patchworklabs.org.yaml

# CAA: the CAs that can issue certificates for the zone. A CAA record also covers
# every name below it. Let's Encrypt: Vercel (www, weave-kyc-proposal), the
# thimble VPN (vpn) and the Traefik origin certificates on alastor. The other
# three: Cloudflare Universal SSL for the proxied names. iodef is where a CA
# reports a refused request.
"": # @patchworklabsorg/infra
  - ttl: 120
    type: MX
    values:
      - exchange: aspmx.l.google.com.
        preference: 1
      - exchange: alt1.aspmx.l.google.com.
        preference: 5
      - exchange: alt2.aspmx.l.google.com.
        preference: 5
      - exchange: alt3.aspmx.l.google.com.
        preference: 10
      - exchange: alt4.aspmx.l.google.com.
        preference: 10
  - ttl: 3600
    type: CAA
    values:
      - flags: 0
        tag: iodef
        value: mailto:security@patchworklabs.org
      - flags: 0
        tag: issue
        value: letsencrypt.org
      - flags: 0
        tag: issue
        value: pki.goog
      - flags: 0
        tag: issue
        value: sectigo.com
      - flags: 0
        tag: issue
        value: ssl.com
  - ttl: 120
    type: TXT
    values:
      - google-site-verification=OjTBuEBXcUdIOVzjidh1sCMfvAYvabpQWnkGfFFQQA4
      - Owned by Patchwork Labs Inc (patchworklabs.org) a registered 501(c)(3) nonprofit organization.
      - v=spf1 include:_spf.google.com ~all
      - slack-domain-verification=ST5I2hJgX8CutN19stoedtub8ODxC2KwlHcbpKtb
      - stripe-verification=2EACE39B000887BB0491EB25506F91621A1E1097C9DE7C5C7C9E4E9F8701137E
  - octodns:
      cloudflare:
        proxied: true
    ttl: 120
    type: A
    value: 216.198.79.1

_atproto: # @patchworklabsorg/infra
  ttl: 120
  type: TXT
  value: did=did:plc:bpd7j2a34mmnyu7t64gzptg7

_dmarc: # @patchworklabsorg/infra
  ttl: 120
  type: TXT
  value: v=DMARC1\; p=quarantine\; np=reject\; rua=mailto:dmarc_reports@patchworklabs.org\; ruf=mailto:dmarc_reports@patchworklabs.org\; adkim=s\; aspf=s

# Customer.io sending domain (Mailgun)
_dmarc.cio: # PWL7A1CE1F3CB / jasper@patchworklabs.org
  ttl: 3600
  type: TXT
  value: v=DMARC1\; p=quarantine\; np=reject\; rua=mailto:dmarc_reports@patchworklabs.org\; ruf=mailto:dmarc_reports@patchworklabs.org\; adkim=s\; aspf=s

_gh-patchworklabsorg-o: # @patchworklabsorg/infra
  type: TXT
  value: cee2c56f89

cio160924.cio: # PWL7A1CE1F3CB / jasper@patchworklabs.org
  - ttl: 300
    type: MX
    values:
      - exchange: mxa.mailgun.org.
        preference: 10
      - exchange: mxb.mailgun.org.
        preference: 10
  - ttl: 3600
    type: TXT
    value: v=spf1 include:mailgun.org ~all

cio._domainkey.cio160924.cio: # PWL7A1CE1F3CB / jasper@patchworklabs.org
  ttl: 3600
  type: TXT
  value: k=rsa\; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0eVU0HCCkUK5FPCvMoX03lgTqTNWEkYA61pKilwmMif+B/L+AlLqQVywt22RLAWCpiJv3hRUFi4UmdXbAZzWjhVY5Mem8F1XqWvu6Xv1yAIC08tX+3vMH+5gdp/SJ8I1z2tmJXNMYbeAC3jK6uxOoY+Mcs63VLtstVJqqmFfJv454D4A8m5ckqb/ltkf6+dlxpC5mHx0IAf7ybek4fCKSlSIwCRI3M1rX2Jhh3KpvQkce4x53Hinj14t5w5u+eCdNUljUuyjjZBq1BMQn65p0FeJ4A6y8jxQXJM44Wajtd+zuDFK1AL8rrbFTgtkezurZvZCSZQSa1UfUkIegAbx2wIDAQAB

# Short links to external forms, e.g. /ganymede. Traefik on alastor redirects
# each path (patchworklabsorg/infra nixosModules.forms-alastor).
forms: # adam.sidwa@patchworklabs.org
  octodns:
      cloudflare:
        proxied: true
  ttl: 120
  type: A
  value: 129.213.163.213

# Google Workspace DKIM authentication
google._domainkey: # @patchworklabsorg/infra
  type: TXT
  value: v=DKIM1\; k=rsa\; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzEuGHXgOxIj0qk83hV4ajl/OIpXbhE/MTKhXU1VZDBISO/+yBCQsVyq1j4F13tWxUpYLlw78OJl+7TlAyZ4llYY5z2Oj+EiAIQZCRBLmKN7zDpnbwbiM4hfam5vnhCvFwdgg0aKUY221T/Pe5Mjz11e0VtyOJ3D3enPId010bi99p93Dimf+rFo9YFwps7U/V4O5rWaRyG9snFcl9tshvKTgQ6OoHEvLbvQIU1QTiXR6oHAI5KP/8BzA26djgIKqNuHaU9S70KSVUH/9CBSAjHP50j4i4rGGEr6PopNjxQxN5owwu2jUDEIOrv13RLpNPISu1NaPCgMnGVyfsQ77yQIDAQAB

