Use SPF and CAA builder. Normalise TTL

diff --git a/src/opengeodata.js b/src/opengeodata.js
index 6dfc203874d1a5be4858f71187d4555e4b90c1f1..fe354674949e5111ee10598462e6c88c97b57d79 100644 (file)
--- a/src/opengeodata.js
+++ b/src/opengeodata.js
@@ -2,9 +2,29 @@ D(DOMAIN, REGISTRAR, DnsProvider(PROVIDER),
 
   // Publish CAA records indicating that only letsencrypt should issue certificates
 
-  CAA("@", "issue", "letsencrypt.org", CF_TTL_ANY),
-  CAA("@", "issuewild", "letsencrypt.org", CF_TTL_ANY),
-  CAA("@", "iodef", "mailto:hostmaster@openstreetmap.org"),
+  CAA_BUILDER({
+    label: "@",
+    ttl: "1h",
+    iodef: "mailto:hostmaster@openstreetmap.org",
+    issue: [
+      "letsencrypt.org",
+    ],
+    issuewild: [
+      "letsencrypt.org",
+    ],
+  }),
+
+  // Delegate SPF policy to the main domain
+
+  SPF_BUILDER({
+    label: "@",
+    ttl: "1h",
+    parts: [
+      "v=spf1",
+      "include:openstreetmap.org",      // main openstreetmap.org spf record
+      "-all"
+    ]
+  }),
 
   // Main web server and it's aliases
 
@@ -12,4 +32,4 @@ D(DOMAIN, REGISTRAR, DnsProvider(PROVIDER),
   A("old", RIDLEY_IPV4, TTL("10m")),
   A("www", RIDLEY_IPV4, TTL("10m"))
 
-);
+);
\ No newline at end of file

diff --git a/src/openstreetmap-uk.js b/src/openstreetmap-uk.js
index bfed62ec942b9ce3e6064bc5e2a5ab7c841f27b7..a8908c2e6215d5a3164b8b1d12a255ddaaaedef1 100644 (file)
--- a/src/openstreetmap-uk.js
+++ b/src/openstreetmap-uk.js
@@ -2,9 +2,17 @@ D(DOMAIN, REGISTRAR, DnsProvider(PROVIDER),
 
   // Publish CAA records indicating that only letsencrypt should issue certificates
 
-  CAA("@", "issue", "letsencrypt.org", CF_TTL_ANY),
-  CAA("@", "issuewild", "letsencrypt.org", CF_TTL_ANY),
-  CAA("@", "iodef", "mailto:hostmaster@openstreetmap.org"),
+  CAA_BUILDER({
+    label: "@",
+    ttl: "1h",
+    iodef: "mailto:hostmaster@openstreetmap.org",
+    issue: [
+      "letsencrypt.org",
+    ],
+    issuewild: [
+      "letsencrypt.org",
+    ],
+  }),
 
   // Let the main domain handle the email
 
@@ -12,7 +20,15 @@ D(DOMAIN, REGISTRAR, DnsProvider(PROVIDER),
 
   // Delegate SPF policy to the main domain
 
-  TXT("@", "v=spf1 include:openstreetmap.org -all"),
+  SPF_BUILDER({
+    label: "@",
+    ttl: "1h",
+    parts: [
+      "v=spf1",
+      "include:openstreetmap.org",      // main openstreetmap.org spf record
+      "-all"
+    ]
+  }),
 
   // Delegate MTA-STS policy to the main domain
 

diff --git a/src/openstreetmap-za.js b/src/openstreetmap-za.js
index b8904b57b51323ca5e56026ac73783fc6c64c3e0..78061efe6d1feeed5c321970c4a02579891e612f 100644 (file)
--- a/src/openstreetmap-za.js
+++ b/src/openstreetmap-za.js
@@ -2,9 +2,17 @@ D(DOMAIN, REGISTRAR, DnsProvider(PROVIDER),
 
   // Publish CAA records indicating that only letsencrypt should issue certificates
 
-  CAA("@", "issue", "letsencrypt.org", CF_TTL_ANY),
-  CAA("@", "issuewild", "letsencrypt.org", CF_TTL_ANY),
-  CAA("@", "iodef", "mailto:hostmaster@openstreetmap.org"),
+  CAA_BUILDER({
+    label: "@",
+    ttl: "1h",
+    iodef: "mailto:hostmaster@openstreetmap.org",
+    issue: [
+      "letsencrypt.org",
+    ],
+    issuewild: [
+      "letsencrypt.org",
+    ],
+  }),
 
