Bug: my self-hosted GitHub Actions experiences failures when files owned by root are
introduced in the runner user's homedir. I'm not sure how they're introduced because
runner doesn't have sudo access, but this ugly workaround will prevent the problem
from getting too bad.
Fixes, from GitHub Actions: <https://github.com/cunnie/sslip.io/actions/runs/16803947661/job/47591559499>
```
Error: File was unable to be removed Error: EACCES: permission denied, rmdir '/home/runner/actions-runner/_work/sslip.io/sslip.io/.github/workflows'
```
Now that our GitHub Actions workflow is functional, let's brag about how
many queries / second we're handling by displaying the badge at the top
of the README and of the web page.
Claude assures me this will fix the problem. Really.
Fixes, when running GitHub Action:
```
Deploy to gist
[INFO] Action failed with "Error: ENOENT: no such file or directory, open '/home/runner/actions-runner/_work/sslip.io/sslip.io/tmp/qps.json'"
```
The number of queries per second we handle is simply ginormous (> 20k!),
and I'd like to be able to communicate that to the user via a badge.
This commit has a GitHub Actions workflow that kicks off every six
hours to gather the current queries per second and create a JSON file
which is pushed to a gist which is used to create a shields.io badge.
Note: I'd normally test the Actions before I pushed, but it seemed
overly-complicated and brittle. So I'm taking the YOLO (you only live
once) approach, and pushing and hoping it works.
- some of the examples to use "nip.io" instead of "sslip.io". I like
"nip.io" better; it's shorter
- The examples that previously used "jammy" now use "noble"; "jammy" is
no longer the latest Ubuntu "Long Term Support" (LTS) release
Default PTR record domain has changed from "sslip.io" to "nip.io".
For example, `dig -x 127.0.0.1 @ns.nip.io` previously returned
`127-0-0-1.sslip.io.`, now returns `127-0-0-1.nip.io.`
Previously, the PTR domain was hard-coded to `sslip.io.`, but this
commit introduces two changes:
- the default PTR domain is now `nip.io.`. Hey, it's shorter.
- the PTR domain can now be set with the `-ptr-domain` flag, e.g. `go
run main.go -ptr-domain=xip.example.com` and then querying `dig -x
169.254.169.254` would return `169-254-169-254.xip.example.com.`
Notes:
- Our new flag, `-ptr-domain`, follows the kebab-case convention of
Golang flags, but this is inconsistent with our previous camelCase
convention, e.g. `-blocklistURL`. We didn't know any better, and it's
too late to change existing flags.
- removed two comment-out `panic()` whose purpose has long since been
forgotten
- I don't feel bad about changing the default behavior because hardly
anyone uses PTR lookups. Out of 12,773,617,290 queries, only 1564 were
PTR records (0.000012%)!
- In that vein, I acknowledge that this is a feature that no one's
clamoring for, no one will use, but it's important to me for reasons
that I don't fully understand.
When using the default addresses, the server would start with a warning
caused by an extra comma at the end of the last `-addresses` argument.
This commit removes that errant comma.
Fixes, when server starts:
```
-addresses: arguments should be in the format "host=ip", not ""
```
- Even though I don't use BOSH anymore, I couldn't change the image name
"fedora-golang-bosh" because it's used in too many places
- Bumped BOSH to the latest version
- reformatted via VS Code; it looks like everything has changed, but the
changes were actually minor
- Spent far too much time trying to get Powerlevel10k's gitstatusd
loaded during build instead of when the container was run, but I gave
up after several attempts
- replaced "fasd" with "autojump"
- deprecated the MAINTAINER directive in favor of the LABEL directive
We test our four production nameservers using `rspec`, and although that
worked fine when we used GitHub actions with a curated Ruby, it didn't
always work as well when running locally.
With this commit we introduce a Gemfile which has the necessary Ruby
dependencies, which make it easer to run the tests locally.
Instead of checking only sslip.io, we expand our [4-times-per-day]
nameserver checks to include nip.io. This is a component of the
long-running campaign to promote the nip.io domain to full citizenship.
I measured the performance penalty of the 725-entry blocklist, and it
clocks in a 3% to 12%. I want to replace the painful for-loop with a
map, assuming the map works more quickly.
- "nip.io" is in the title
- "wildcard" NS ns.nip.io is used in examples
- nip.io is used for special TXT queries (ip, version, metrics)
- bump Bootstrap v3.7.7 -> v5.3.7
- freshen metrics
- describe metric "Blocked"
nip.io has the complete set of NS records that sslip.io has. Previously
all the nameservers had only sslip.io records, e.g. ns-ovh.sslip.io.
With this commit, we now duplicate the nameservers, so now there's an
ns-ovh.nip.io as well. This also includes the "wildcard" record,
ns.sslip.io.
This unlocks the ability to use the shorter "nip.io" domain for certain
lookups, e.g. "dig txt @ns.nip.io ip.nip.io", whereas previously I'd
have to do "dig txt @ns.sslip.io ..."
`nip.io` is a better domain name, shorter and more apropos (the "ssl" of
"sslip.io" has long since lost its relevance), so I use more examples of
nip.io.
Signed-off-by: Brian Cunnie <brian.cunnie@gmail.com>
This reverts commit dea655a990.
The Public Suffix List (PSL) denied our pull request to add sslip.io to
their list: <https://github.com/publicsuffix/list/pull/2206>
So there's no reason to keep their TXT record around; it only adds to
the clutter.
I want to promote nip.io to the same status as sslip.io, same features,
same special TXT records.
This will allow me to write automated health checks for both nip.io and
sslip.io instead of only sslip.io
Side note: I prefer the shorter "nip.io". I went with "sslip.io" when
Sam Stephenson suggested it even though I thought that "tlsip.io" would
be more apropos (TLS had long since replaced SSL), and within a month
the domain name didn't make sense because Comodo had revoked our
certificate.
- ip.nip.io returns the IP address TXT record
- version.status.nip.io returns the version information in a TXT record
- metrics.status.nip.io returns the metrics information in a TXT record
The Sender Policy Framework (SPF) TXT records remain different for both
domains.
sslip.io Public Suffix List (PSL) TXT remains & was not implemented for
nip.io. The PSL has denied our PR to add sslip.io to the list. That TXT
record will be removed in a future commit.
I backfilled unit tests for {version,metrics].status.{nip,sslip}.io.
Drive-by: A `for` loop was rewritten as a `copy()` at the behest of the
linter.
I have a test helper which produces a random 8-character string
consisting of mixed-case alphabetic characters; however, there's a small
chance (6/26^8 == 0.0008%) that it would produce a valid 8-character
hexadecimal string, which could be mistakenly recognized as an IP
address, which _might_ break a test.
Out of an abundance of caution, I guard against producing an 8-byte
string that might be accidentally recognized as 8-byte hexadecimal
notation by making sure the first & last bytes are NOT hex characters.
The Nameservers test (in GitHub Actions), fails ~25% of the time, almost
invariably ns-do-sg.sslip.io (I don't know whether it's Digital Ocean's
fault or the large distance between my GitHub Actions runner &
Singapore).
The failures are noisy, typically one day, and have led me to stop
checking the status of my nameservers, which defeats the purpose.
This commit attempts to reduce the failures by increasing both the
timeout and the retries. We are nothing if not persistent.
- the sslip.io favicon wasn't working, a side effect of switching away
from k8s. I now hard-code the favicon.ico to https://sslip.io so that
I don't need to copy it to all the mirrors
- the nip.io favicon wasn't working, I forgot to copy it from
Roopinder's site, so I'm using sslip.io's icon instead
- Similarly, I forgot to copy Roopinder's `app.css`; oh well, the
styling looks good enough
- remove `ie10-viewport..`; it 404'ed. Besides, who uses Windows 8?
- remove `starter-template.css`; I couldn't see any obvious difference,
and I'm a big fan of keeping things simple, including the minimum
number of files. Also, the comment about IE8 made no sense.
- got rid of the warning about deprecating ns-azure & ns-aws; they've
been gone for over six months. It wasted space & mind share
- moved the alert about indexing to the bottom; I never cared about
impostor sites, but accommodated Morty Feldman, and he appears to have
lost interest (his last PR was nine months ago, 2024-09-19)
- updated instructions for updating the website when rolling out new
releases
- We don't use JetBrains anymore; we use VS Code
- We don't have a CI directory
- Jenessa is no longer at Let's Encrypt
- Roopinder is now the "late Roopinder" 😢
Prior to switching to GitHub actions, I used Concourse CI to run
continuous integration, but I didn't switch all the URLs over to GitHub
actions.
