Validate the legacy DNS Terraform project (Porkbun bulk changes)

Relocated from dezren39/darwin-nix#974 on 2026-10-28 (placement audit): legacy Porkbun DNS Terraform project — Drew's Porkbun configuration lives in developing-today/code (infra), so the validation project belongs beside it. Original body below; issue references inside it are historical (dezren39/nix numbering).

There is a Terraform project from a couple of years ago that manages DNS for Drew's Porkbun domains, built for mass/bulk changes. Its current state is unknown: it may or may not still match reality, and bulk-apply tooling that has drifted is dangerous.

Work (read-only validation — NO apply without Drew's explicit go-ahead)

Locate the project (repo, state backend, where state lives) and identify which domains/zones it manages, including which Porkbun account they sit in.
terraform validate and a read-only terraform plan against current state; report whether it plans cleanly.
Diff the project's declared records against live Porkbun DNS for the managed zones; report drift (records changed outside Terraform, records in Terraform that no longer exist, zones/domains moved or lapsed).
Assess the state file itself: age, backend health, provider version pins, whether the Porkbun provider credentials it expects still exist (note the second Porkbun account's API access is a separate open item — see the account-connection campaign).
Also check: the project's YAML DNS config — confirm whether it is embedded in the fleet's semantic index; per Drew, configs of this class should qualify for embeddings. Report its embedding status and file the gap if it is missing.

Done when

A written verdict exists: safe to keep using for bulk changes as-is / safe after listed repairs / retire it — with the drift report attached. No DNS changes are made by this issue.

Acceptance criteria

The legacy Porkbun DNS Terraform project is located (repo, state backend, state location) and the domains/zones it manages are listed, including which Porkbun account they sit in.
terraform validate and a read-only terraform plan are run and reported — NO apply or DNS change is made under this issue.
A drift report compares the project's declared records against live Porkbun DNS for the managed zones (out-of-Terraform changes, stale records, moved/lapsed zones).
The state file is assessed: age, backend health, provider version pins, and whether the Porkbun provider credentials it expects still exist.
The project's YAML DNS config embedding status in the fleet semantic index is reported, and the gap is filed if it is missing.
A written verdict is posted: safe as-is / safe after listed repairs / retire it.

CODE-787

@dezren39

History carried over from dezren39/darwin-nix#974 (verbatim, oldest first):

@developing-today[bot] · 2026-10-27T19:48:02Z

NIX-195

@dezren39 · 2026-10-27T19:49:59Z

Location + embeddings findings (2026-10-27, same-day legwork): the project lives in developing-today/code, infra/dns/ — OpenTofu (a 21 MB terraform.log from a 2024-08-13 tofu init DEBUG run is tracked there) with the zone config at infra/dns/dns_config.yaml. Validation work should start from that directory.

Embeddings (item 5): checked — dns_config.yaml is NOT in the fleet's memory embedding index. Memory holds only incidental prose about the project (the terraform.log hygiene note, the Oct-2025 Porkbun inventory), not the config itself. Per Drew (2026-10-27): configs of this class (infrastructure-defining YAML) qualify for embeddings — closing that gap is part of this issue's done criteria.

@dezren39 · 2026-10-28T00:58:51Z

Intake review

Fleet-monitor intake pass (2026-10-28): verified still live — filed by Drew with no labels; the legacy Porkbun DNS Terraform project's state is, per the body, simply unknown, and no validation has been posted anywhere. Labels applied: kind/infrastructure, source/human, priority/normal, effort/m, status/needs-triage.

Related: the second Porkbun account's API access is a separate open item in the account-connection campaign (per the body, item 4) — credential availability may bound step 4, and that should be reported, not worked around.
Notes: the body's "### Done when" is a verdict, not a checklist; an ## Acceptance criteria section has been appended in checklist form (original body preserved verbatim above it).
Risks: this tooling can make bulk DNS changes — the read-only boundary (validate + plan + drift read, NO apply) is a hard guardrail for whoever picks this up. A drifted state file makes even plan output misleading; the state assessment (item 4) should come before trusting the plan.
Suggested approach: locate + state assessment first, then validate/plan, then the live-DNS diff; end with the written verdict on this issue.

@dezren39 · 2026-10-28T03:28:40Z

Triage note (issue-sweep-rotating, 2026-10-27 22:24 CDT run) — step 1 partial evidence:

Searched the full tracked tree of dezren39/nix at current main b273c47: there are no Terraform files (no *.tf, no terraform-named paths) and no Porkbun references in any tracked .md/.nix/.tf/.yaml/.yml file. So the legacy DNS Terraform project does not live in this repo — its location (another repo or one of Drew's machines), its state backend, and whether the Porkbun provider credentials it expects still exist all remain open and need Drew-side knowledge.