   // Let the main domain handle the email
 
@@ -12,7 +20,15 @@ D(DOMAIN, REGISTRAR, DnsProvider(PROVIDER),
 
   // Delegate SPF policy to the main domain
 
-  TXT("@", "v=spf1 include:openstreetmap.org -all"),
+  SPF_BUILDER({
+    label: "@",
+    ttl: "1h",
+    parts: [
+      "v=spf1",
+      "include:openstreetmap.org",      // main openstreetmap.org spf record
+      "-all"
+    ]
+  }),
 
   // Delegate MTA-STS policy to the main domain
 

diff --git a/src/openstreetmap.js b/src/openstreetmap.js
index b25f6970ff759eff10bac67538a949fcab541403..2f21f7ffc0cba4c06d5d609a09764faa16ae43b0 100644 (file)
--- a/src/openstreetmap.js
+++ b/src/openstreetmap.js
@@ -2,11 +2,19 @@ D(DOMAIN, REGISTRAR, DnsProvider(PROVIDER),
 
   // Publish CAA records indicating that only letsencrypt and globalsign (Fastly) should issue certificates
 
-  CAA("@", "issue", "letsencrypt.org", CF_TTL_ANY),
-  CAA("@", "issuewild", "letsencrypt.org", CF_TTL_ANY),
-  CAA("@", "issue", "globalsign.com", CF_TTL_ANY),
-  CAA("@", "issuewild", "globalsign.com", CF_TTL_ANY),
-  CAA("@", "iodef", "mailto:hostmaster@openstreetmap.org"),
+  CAA_BUILDER({
+    label: "@",
+    ttl: "1h",
+    iodef: "mailto:hostmaster@openstreetmap.org",
+    issue: [
+      "letsencrypt.org",
+      "globalsign.com",   // Used by Fastly for CDN certificates
+    ],
+    issuewild: [
+      "letsencrypt.org",
+      "globalsign.com",   // Used by Fastly for CDN certificates
+    ],
+  }),
 
   // Use shenron as the MX host
 
@@ -19,8 +27,29 @@ D(DOMAIN, REGISTRAR, DnsProvider(PROVIDER),
 
   // Publish SPF records indicating that only shenron sends mail
 
-  TXT("@", "v=spf1 ip4:212.110.172.32 ip6:2001:41c9:1:400::32 mx -all"),
-  TXT("otrs", "v=spf1 ip4:212.110.172.32 ip6:2001:41c9:1:400::32 mx -all"),
+  SPF_BUILDER({
+    label: "@",
+    ttl: "1h",
+    parts: [
+      "v=spf1",
+      "ip4:212.110.172.32",       // shenron ipv4
+      "ip6:2001:41c9:1:400::32",  // shenron ipv6
+      "mx",                       // safety net if we change mx
+      "-all"
+    ]
+  }),
+
+  SPF_BUILDER({
+    label: "otrs",
+    ttl: "1h",
+    parts: [
+      "v=spf1",
+      "ip4:212.110.172.32",       // shenron ipv4
+      "ip6:2001:41c9:1:400::32",  // shenron ipv6
+      "mx",                       // safety net if we change mx
+      "-all"
+    ]
+  }),
 
   // Publish DKIM public key
 
@@ -30,7 +59,7 @@ D(DOMAIN, REGISTRAR, DnsProvider(PROVIDER),
 
   TXT("_mta-sts", "v=STSv1; id=202001291805Z"),
   TXT("_smtp._tls", "v=TLSRPTv1; rua=mailto:postmaster@openstreetmap.org"),
-  
+
   // Fastly cert domain ownership confirmation
 
   TXT("@", "_globalsign-domain-verification=ps00GlW1BzY9c2_cwH_pFqRkvzZyaCVZ-3RLssRG6S"),
@@ -214,7 +243,7 @@ D(DOMAIN, REGISTRAR, DnsProvider(PROVIDER),
   CNAME("a.tile", "dualstack.osff2.map.fastly.net.", TTL("10m")),
   CNAME("b.tile", "dualstack.osff2.map.fastly.net.", TTL("10m")),
   CNAME("c.tile", "dualstack.osff2.map.fastly.net.", TTL("10m")),
-  
+
   // Services machine
 
