eac77ef7b4
Collection of operational skills for VaultMesh infrastructure including: - backup-sovereign: Backup and recovery operations - btc-anchor: Bitcoin anchoring - cloudflare-tunnel-manager: Cloudflare tunnel management - container-registry: Container registry operations - disaster-recovery: Disaster recovery procedures - dns-sovereign: DNS management - eth-anchor: Ethereum anchoring - gitea-bootstrap: Gitea setup and configuration - hetzner-bootstrap: Hetzner server provisioning - merkle-forest: Merkle tree operations - node-hardening: Node security hardening - operator-bootstrap: Operator initialization - proof-verifier: Cryptographic proof verification - rfc3161-anchor: RFC3161 timestamping - secrets-vault: Secrets management 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
69 lines
2.5 KiB
Bash
69 lines
2.5 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
SKILL_ROOT="$(dirname "$SCRIPT_DIR")"
|
|
source "$SCRIPT_DIR/_common.sh"
|
|
|
|
: "${CF_API_TOKEN:=}"
|
|
: "${ZONE_NAME:=}"
|
|
: "${HOSTNAME:=}"
|
|
: "${CONFIG_DIR:=$SKILL_ROOT/outputs/config}"
|
|
|
|
api() {
|
|
local method="$1"; shift
|
|
local url="$1"; shift
|
|
curl -sS -X "$method" "$url" \
|
|
-H "Authorization: Bearer $CF_API_TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
"$@"
|
|
}
|
|
|
|
main() {
|
|
confirm_gate
|
|
[[ -n "$CF_API_TOKEN" ]] || die "CF_API_TOKEN is required."
|
|
[[ -n "$ZONE_NAME" ]] || die "ZONE_NAME is required."
|
|
[[ -n "$HOSTNAME" ]] || die "HOSTNAME is required."
|
|
[[ -f "$CONFIG_DIR/tunnel.json" ]] || die "Missing tunnel snapshot: $CONFIG_DIR/tunnel.json"
|
|
|
|
local tunnel_id; tunnel_id="$(jq -r '.id' "$CONFIG_DIR/tunnel.json")"
|
|
[[ -n "$tunnel_id" && "$tunnel_id" != "null" ]] || die "Invalid tunnel id in tunnel.json"
|
|
|
|
log_info "Resolving zone id for: $ZONE_NAME"
|
|
local z; z="$(api GET "https://api.cloudflare.com/client/v4/zones?name=$ZONE_NAME" | jq -r '.result[0].id' )"
|
|
[[ -n "$z" && "$z" != "null" ]] || die "Unable to resolve zone id for $ZONE_NAME"
|
|
|
|
local cname_target="${tunnel_id}.cfargotunnel.com"
|
|
log_info "Ensuring CNAME: $HOSTNAME -> $cname_target"
|
|
|
|
# Find existing record
|
|
local rec; rec="$(api GET "https://api.cloudflare.com/client/v4/zones/$z/dns_records?type=CNAME&name=$HOSTNAME")"
|
|
local rec_id; rec_id="$(echo "$rec" | jq -r '.result[0].id' )"
|
|
|
|
if [[ -n "$rec_id" && "$rec_id" != "null" ]]; then
|
|
log_info "Updating existing DNS record id: $rec_id"
|
|
api PUT "https://api.cloudflare.com/client/v4/zones/$z/dns_records/$rec_id" \
|
|
--data "{\"type\":\"CNAME\",\"name\":\"$HOSTNAME\",\"content\":\"$cname_target\",\"ttl\":1,\"proxied\":true}" \
|
|
| jq -e '.success==true' >/dev/null || die "Failed to update DNS record."
|
|
else
|
|
log_info "Creating new DNS record"
|
|
api POST "https://api.cloudflare.com/client/v4/zones/$z/dns_records" \
|
|
--data "{\"type\":\"CNAME\",\"name\":\"$HOSTNAME\",\"content\":\"$cname_target\",\"ttl\":1,\"proxied\":true}" \
|
|
| jq -e '.success==true' >/dev/null || die "Failed to create DNS record."
|
|
fi
|
|
|
|
# Save snapshot
|
|
cat > "$CONFIG_DIR/dns_route.json" <<EOF
|
|
{
|
|
"zone_name": "$(json_escape "$ZONE_NAME")",
|
|
"hostname": "$(json_escape "$HOSTNAME")",
|
|
"target": "$(json_escape "$cname_target")",
|
|
"generated": "$(date -Iseconds)"
|
|
}
|
|
EOF
|
|
|
|
log_info "Wrote DNS snapshot: $CONFIG_DIR/dns_route.json"
|
|
log_info "Next: ./scripts/30_service_plan.sh"
|
|
}
|
|
|
|
main "$@"
|