Deploy Hosted DNS to production and set Cloud's default endpoint

Parent

Spec: Hosted DNS, Cluster Domain and wildcard certificates

What to build

Hosted DNS runs in production on the provisioned Railway service (ployz-hosted-dns / api, custom domain dns.ployz.app) against the real apex zone, PlanetScale database and Google Trust Services account, and Cloud's PLOYZ_HOSTED_DNS_URL default points at it.

Acceptance criteria

A repeatable deploy of the service to Railway, with secrets in Railway variables (already set: AWS key, zone id, apex, DATABASE_URL).
A smoke run mints a name, publishes an address, resolves name and x.name publicly, obtains a wildcard from a CSR, and releases the name.
Cloud's default Hosted DNS URL is the production endpoint.
A mint key is generated, set in Hosted DNS MINT_KEYS and Hosted Cloud's PLOYZ_HOSTED_DNS_MINT_KEY; CLIENT_IP_HEADER=x-real-ip is set so the anonymous limit sees real caller IPs.

Blocked by

Carried over from Provision Hosted DNS infrastructure

Already in place: Railway ployz-hosted-dns / api (EU West), with dns.ployz.app verified and its TLS certificate valid. Variables are set: AWS_*, ROUTE53_HOSTED_ZONE_ID, HOSTED_DNS_APEX and DATABASE_URL.

Left for this ticket: create the Google Trust Services EAB key at deploy time. It comes from the GCP project ployz-acme (account nick@nickpotts.com.au), which already has publicca.googleapis.com enabled:

gcloud publicca external-account-keys create --project ployz-acme

Store GTS_EAB_KID and GTS_EAB_HMAC on Railway api. An unused EAB key expires after 7 days, and the service's first order binds it to an ACME account, so the service must persist its ACME account key (for example as a Railway variable) rather than re-registering. Also check that Railway's HTTP request timeout allows the synchronous multi-minute certificate call.

Smoke run against production (https://dns.ployz.app, deploy cb2e04f, europe-west4), 2026-09-25:

POST /domains (mint key)           201  m8rwajh2ot.ployz.app
PUT  records {a: [5.9.85.203]}     204
dig @1.1.1.1 name A                5.9.85.203
dig @8.8.8.8 x.name A              5.9.85.203   (*.name CNAME → name)
POST certificate (CSR name+*.name) 200 in 42 s  issuer GTS WR1, SAN name + *.name, leaf matches the CSR key
_acme-challenge TXT (authoritative) NXDOMAIN    challenge removed
DELETE /domains/name               204
POST lease after release           410          retired
dig name / x.name                  empty

Fixed on the way: GTS refuses ACME accounts with no contact, so the service now requires ACME_CONTACT_EMAIL (set to acme@ployz.app). Railway auto-deploys getployz/hosted-dns main; variables and the mint key are set, and the same mint key is set as PLOYZ_HOSTED_DNS_MINT_KEY on Ployz Dashboard web and worker. Cloud's default Hosted DNS URL (https://dns.ployz.app/) lands in #1061.

Navigation Menu

Repository navigation

Deploy Hosted DNS to production and set Cloud's default endpoint #1018

Parent

What to build

Acceptance criteria

Blocked by

Carried over from Provision Hosted DNS infrastructure

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Deploy Hosted DNS to production and set Cloud's default endpoint #1018

Description

Parent

What to build

Acceptance criteria

Blocked by

Activity

nick-potts commented on Sep 25, 2026

Carried over from Provision Hosted DNS infrastructure

nick-potts commented on Sep 25, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions