From 7c600055826f823efb134cb5e69a6c784d3d6649 Mon Sep 17 00:00:00 2001 From: Wessel Verheij Date: Mon, 27 Jul 2026 20:03:07 +0200 Subject: [PATCH] chore(dns): drop the zone file from the site repository MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The zone was a snapshot of records that live in Cloudflare, and Cloudflare is where they are actually edited. A copy here has no mechanism keeping it in step: nothing imports it, nothing validates it, and nothing fails when the two diverge — so its only guaranteed property over time is being wrong in a way that looks authoritative. It also sat in the wrong repository. This one builds a static site; DNS for the apex is infrastructure the site has no relationship with beyond being served at the end of it. The content is not lost — it remains in history at 052224c, which is the right place for a record of what was configured and when. Signed-off-by: Wessel Verheij --- dns/beatrax.app.zone | 56 -------------------------------------------- 1 file changed, 56 deletions(-) delete mode 100644 dns/beatrax.app.zone diff --git a/dns/beatrax.app.zone b/dns/beatrax.app.zone deleted file mode 100644 index 53720df..0000000 --- a/dns/beatrax.app.zone +++ /dev/null @@ -1,56 +0,0 @@ -; beatrax.app — Cloudflare DNS zone -; -; Import: Cloudflare dashboard → beatrax.app → DNS → Records -; → Import and Export → Import DNS records → upload this file. -; -; Set every A, AAAA and CNAME record below to DNS only (grey cloud) until -; GitHub has issued the certificate for beatrax.app. Proxying before then -; hides the origin from GitHub's validation and the certificate never issues. -; Once "Enforce HTTPS" is available under the repository's Pages settings, -; proxying can be turned on if you want Cloudflare in front of it. -; -; .app is on the HSTS preload list, so browsers refuse plain HTTP for this -; domain by policy. That is the intended behaviour and needs no record. - -$ORIGIN beatrax.app. -$TTL 3600 - -; ── Apex → GitHub Pages ─────────────────────────────────────────────── -; The four published Pages anycast addresses. All four belong here; GitHub -; balances across them, so dropping one costs availability for no gain. -@ 3600 IN A 185.199.108.153 -@ 3600 IN A 185.199.109.153 -@ 3600 IN A 185.199.110.153 -@ 3600 IN A 185.199.111.153 -@ 3600 IN AAAA 2606:50c0:8000::153 -@ 3600 IN AAAA 2606:50c0:8001::153 -@ 3600 IN AAAA 2606:50c0:8002::153 -@ 3600 IN AAAA 2606:50c0:8003::153 - -; ── www → the same site ─────────────────────────────────────────────── -; GitHub redirects www to the apex on its own, because the repository's -; CNAME file names the apex. No redirect rule is needed here. -www 3600 IN CNAME beatrax-app.github.io. - -; ── GitHub organisation verification ────────────────────────────────── -; Proves beatrax-app owns this domain. That is what lets Pages sites in the -; organisation serve it, and what stops anyone else from claiming it. -_github-challenge-beatrax-app-org 3600 IN TXT "0b5a763863f5ae4b2231a4dc9d2549" - -; ── Certificate authority authorisation ─────────────────────────────── -; Pages certificates come from Let's Encrypt. digicert and pki.goog are the -; authorities Cloudflare issues its own edge certificates from, so they stay -; authorised in case these records are proxied later. -@ 3600 IN CAA 0 issue "letsencrypt.org" -@ 3600 IN CAA 0 issue "digicert.com" -@ 3600 IN CAA 0 issue "pki.goog" -@ 3600 IN CAA 0 issuewild ";" - -; ── Mail: this domain sends none ────────────────────────────────────── -; A domain with no mail policy is a free spoofing target. These say, in the -; three places a receiver looks, that nothing legitimate is ever sent from -; beatrax.app. -@ 3600 IN MX 0 . -@ 3600 IN TXT "v=spf1 -all" -_dmarc 3600 IN TXT "v=DMARC1; p=reject; rua=mailto:info@nightworks.io; aspf=s; adkim=s" -*._domainkey 3600 IN TXT "v=DKIM1; p="