# Krater staging (Project Ganymede portal), on weft behind alastor's edge
# (patchworklabsorg/infra hosts/weft/krater.nix). Weave staging sign-in.
krater-staging: # @patchworklabsorg/infra
  octodns:
      cloudflare:
        proxied: true
  ttl: 120
  type: A
  value: 129.213.163.213

# Krater staging's S3 storage (SeaweedFS on weft), behind alastor's edge.
# Proxied on purpose: staging stores small gallery screenshots, and Compute
# (large checkpoints) is off. Cloudflare caps a request body at 100 MB, so
# turn the proxy off or use small multipart parts before Compute needs more.
# No cache or Rocket Loader rule may apply here: they break S3 signatures.
krater-staging-storage: # @patchworklabsorg/infra
  octodns:
      cloudflare:
        proxied: true
  ttl: 120
  type: A
  value: 129.213.163.213

openpgpkey: # @patchworklabsorg/infra
  ttl: 300
  type: CNAME
  value: wkd.keys.openpgp.org.

# Quilt, the Patchwork funding and records system, on alastor
# (patchworklabsorg/infra nixosModules.quilt-alastor).
quilt: # @patchworklabsorg/infra
  octodns:
      cloudflare:
        proxied: true
  ttl: 120
  type: A
  value: 129.213.163.213

# Quilt staging, on alastor next to production (patchworklabsorg/infra
# nixosModules.quilt-alastor, staging). Mercury sandbox only.
quilt-staging: # @patchworklabsorg/infra
  octodns:
      cloudflare:
        proxied: true
  ttl: 120
  type: A
  value: 129.213.163.213

resend._domainkey.sandbox: # PWL7A1CE1F3CB / jasper@patchworklabs.org
  ttl: 3600
  type: TXT
  value: p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDxua1n4Hmk59q+hfD5XNVGh2izW+4sQZO6geNKIfiiAFkJV1yE2WJFZA+AJLIYGNbZ5YZTi89iWhodFCtOjynMHL0a0AvE/rA09NDp22b3J2pSxp2Xd0h5tRsmyL2yx8lCor4G9QCu6EkZz4jY3VXQOSQICnDnzMaBeV4hyebeYwIDAQAB

# Weave (Patchwork Labs IDP) sends email through Resend from send.weave.
resend._domainkey.weave: # @patchworklabsorg/weave
  ttl: 3600
  type: TXT
  value: p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCw686PBvLW3WwbVohPhkkxGXnkfIj4Qe+1h0t64WPqZcu70jF0SrbdfGU7yKgpnAA7/JvtkngYPfc85EGGHxrD83MG5DQ60vK9EPn5PExt4iYWwfMRSJ0solhKeu/8//YLvn7Lq7O+1HaFp566qH4RZ8xa5hENZy5rqEkmIpoHFQIDAQAB

rsend.sandbox: # PWL7A1CE1F3CB / jasper@patchworklabs.org
  ttl: 3600
  type: CNAME
  value: rsend.forge.rmta.net.

send.sandbox: # PWL7A1CE1F3CB / jasper@patchworklabs.org
  ttl: 3600
  type: CNAME
  value: send.forge.rmta.net.

send.weave: # @patchworklabsorg/weave
  - ttl: 3600
    type: MX
    value:
      exchange: feedback-smtp.us-east-1.amazonses.com.
      preference: 10
  - ttl: 3600
    type: TXT
    value: v=spf1 include:amazonses.com ~all

# Public "join our Slack" address. Weave redirects it to
# https://weave.patchworklabs.org/slack (patchworklabsorg/weave#121).
slack: # @patchworklabsorg/weave
  octodns:
      cloudflare:
        proxied: true
  ttl: 120
  type: A
  value: 129.213.163.213

# The thimble WireGuard endpoint (patchworklabsorg/infra). WireGuard is UDP,
# so Cloudflare cannot proxy it.
vpn: # @patchworklabsorg/infra
  octodns:
      cloudflare:
        proxied: false
  ttl: 300
  type: A
  value: 69.54.28.49

# Weave, the Patchwork Labs IDP, on alastor.
weave: # @patchworklabsorg/weave
  octodns:
      cloudflare:
        proxied: true
  ttl: 120
  type: A
  value: 129.213.163.213

weave-kyc-proposal: # PWL7A1CE1F3CB / jasper@patchworklabs.org
  ttl: 300
  type: CNAME
  value: e4ec487349d24e0b.vercel-dns-017.com.

# Weave staging, on alastor next to production.
weave-staging: # @patchworklabsorg/weave
  octodns:
      cloudflare:
        proxied: true
  ttl: 120
  type: A
  value: 129.213.163.213

www: # @patchworklabsorg/infra
  octodns:
      cloudflare:
        proxied: true
  ttl: 120
  type: CNAME
  value: 52fd2b2210caa11f.vercel-dns-017.com.