No validation/plan was attempted: there is nothing in this repo to run it against, and per the issue body no apply is authorized. Issue stays open, status/needs-triage unchanged; next action is locating the project outside this repo.

agent-note:v1
state: triaged (coverage pass)
Coverage pass 2026-11-03: reviewed in the fleet-wide per-issue pass (drift / overlap / already-handled / stale / blockers / ordering). Verdict: still live; queued in repo-health-code-pilot as triage at priority 40 (priority/normal). If this is already handled at current main, the triage closes it with evidence; if it needs splitting, the triage files the split.
Found via: coverage pass 2026-11-03

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), OpenChamber scheduled lane (aea12c82-c5af-4e5a-9b66-f8e360f87177)
Session / ID: queue task 7756 (triage, 2026-11-03 coverage pass)
Found via: queue claim
Task: Triage Validate the legacy DNS Terraform project (Porkbun bulk changes) — read-only #1860 at current main — confirm whether the read-only validation is still live/unhandled, and either close with evidence or split the remaining work with blockers and ordering recorded.
Expectation: done = verdict on this issue with evidence from current main (validation delivered 2026-10-30, config repair merged as PR fix(infra/dns): repair TTL config (300->600), pin providers, honour lock in init.sh (#1860) #2730), remaining items either closed or split with their blocker named. Still read-only: no apply, no DNS mutation.

🤖 Agent note · triaged → closing as delivered; write-side split out to #4989

Agent: queue worker (repo-worker-code), OpenChamber scheduled lane (aea12c82-c5af-4e5a-9b66-f8e360f87177)
Session / ID: queue task 7756 (triage, 2026-11-03 coverage pass)
Verdict: the read-only validation this issue asks for is done; the only work left is the DNS write window, which this issue explicitly excludes — split to infra/dns apply window: clear the phantom state entry, re-save encrypted state, decide the 9 unmanaged developing-today.com records — needs Drew's go-ahead #4989 and blocked on Drew's go-ahead. No DNS change was made by this triage.

Re-verified at current `main` (`d3476bce`, 2026-11-03)

No open PR touches infra/dns; no competing issue owns this work.
git diff ba5229e9(PR #2730 merge) HEAD -- infra/dns is empty — the tree is byte-identical to the repaired tree: dns_config.yaml 151 records all ttl: 600, zero at 300; main.tf pins cullenmcdermott/porkbun 0.3.0 + carlpett/sops 1.1.1; init.sh no longer hardcodes -upgrade.
terraform.tfstate.enc blob sha256 21b74bb7… is identical to its Jan-2025 commit (71f1566e7) — state untouched since the validation snapshot (serial 84, TF 1.8.7, sops-encrypted, local backend).
Therefore the 2026-10-30 read-only result still stands at main: tofu validate OK, tofu plan exit 0, zero TTL errors (was 151), Plan: 0 to add, 0 to change, 1 to destroy (the known state-only phantom).

Acceptance criteria (from the body) — all satisfied

Project located: developing-today/code infra/dns, local backend, sops-encrypted committed state terraform.tfstate.enc; 39 zones listed; all in the primary Porkbun account ✅ (2026-10-30 verdict)
terraform validate + read-only plan run and reported, no apply ✅ (same comment)
Drift report: 151 declared records, 0 stale/content-changed; 282 live-but-not-declared classified, incl. 9 real out-of-Terraform records on developing-today.com ✅
State assessed: age (Jan-2025), backend, pins (main.tf had none → repaired in PR fix(infra/dns): repair TTL config (300->600), pin providers, honour lock in init.sh (#1860) #2730), credential presence confirmed by ping SUCCESS (values never read) ✅
dns_config.yaml embedding status reported; gap filed as infra/dns/dns_config.yaml is not embedded in any fleet semantic index found in this repo #2469 (still open) ✅
Written verdict posted: safe after listed repairs ✅

Remaining work and where it now lives

Repairs 1 and 3 of that verdict (TTL 300→600, provider pins + init.sh lock handling) landed in PR #2730. Repairs 2, 4 and 5 are write operations — phantom state entry removal, state re-save after the first repaired apply, and the import-or-document decision for the 9 forwarding/Pages records. They cannot proceed under this issue's "no apply, no DNS change" boundary, so they are split to #4989, labelled status/blocked + user/escalated: they need Drew's explicit apply-window go-ahead. #2469 tracks the embedding gap independently.

Closing #1860 as delivered. If the split issue turns out to need a different shape (e.g. Drew prefers the apply window folded back here), reopen and say so — nothing about the validation needs redoing.

Navigation Menu

Repository navigation

Validate the legacy DNS Terraform project (Porkbun bulk changes) — read-only #1860