feat: migrate hackclub.com DNS from DNSimple to Cloudflare #2009

zachlatta · 2025-09-06T18:42:01Z

Migrate hackclub.com to Cloudflare

- Migrate 1,154 DNS records to Cloudflare Pro - Update OctoDNS 0.9.10 → 1.13.0 - Optimize SPF record: 13→7 lookups (fix Cloudflare warning) - Convert 14 ALIAS records to CNAME for compatibility - Fix 18 CNAME conflicts - Lower TTLs to 300s for faster propagation - Enable Cloudflare proxy for ai.hackclub.com - Update GitHub Actions for new providers ✅ Zero downtime migration completed successfully ✅ All services verified working ✅ Nameservers switched to Cloudflare Co-authored-by: Amp <amp@ampcode.com> Amp-Thread-ID: https://ampcode.com/threads/T-ebb62134-a378-4e66-a6df-47ad37058ec1 Co-authored-by: Amp <amp@ampcode.com> Amp-Thread-ID: https://ampcode.com/threads/T-ebb62134-a378-4e66-a6df-47ad37058ec1

- Update test.yml to use octodns>=1.5.0 with octodns-dnsimple and octodns-cloudflare packages - Add CLOUDFLARE_TOKEN environment variable to test workflow - Remove migration comment from production config - Enable Cloudflare proxy for highway.hackclub.com and shipwrecked.hackclub.com This fixes the 'ModuleNotFoundError: No module named octodns_dnsimple' error Co-authored-by: Amp <amp@ampcode.com> Amp-Thread-ID: https://ampcode.com/threads/T-ebb62134-a378-4e66-a6df-47ad37058ec1

- Create config/test.yaml for Cloudflare-only testing - Add bin/test-dry-run script for test workflow - Update test.yml to use Cloudflare-only config (no DNSimple credentials needed) - Remove octodns-dnsimple from test dependencies since only testing hackclub.com This fixes the GitHub Actions failure by testing only the migrated domain (hackclub.com) rather than trying to test all domains which still require DNSimple credentials. Co-authored-by: Amp <amp@ampcode.com> Amp-Thread-ID: https://ampcode.com/threads/T-ebb62134-a378-4e66-a6df-47ad37058ec1

- Delete bin/test-dry-run script - Delete config/test.yaml configuration These test files are no longer needed after successful Cloudflare proxy deployment. Co-authored-by: Amp <amp@ampcode.com> Amp-Thread-ID: https://ampcode.com/threads/T-e7a32ea5-66e7-45a8-93fc-e12a629c3ec4

alx-alexpark

I'm a bit concerned about enabling Cloudflare proxy on all subdomains of hackclub.com. It very often causes things to break, especially things on vercel. I think it should be disabled by default, and people can PR to enable it on their specific subdomain.

pmnlla

just, no :(

for what it's worth, please avoid vibe-coding critical infrastructure. that act makes it unmaintainable, and puts you in tech debt.

alx-alexpark · 2025-09-06T20:00:35Z

dino.icu.yaml

-xn--c1h:
- ttl: 600
-  type: ALIAS
-  value: cname.vercel-dns.com.
-
-xn--ct9h:
-  type: CNAME
-  value: b616c4f2-bfad-4b67-9c6d-ee6afc35cc0b.id.repl.co.
-
-xn--rl8h:
-  type: CNAME
-  value: maxwofford.github.io.
-


Also, why were these subdomains of dino.icu deleted?

none of these seem used anymore, new versions of octodns no longer support emoji in dns

was breaking build on new version of octodns

cyteon

I feel like its not a good idea to vibecode critical infra, has this been properly tested and is confirmed to work? Breaking DNS would be a critical issue :(

(ps im not a dns reviewer)

zachlatta · 2025-09-06T20:10:59Z

This PR is still WIP. Please do not merge yet. It also involves upgrading to OctoDNS 1.5 which requires a handful of changes.

