iter-17: DNSSEC, wildcard certs, and DNS record scans by ractive · Pull Request #26 · ractive/hoppy

ractive · 2026-05-07T16:22:23Z

Summary

Add DNSSEC enable/disable/status endpoints to bunny-api-core and hoppy dns zone dnssec subcommands. Enable returns the DS record details users need to copy to their domain registrar; disable warns about resolution breakage and prompts for confirmation (--yes to skip).
Add wildcard TLS certificate issuance: POST /dnszone/{id}/certificate/issue and hoppy dns zone issue-cert --id <zone-id>.
Add async DNS record discovery scans: POST /dnszone/records/scan (accepts either zone_id or domain) plus GET /dnszone/{zoneId}/records/scan. CLI exposes them as hoppy dns zone scan start and hoppy dns zone scan results (option (a) from the iteration plan — separate trigger and fetch, matching the API shape).
New types: DnsSecDsRecord, DnsScanJobStatus, DnsDiscoveredRecordType, DnsDiscoveredRecord, DnsRecordScanTrigger, DnsRecordScanResult, TriggerDnsRecordScan. Fixtures and wiremock+insta tests added.
README updated with the new DNS subcommands; iteration plan tasks marked done; status moved to in-progress.

Test plan

cargo fmt --all clean
cargo clippy --workspace --all-targets -- -D warnings clean
cargo test --workspace --quiet all green (new wiremock tests cover DNSSEC enable/disable/404, cert issue success/404, scan trigger by zone-id and by domain, scan results with three discovered records)
CLI E2E tests cover JSON and table output for each new subcommand, including DS record display in dnssec enable table mode and the scan start arg-validation path
Live-API tests (live_dns_zone_dnssec_lifecycle, live_dns_zone_record_scan_lifecycle) — gated behind --features live-api; require a real bunny.net account
Manual: confirm wildcard cert issuance against a properly-delegated zone (cannot be exercised in CI)

🤖 Generated with Claude Code

Summary by CodeRabbit

Release Notes

New Features
- Added DNSSEC management (enable, disable, and status checking) for DNS zones
- Added wildcard TLS certificate issuance for DNS zones
- Added DNS record discovery scanning to identify existing records within a zone
Documentation
- Expanded DNS command documentation with DNSSEC and record scanning guidance

Adds DNSSEC enable/disable/status, wildcard TLS certificate issuance, and async DNS record discovery scans to the DNS service. Hand-written API clients in `bunny-api-core` and corresponding `hoppy dns zone …` CLI subcommands, with wiremock + insta tests and live-API E2E lifecycles. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

coderabbitai · 2026-05-07T16:22:30Z

Warning

Rate limit exceeded

@ractive has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 8 minutes and 7 seconds before requesting another review.

To unlock additional reviews, purchase usage credits in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Free

Run ID: 353101d3-3884-4b1e-868d-2cf6c18eacdd

📥 Commits

Reviewing files that changed from the base of the PR and between d9d182a and 1d9d4e1.

📒 Files selected for processing (4)

crates/bunny-api-core/src/client.rs
crates/bunny-api-core/src/types.rs
src/cli.rs
src/commands/dns.rs

📝 Walkthrough

Walkthrough

This PR extends the Bunny DNS API client and CLI with three new capabilities: DNSSEC management (enable/disable/status), free wildcard TLS certificate issuance, and DNS record discovery scanning. New API client methods wire the endpoints; CLI commands expose them with JSON or table output; and full E2E test coverage validates the flows.

Changes

DNS Security and Discovery Features

Layer / File(s)	Summary
Data Models `crates/bunny-api-core/src/types.rs`, `crates/bunny-api-core/src/lib.rs`	New public types added: `DnsSecDsRecord` (DNSSEC DS record fields), `DnsScanJobStatus` (enum), `DnsRecordScanTrigger`, `DnsRecordScanResult`, and supporting scan discovery types. Re-export list reformatted.
API Client Methods `crates/bunny-api-core/src/client.rs`	Five new async methods on `CoreClient`: `enable_dns_zone_dnssec`, `disable_dns_zone_dnssec`, `issue_dns_zone_wildcard_certificate`, `trigger_dns_record_scan`, `get_dns_zone_record_scan`. Import list expanded for new DTOs.
CLI Command Structure `src/cli.rs`	Three new `DnsZoneAction` variants added: `Dnssec` (delegates to `DnsDnssecAction`), `IssueCert`, and `Scan` (delegates to `DnsScanAction`). Subcommand enums support enable/disable/status and scan start/results.
CLI Handlers `src/commands/dns.rs`	Routing extended in `handle_zone`; new `handle_dnssec` (enable/disable with optional confirmation, status output); new `handle_scan` (start and results polling); display structs for table/JSON rendering.
Test Fixtures `fixtures/core/dnssec_.json`, `fixtures/core/dnszone_scan_.json`	Four JSON fixtures capture API responses for DNSSEC enable/disable and DNS record scan trigger/result payloads.
API Integration Tests `crates/bunny-api-core/tests/e2e/dns_api.rs`	New end-to-end tests validate DNSSEC enable/disable/error flows, wildcard certificate success/error, and DNS scan trigger by zone ID or domain with result assertions including discovered record types and priorities.
CLI Integration Tests `tests/e2e/cli_dns.rs`	Live API tests for DNSSEC lifecycle and scan polling; mocked E2E tests for enable/disable/status table output, wildcard certificate issuance confirmation, and scan start/results with mutually-exclusive option validation.
Documentation `README.md`, `hoppy-knowledgebase/iterations/iteration-17-dns-security.md`	README extended with command examples for DNSSEC, wildcard certificate, and DNS scanning. Iteration 17 status marked in-progress with all task items checked.