   A("ironbelly", IRONBELLY_IPV4),
@@ -510,7 +539,7 @@ D(DOMAIN, REGISTRAR, DnsProvider(PROVIDER),
 
   // Donation site
 
-  A("donate", RIDLEY_IPV4, TTL("10m")),
+  A("donate", RIDLEY_IPV4),
 
   // Uptime site at StatusCake
 

diff --git a/src/osm2pgsql.js b/src/osm2pgsql.js
index 770979ad5a421daa3a38f35d3dcb33f4cdd3728c..070dda9aef2eb4ff893c4321a14fddf4543e8195 100644 (file)
--- a/src/osm2pgsql.js
+++ b/src/osm2pgsql.js
@@ -2,15 +2,23 @@ D(DOMAIN, REGISTRAR, DnsProvider(PROVIDER),
 
   // Publish CAA records indicating that only letsencrypt should issue certificates
 
-  CAA("@", "issue", "letsencrypt.org", CF_TTL_ANY),
-  CAA("@", "issuewild", "letsencrypt.org", CF_TTL_ANY),
-  CAA("@", "iodef", "mailto:hostmaster@openstreetmap.org"),
+  CAA_BUILDER({
+    label: "@",
+    ttl: "1h",
+    iodef: "mailto:hostmaster@openstreetmap.org",
+    issue: [
+      "letsencrypt.org",
+    ],
+    issuewild: [
+      "letsencrypt.org",
+    ],
+  }),
 
   // Main web server and it's aliases
 
-  A("@", "138.201.190.130"),
-  AAAA("@", "2a01:4f8:1c17:6433::1"),
-  A("www", "138.201.190.130"),
-  AAAA("www", "2a01:4f8:1c17:6433::1")
+  A("@", "138.201.190.130", TTL("10m")),
+  AAAA("@", "2a01:4f8:1c17:6433::1", TTL("10m")),
+  A("www", "138.201.190.130", TTL("10m")),
+  AAAA("www", "2a01:4f8:1c17:6433::1", TTL("10m"))
 
 );

diff --git a/src/osmfoundation.js b/src/osmfoundation.js
index a6a8bcd9c7c30f38595073c89e81a76d87ca042d..b0c7d8a157148d7773766e8e50b4e695444afa15 100644 (file)
--- a/src/osmfoundation.js
+++ b/src/osmfoundation.js
@@ -2,9 +2,17 @@ D(DOMAIN, REGISTRAR, DnsProvider(PROVIDER),
 
   // Publish CAA records indicating that only letsencrypt should issue certificates
 
-  CAA("@", "issue", "letsencrypt.org", CF_TTL_ANY),
-  CAA("@", "issuewild", "letsencrypt.org", CF_TTL_ANY),
-  CAA("@", "iodef", "mailto:hostmaster@openstreetmap.org"),
+  CAA_BUILDER({
+    label: "@",
+    ttl: "1h",
+    iodef: "mailto:hostmaster@openstreetmap.org",
+    issue: [
+      "letsencrypt.org",
+    ],
+    issuewild: [
+      "letsencrypt.org",
+    ],
+  }),
 
   // Let google handle email
 
@@ -20,7 +28,17 @@ D(DOMAIN, REGISTRAR, DnsProvider(PROVIDER),
 
   // SPF policy
 
-  TXT("@", "v=spf1 ip4:212.110.172.32 ip6:2001:41c9:1:400::32 a mx include:_spf.google.com -all"),
+  SPF_BUILDER({
+    label: "@",
+    ttl: "1h",
+    parts: [
+      "v=spf1",
+      "include:_spf.google.com",  // Google GSuite
+      "ip4:212.110.172.32",       // shenron ipv4
+      "ip6:2001:41c9:1:400::32",  // shenron ipv6
+      "-all"
+    ]
+  }),
 
   // DKIM keys
 

diff --git a/src/stateofthemap-eu.js b/src/stateofthemap-eu.js
index 4e83e5d9ba9b8fe56d5024264de571256fe0dcd5..25cb14a4270012fe00da7ab858b6b2a398ee62bd 100644 (file)
--- a/src/stateofthemap-eu.js
+++ b/src/stateofthemap-eu.js
@@ -2,9 +2,17 @@ D(DOMAIN, REGISTRAR, DnsProvider(PROVIDER),
 
   // Publish CAA records indicating that only letsencrypt should issue certificates
 
-  CAA("@", "issue", "letsencrypt.org", CF_TTL_ANY),
-  CAA("@", "issuewild", "letsencrypt.org", CF_TTL_ANY),
-  CAA("@", "iodef", "mailto:hostmaster@openstreetmap.org"),
+  CAA_BUILDER({
+    label: "@",
+    ttl: "1h",
+    iodef: "mailto:hostmaster@openstreetmap.org",
+    issue: [
+      "letsencrypt.org",
+    ],
+    issuewild: [
+      "letsencrypt.org",
+    ],
+  }),
 
   // Let openstreetmap.at handle email
 

diff --git a/src/stateofthemap.js b/src/stateofthemap.js
index a8ca9d4cb64dac4a1d26ef4721ec529fc0ee8f49..e13e764904e79eda54bcaca4500fb426afecf142 100644 (file)
--- a/src/stateofthemap.js
+++ b/src/stateofthemap.js
@@ -2,9 +2,31 @@ D(DOMAIN, REGISTRAR, DnsProvider(PROVIDER),
 
   // Publish CAA records indicating that only letsencrypt should issue certificates
 
-  CAA("@", "issue", "letsencrypt.org", CF_TTL_ANY),
-  CAA("@", "issuewild", "letsencrypt.org", CF_TTL_ANY),
-  CAA("@", "iodef", "mailto:hostmaster@openstreetmap.org"),
+  CAA_BUILDER({
+    label: "@",
+    ttl: "1h",
+    iodef: "mailto:hostmaster@openstreetmap.org",
+    issue: [
+      "letsencrypt.org",
+    ],
+    issuewild: [
+      "letsencrypt.org",
+    ],
+  }),
+
+  // SPF policy
+
+  SPF_BUILDER({
+    label: "@",
+    ttl: "1h",
+    parts: [
+      "v=spf1",
+      "include:_spf.google.com",  // Google GSuite
+      "ip4:212.110.172.32",       // shenron ipv4
+      "ip6:2001:41c9:1:400::32",  // shenron ipv6
+      "-all"
+    ]
+  }),
 
   // Let google handle email
 
@@ -35,10 +57,6 @@ D(DOMAIN, REGISTRAR, DnsProvider(PROVIDER),
   A("2010", RIDLEY_IPV4, TTL("10m")),
   A("2009", RIDLEY_IPV4, TTL("10m")),
   A("2008", RIDLEY_IPV4, TTL("10m")),
-  A("2007", RIDLEY_IPV4, TTL("10m")),
-
-  // Video conferencing server
-
-  A("talk", "95.217.113.173")
+  A("2007", RIDLEY_IPV4, TTL("10m"))
 
 );

diff --git a/src/switch2osm.js b/src/switch2osm.js
index 71cae23abc52aef68b50f05c251ca838699564e9..70e2775efc77ee7a674e5a1c433b5f232235b22f 100644 (file)
--- a/src/switch2osm.js
+++ b/src/switch2osm.js
@@ -2,9 +2,29 @@ D(DOMAIN, REGISTRAR, DnsProvider(PROVIDER),
 
   // Publish CAA records indicating that only letsencrypt should issue certificates
 
-  CAA("@", "issue", "letsencrypt.org", CF_TTL_ANY),
-  CAA("@", "issuewild", "letsencrypt.org", CF_TTL_ANY),
-  CAA("@", "iodef", "mailto:hostmaster@openstreetmap.org"),
+  CAA_BUILDER({
+    label: "@",
+    ttl: "1h",
+    iodef: "mailto:hostmaster@openstreetmap.org",
+    issue: [
+      "letsencrypt.org",
+    ],
+    issuewild: [
+      "letsencrypt.org",
+    ],
+  }),
+
+  // Delegate SPF policy to the main domain
+
+  SPF_BUILDER({
+    label: "@",
+    ttl: "1h",
+    parts: [
+      "v=spf1",
+      "include:openstreetmap.org",  // main openstreetmap.org spf record
+      "-all"
+    ]
+  }),
 
   // Main web server and it's aliases