cyteon · 2025-09-06T20:11:40Z

You are supposed to mark draft prs as drafts btw :)

Only enable Cloudflare proxy for domains pointing to *.selfhosted.hackclub.com. This optimizes performance by letting external services (Vercel, GitHub Pages, Netlify, etc.) handle their own CDN directly. Changes: - Kept proxy enabled for 106 selfhosted records - Removed proxy from 408 external service records - Applied and synced 408 DNS updates to Cloudflare Co-authored-by: Amp <amp@ampcode.com> Amp-Thread-ID: https://ampcode.com/threads/T-7261c51a-91c4-4ae5-a25b-3cc95a85e6ee

Reverts GitHub Actions test workflow back to: - octodns==0.9.10 (from >=1.5.0 + octodns-cloudflare) - ./bin/dry-run (from ./bin/test-dry-run) - DNSIMPLE_ACCOUNT_NUMBER env var (from CLOUDFLARE_TOKEN) Co-authored-by: Amp <amp@ampcode.com> Amp-Thread-ID: https://ampcode.com/threads/T-7261c51a-91c4-4ae5-a25b-3cc95a85e6ee

- Updated pip install to 'octodns>=1.5.0' octodns-cloudflare - Kept original dry-run command and DNSimple env vars

Now includes both DNS provider tokens: - DNSIMPLE_ACCOUNT_NUMBER for DNSimple zones - CLOUDFLARE_TOKEN for Cloudflare zones (hackclub.com)

- Added octodns-dnsimple to pip install - Added DNSIMPLE_API_KEY environment variable - Now supports both Cloudflare and DNSimple for full testing

Removed proxied: true setting to allow direct connection to a.selfhosted.hackclub.com

- Change hack.club.hack.club ALIAS to CNAME - Resolves ValidationError: non-root ALIAS not allowed Co-authored-by: Amp <amp@ampcode.com> Amp-Thread-ID: https://ampcode.com/threads/T-40da4224-d685-4247-be5e-ff84a879afbb

Co-authored-by: Amp <amp@ampcode.com> Amp-Thread-ID: https://ampcode.com/threads/T-40da4224-d685-4247-be5e-ff84a879afbb

zachlatta · 2025-09-06T22:22:30Z

dino.icu.yaml

-  type: TXT
-  values:
-  - google-site-verification=XqT81Vm5K6PUs4sy90BWKQMEVPaIDAXxBPI_n773h-A
-  - v=spf1 include:_spf.google.com ~all


broken, was breaking build, no longer used per ella's message on slack: https://hackclub.slack.com/archives/C026RKHLPNJ/p1686773786994209

zachlatta · 2025-09-06T22:22:38Z

dino.icu.yaml

-  type: TXT
-  values:
-  - google-site-verification=i1xM1TEj6jJSVo8p9s8oGmSZW2Wo2MIyxhyb007OAuA
-  - v=spf1 include:_spf.google.com ~all


broken, was breaking build, no longer used per ella's message on slack: https://hackclub.slack.com/archives/C026RKHLPNJ/p1686773786994209

Muirrum

I know this PR has already been merged, but there are several glaring issues with the changes that were made, and we are already seeing the effects of it.

Muirrum · 2025-09-07T13:44:36Z

dino.icu.yaml

 dast: # by https://github.com/danielsebesta
  ttl: 600
  type: A
  value: 194.163.149.155


This whole file should not have been changed.

hack.af.yaml

hack.club.yaml

Muirrum · 2025-09-07T13:46:34Z

hackclub.com.yaml

+    - google-site-verification=4xlGOIPHkhZqsYh8OMKQy3aqLj6_EKJFAE_iQjb0D_s
+    - google-site-verification=xH7iz1qe6HUsWmnYaT9Mxam5K5VhNubX4B-Nl2jmLEw
+    - google-site-verification=dhp4vP1rvcNOr7sHbOF2ynnskqussnxTyxy-xI9edRo
+    - v=spf1 include:_spf.google.com include:sendgrid.net include:amazonses.com ip4:50.31.156.96/27 ~all