🎯 3 (Moderate) | ⏱️ ~25 minutes

A rabbit bounces through DNS with glee,
DNSSEC locked tight, as secure can be! 🔐
Wildcard certs bloom, record scans run free,
Three features now hop in perfect harmony. 🐰✨

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Copilot

Pull request overview

Adds new DNS security and migration features to Hoppy’s DNS surface area, spanning the bunny-api-core client, CLI subcommands, fixtures, and test coverage.

Changes:

Implement DNSSEC enable/disable/status in bunny-api-core and expose via hoppy dns zone dnssec ..., including DS record display on enable.
Add wildcard certificate issuance (hoppy dns zone issue-cert) backed by a new core client endpoint.
Add async DNS record discovery scans (trigger + results) with new types, fixtures, and wiremock/E2E coverage.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/e2e/cli_dns.rs	Adds CLI E2E coverage for DNSSEC, wildcard cert issuance, and scan trigger/results (plus live-api lifecycle tests).
src/commands/dns.rs	Implements new DNSSEC, wildcard cert, and scan handlers/output formatting in the CLI command layer.
src/cli.rs	Adds new clap subcommands/args for `dnssec`, `issue-cert`, and `scan start/results`.
README.md	Documents new DNS subcommands and capabilities.
hoppy-knowledgebase/iterations/iteration-17-dns-security.md	Updates iteration status and marks tasks complete.
fixtures/core/dnszone_scan_trigger.json	Adds fixture for scan trigger response.
fixtures/core/dnszone_scan_result.json	Adds fixture for scan results response.
fixtures/core/dnssec_enable.json	Adds fixture for DNSSEC enable response.
fixtures/core/dnssec_disable.json	Adds fixture for DNSSEC disable response.
crates/bunny-api-core/tests/e2e/dns_api.rs	Adds wiremock tests for DNSSEC, wildcard cert issuance, and record scan endpoints.
crates/bunny-api-core/src/types.rs	Introduces new DNSSEC + scan request/response types and enums.
crates/bunny-api-core/src/lib.rs	Re-exports newly added DNSSEC/scan types from the crate root.
crates/bunny-api-core/src/client.rs	Adds core client methods for DNSSEC, wildcard cert issuance, and scan trigger/results.

+        let json = serde_json::to_string_pretty(ds).expect("failed to serialize to JSON");
+        println!("{json}");


- Enforce one-of --id/--domain at parse time via clap ArgGroup - Propagate JSON serialization errors from print_dnssec (no panic) - Fix wildcard cert doc to correctly reference DNS-01 only - Clarify DnsDiscoveredRecordType numbering doc Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ractive requested a review from Copilot May 7, 2026 16:22

Copilot started reviewing on behalf of ractive May 7, 2026 16:23 View session

Copilot AI reviewed May 7, 2026

View reviewed changes

Comment thread src/commands/dns.rs Outdated

Comment on lines +568 to +569

let json = serde_json::to_string_pretty(ds).expect("failed to serialize to JSON");

println!("{json}");

ractive merged commit ca8655c into main May 7, 2026
6 of 8 checks passed

ractive deleted the iter-17/dns-security branch May 7, 2026 16:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

iter-17: DNSSEC, wildcard certs, and DNS record scans#26

iter-17: DNSSEC, wildcard certs, and DNS record scans#26
ractive merged 2 commits into
mainfrom
iter-17/dns-security

ractive commented May 7, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented May 7, 2026 •

edited

Loading

Rate limit exceeded

Walkthrough

Changes

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		let json = serde_json::to_string_pretty(ds).expect("failed to serialize to JSON");
		println!("{json}");

Conversation

ractive commented May 7, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Release Notes

Uh oh!

coderabbitai Bot commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rate limit exceeded

Walkthrough

Changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ractive commented May 7, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 7, 2026 •

edited

Loading