359 - value = "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDDCLtvNH4Ly+9COXf7InptMvoA7I5O347D7+j+saECt7RRe8yNz4TmhJTyJik+bg7e3+l7EJM0vE6k7xtpGBXACY6CCmg/8EgUi6YnDd126ttJHWpoqO96w4SWX93G+ZnoSC8O5rTPqdaTTkntYDTrw5u5n+7RA8GarZadgmaEzwIDAQAB"
360 - },
361 - {
362 - hostname = "_dmarc.caliban.nixos.org"
363 - type = "TXT"
364 - value = "v=DMARC1; p=none"
365 - },
366 - {
367 - hostname = "survey.nixos.org"
368 - type = "CNAME"
369 - value = "caliban.nixos.org"
370 - },
371 - {
372 - hostname = "nixpkgs-merge-bot.nixos.org"
373 - type = "A"
374 - value = "37.27.11.42"
375 - },
376 - {
377 - hostname = "nixpkgs-merge-bot.nixos.org"
378 - type = "AAAA"
379 - value = "2a01:4f9:c012:7615::1"
380 - },
381 - # nixpkgs-merge-bot-staging.nixos.org is currently hosted by helsinki systems
382 - {
383 - hostname = "nixpkgs-merge-bot-staging.nixos.org"
384 - type = "A"
385 - value = "37.27.197.11"
386 - },
387 - {
388 - hostname = "nixpkgs-merge-bot-staging.nixos.org"
389 - type = "AAAA"
390 - value = "2a01:4f9:c010:dd30::1"
391 - },
392 - {
393 - hostname = "umbriel.nixos.org"
394 - type = "A"
395 - value = "37.27.20.162"
396 - },
397 - {
398 - hostname = "umbriel.nixos.org"
399 - type = "AAAA"
400 - value = "2a01:4f9:c011:8fb5::1"
401 - },
402 - {
403 - hostname = "wiki.nixos.org"
404 - type = "A"
405 - value = "65.21.240.250"
406 - },
407 - {
408 - hostname = "wiki.nixos.org"
409 - type = "TXT"
410 - value = "v=spf1 ip4:65.21.240.250 ip6:2a01:4f9:c012:8178:: ~all"
411 - },
412 - {
413 - hostname = "mail._domainkey.wiki.nixos.org"
414 - type = "TXT"
415 - value = "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDa+KjIljYr3q5MWWK7sEYzjR8OcA32zBh9BCPo6/HlY1q2ODTYsmE/FDZWpYMzM5z+ddnuGYdXia322XnZaNpZNoq1TbGYuQ5DsgAEK09CGoLuzONg3PSXTrkG7E2Sd6wstwHGJ5FHxSLKtNoWkknt9F5XAFZgXapO0w54p+BWvwIDAQAB"
416 - },
417 - {
418 - hostname = "_dmarc.wiki.nixos.org"
419 - type = "TXT"
420 - value = "v=DMARC1; p=none"
421 - },
422 - {
423 - hostname = "wiki.nixos.org"
424 - type = "AAAA"
425 - value = "2a01:4f9:c012:8178::"
426 - },
427 -
428 - # Mailserver configuration for `nixos.org`
429 - # TODO: remove the 2 MX records for improvmx below in favor of this once
430 - # we're ready to switch to the new mailserver:
431 - # https://github.com/NixOS/infra/issues/485
432 - # {
433 - # hostname = "nixos.org"
434 - # type = "MX"
435 - # value = "umbriel.nixos.org"
436 - # },
437 - {
438 - hostname = "nixos.org"
439 - type = "TXT"
440 - # TODO: simplify to just a `mx` rule once umbriel is our one and only
441 - # mailserver:
442 - # https://github.com/NixOS/infra/issues/485
443 - # value = "v=spf1 mx ~all"
444 - value = "v=spf1 include:spf.improvmx.com a:umbriel.nixos.org ~all"
445 - },
446 - {
447 - hostname = "mail._domainkey.nixos.org"
448 - type = "TXT"
449 - # See `nixos.org.mail.key` in `non-critical-infra/modules/mailserver/default.nix`.
450 - value = "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDcgNq4+Y23GxN8Mdza437tL5DuJJZU1y6VzTCwSi6cBNLyBDci2cmqXx/gm1sA3yv7+h+8/OyJpEgcbCIW/Ygs1XLuECqvXVX8MU6Djn4KY+d2sU1tlUdqvNM86puoneQtjEv9rDsjf3HGqaeOcjetFnQW7H+qcNcaEShxyKztzQIDAQAB"
451 - },
452 - {
453 - hostname = "_dmarc.nixos.org"
454 - type = "TXT"
455 - value = "v=DMARC1; p=none"
456 - },
457 - ]
458 -}
459 -
460 -resource "netlify_dns_zone" "nixos" {
461 - site_id = ""
462 - name = "nixos.org"
463 -}
464 -
465 -resource "netlify_dns_record" "nixos" {
466 - for_each = { for v in local.dns_records : "${v.hostname}-${v.type}" => v }
467 - zone_id = local.zone_id
468 - hostname = each.value.hostname
469 - type = each.value.type
470 - value = each.value.value
471 -}
472 -
473 -### TODO: remove, see https://github.com/NixOS/infra/issues/485 ###
474 -# MX records both have the same hostname and type and would clash on the above
475 -# mapping.
476 -resource "netlify_dns_record" "nixos_MX1" {
477 - zone_id = local.zone_id
478 - hostname = "nixos.org"
479 - type = "MX"
480 - value = "mx1.improvmx.com"
481 -}
482 -
483 -resource "netlify_dns_record" "nixos_MX2" {
484 - zone_id = local.zone_id
485 - hostname = "nixos.org"
486 - type = "MX"
487 - value = "mx2.improvmx.com"
488 -}
489 -
490 -resource "netlify_dns_record" "nixos_DKIM1" {
491 - zone_id = local.zone_id
492 - hostname = "dkimprovmx1._domainkey.nixos.org"
493 - type = "CNAME"
494 - value = "dkimprovmx1.improvmx.com"
495 -}
496 -
497 -resource "netlify_dns_record" "nixos_DKIM2" {
498 - zone_id = local.zone_id
499 - hostname = "dkimprovmx2._domainkey.nixos.org"
500 - type = "CNAME"
501 - value = "dkimprovmx2.improvmx.com"
502 -}
503 -### END TODO: remove ###
504 -
505 -resource "netlify_dns_record" "nixos_google_verification" {
506 - zone_id = local.zone_id
507 - hostname = "nixos.org"
508 - type = "TXT"
509 - value = "google-site-verification=Pm5opvmNjJOwdb7JnuVJ_eFBPaZYWNcAavY-08AJoGc"
510 -}