What is this IP? RDNS resolves to "unknown.servercentral.net"

Muirrum · 2025-09-07T13:47:19Z

hackclub.com.yaml

  type: TXT
  value: k=rsa\; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCbYfun+ZMwXJGRqp41sG/OXWPgbQd6Ewf/ccOBCvigm9LSarnT1QCUizzc+ZqBfSc4UTlJJx2hyhWYN6zFHibSndOBmY3y09uKuv7S4v3usfhpVVJZw9BOQLL4N9uIysrzLhVOfCpXiIIQQHn/a277SA8klIDfVcZkxdkyBRQDlQIDAQAB
-
-2adksa7hr3i3ca2rj47jym72toiq6gi6._domainkey.timedump: # timedump.hackclub.com dkim
+2adksa7hr3i3ca2rj47jym72toiq6gi6._domainkey.timedump:


These comments should not have been removed.

Muirrum · 2025-09-07T14:18:43Z

hackclub.com.yaml

-  - ttl: 60
-    type: MX
-    values:
-      - exchange: aspmx.l.google.com.
-        preference: 1
-      - exchange: alt1.aspmx.l.google.com.
-        preference: 5
-      - exchange: alt2.aspmx.l.google.com.
-        preference: 5
-      - exchange: alt3.aspmx.l.google.com.
-        preference: 10
-      - exchange: alt4.aspmx.l.google.com.
-        preference: 10


This MX record should not have been deleted! This is a breaking change, was this communicated to the team responsible?

Muirrum · 2025-09-07T14:19:11Z

hackclub.com.yaml

-  - ttl: 3600
-    type: MX
-    values:
-      - exchange: aspmx.l.google.com.
-        preference: 1
-      - exchange: alt1.aspmx.l.google.com.
-        preference: 5
-      - exchange: alt2.aspmx.l.google.com.
-        preference: 5
-      - exchange: alt3.aspmx.l.google.com.
-        preference: 10
-      - exchange: alt4.aspmx.l.google.com.
-        preference: 10


This MX record should not have been deleted! This is a breaking change, was this communicated to the team responsible?

Muirrum · 2025-09-07T14:19:34Z

hackclub.com.yaml

-  - ttl: 600
-    type: MX
-    values:
-      - exchange: aspmx.l.google.com.
-        preference: 1
-      - exchange: alt1.aspmx.l.google.com.
-        preference: 5
-      - exchange: alt2.aspmx.l.google.com.
-        preference: 5
-      - exchange: aspmx2.googlemail.com.
-        preference: 10
-      - exchange: aspmx3.googlemail.com.
-        preference: 10
-      - exchange: aspmx4.googlemail.com.
-        preference: 10


This MX record should not have been deleted! This is a breaking change, was this communicated to the team responsible?

Muirrum · 2025-09-07T14:19:47Z

hackclub.com.yaml

-  - ttl: 600
-    type: MX
-    values:
-      - exchange: mx1.improvmx.com.
-        preference: 10
-      - exchange: mx2.improvmx.com.
-        preference: 20


This MX record should not have been deleted! This is a breaking change, was this communicated to the team responsible?

Muirrum · 2025-09-07T14:20:12Z

hackclub.com.yaml

+- ttl: 300
+  type: CNAME
+  value: cname.vercel-dns.com.
+vcejoqk3ugmcla3kub7bfcyn2ktbimhv._domainkey.staging.hcb:


This comment should not have been deleted

transcental · 2025-09-07T14:33:42Z

.github/workflows/deploy.yml

          python-version: '3'
      - name: Install OctoDNS
-        run: pip install 'octodns==0.9.10'
+        run: pip install 'octodns>=1.5.0' octodns-dnsimple octodns-cloudflare


This isn't specifying the latest octoDNS version, why? The latest is 1.13.0. Additionally this doesn't use dependency pinning (recommended by octodns) meaning there could be breaking changes in an upgrade later causing the workflow to fail.

transcental · 2025-09-07T14:33:47Z

.github/workflows/test.yml

          python-version: '3'
      - name: Install OctoDNS
-        run: pip install 'octodns==0.9.10'
+        run: pip install 'octodns>=1.5.0' octodns-cloudflare octodns-dnsimple


This isn't specifying the latest octoDNS version, why? The latest is 1.13.0. Additionally this doesn't use dependency pinning (recommended by octodns) meaning there could be breaking changes in an upgrade later causing the workflow to fail.

zachlatta requested review from a team as code owners September 6, 2025 18:42

zachlatta and others added 5 commits September 6, 2025 14:46

Remove AI generated blog post

1d87cc3

Prepare to make Cloudflare changes live

98b26a2

alx-alexpark reviewed Sep 6, 2025

View reviewed changes

pmnlla suggested changes Sep 6, 2025

View reviewed changes

alx-alexpark reviewed Sep 6, 2025

View reviewed changes

cyteon requested changes Sep 6, 2025

View reviewed changes

cyteon marked this pull request as draft September 6, 2025 20:11

zachlatta and others added 8 commits September 6, 2025 16:50

Update OctoDNS to modern version while keeping original workflow

a500993

- Updated pip install to 'octodns>=1.5.0' octodns-cloudflare - Kept original dry-run command and DNSimple env vars

Add Cloudflare token to test workflow environment

239dcb0

Now includes both DNS provider tokens: - DNSIMPLE_ACCOUNT_NUMBER for DNSimple zones - CLOUDFLARE_TOKEN for Cloudflare zones (hackclub.com)

Add DNSimple provider and API key to test workflow

8e01d0c

- Added octodns-dnsimple to pip install - Added DNSIMPLE_API_KEY environment variable - Now supports both Cloudflare and DNSimple for full testing

Disable Cloudflare proxy for daydream.hackclub.com

5436e3e

Removed proxied: true setting to allow direct connection to a.selfhosted.hackclub.com

Fix invalid ALIAS record in hack.club subdomain

629114e

- Change hack.club.hack.club ALIAS to CNAME - Resolves ValidationError: non-root ALIAS not allowed Co-authored-by: Amp <amp@ampcode.com> Amp-Thread-ID: https://ampcode.com/threads/T-40da4224-d685-4247-be5e-ff84a879afbb

Retrigger build - DNS errors resolved

5c331b2

Co-authored-by: Amp <amp@ampcode.com> Amp-Thread-ID: https://ampcode.com/threads/T-40da4224-d685-4247-be5e-ff84a879afbb

zachlatta commented Sep 6, 2025

View reviewed changes

zachlatta marked this pull request as ready for review September 6, 2025 22:25

zachlatta merged commit 4502844 into main Sep 6, 2025
3 checks passed

zachlatta deleted the cloudflare branch September 6, 2025 22:25

ajhalili2006 mentioned this pull request Sep 7, 2025

[meta] Update contributing guidelines docs/template regarding AI-generated/vibe coded contribs recaptime-dev/meta#3

Open

2 tasks

transcental mentioned this pull request Sep 7, 2025

Re-add conduct.hackclub.com email records #2014

Closed

Muirrum reviewed Sep 7, 2025

View reviewed changes

transcental reviewed Sep 7, 2025

View reviewed changes

feat: migrate hackclub.com DNS from DNSimple to Cloudflare #2009

feat: migrate hackclub.com DNS from DNSimple to Cloudflare #2009

Uh oh!

Conversation

zachlatta commented Sep 6, 2025

Uh oh!

alx-alexpark left a comment

Choose a reason for hiding this comment

Uh oh!

pmnlla left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cyteon left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

(ps im not a dns reviewer)

Uh oh!

zachlatta commented Sep 6, 2025

Uh oh!

cyteon commented Sep 6, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Muirrum left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

cyteon left a comment •

edited

Loading