This commit fixes that by switching over the last two occurrences of
ci.nono.io.
- Include hexadecimal example. Use the nip.io domain name because those
are the users that want hexadecimal.
- Update the nip.io website to no longer mention that sslip.io doesn't
have hexadecimal notation. It has hexadecimal notation.
- Make nip.io more prominent in the sslip.io website. Heck, it's a
shorter domain name. A better domain name.
- Update that nip.io is incorporated into sslip.io
TODO: expand the
e.g. `00000000000000000000000000000001.nip.io` → ::1
This is to bring parity with IPv4's hexadecimal notation, though IPv6's
hexadecimal notation is so clunky that I doubt it'll ever be used.
- The hexadecimal-notated IPv6 must be exactly 32 hexadecimal
characters, no separators.
- Any hexadecimal notation _must_ be bookended by dots or by the
beginning or end of the string
(www.0000000000000000000000000000001.sslip.io or
00000000000000000000000000000001.sslip.io). No dashes.
- If a normal IP notation and a hex notation are in the same hostname,
then the normal IP notation takes precedence. This preserves existing
behavior for sslip.io users, e.g.
(00000000000000000000000000000001.2600--.nip.io resolves to 2600::,
not ::1)
e.g. `7f000001.sslip.io` → 127.0.0.1
This came about as a result of the nip.io migration to sslip.io servers:
nip.io supported hexadecimal notation; sslip.io didn't. Several nip.io
users were blindsided by the feature's lack, and raised an issue.
- The hexadecimal-notated IPv4 must be exactly 8 hexadecimal characters,
no separators.
- Any hexadecimal notation _must_ be bookended by dots or by the
beginning or end of the string (www.0a09091e.sslip.io or
0a09091e.sslip.io). No dashes.
- If a normal IP notation and a hex notation are in the same hostname,
then the normal IP notation takes precedence. This preserves existing
behavior for sslip.io users, e.g. (0a09091e.127-0-0-1.sslip.io
resolves to 127.0.0.1, not 10.9.9.30)
[#92]
rand.Seed() has been deprecated since Golang 1.20, and is now a no-op:
Deprecated: As of Go 1.20 there is no reason to call Seed with a random
value. Programs that call Seed with a known value to get a specific
sequence of results should use New(NewSource(seed)) to obtain a local
random generator.
As of Go 1.24 Seed is a no-op.
And the reason I used it — to reproduce failures if necessary — has
never been necessary.
ns-ovh-sg, at $60/month, was an expensive experiment. I suspected the
traffic would be voluminous, matching ns-ovh. That wasn't the case: it
wasn't even a tenth of the traffic.
The Digital Ocean droplet costs ~$24/month, almost a third of the OVH
offering,
```
ns-do-sg.sslip.io
"Queries: 33781674 (641.4/s)"
ns-hetzner.sslip.io
"Queries: 89852958 (1716.1/s)"
ns-ovh.sslip.io
"Queries: 661406550 (12670.2/s)"
```
Rather than buy the Roopinder dedication in the third line, it's now its
own banner at the top, replacing the navbar which long ago lost its
purpose (a holdover when we had several pages).
- Proton insists on have a TXT record before adding that domain, and we
comply with "protonmail-verification=19b0837cc4d9daa1f49980071da231b00e90b313"
- We add A & AAAA records for nip.io, identical to sslip.io's.
- We add convenience records for ns1.nip.io and ns2.nip.io to eliminate
the dreaded automated message "dig: couldn't get address for
'ns1.nip.io': not found"
Slight tweak: I want every WHOIS nameserver to be reflected in the NS
records, but I also want to allow for additional NS records.
Specifically, I've paid the Google Cloud Platform (GCP) "Committed Use
Discounts" for `ns-gce.sslip.io`, but it attracts *lots* of traffic, and
that can easily incur $100+ in bandwidth charges per month. To tamp down
on traffic, I don't include `ns-gce` in the whois nameservers, but I do
include it in the NS records.
But then my tests fail, so this commit tweaks the tests so that as long
as the NS records are a superset of the whois records, I'm fine
(previously they had to match).
Fixes, when running `DOMAIN=sslip.io rspec --format documentation
--color spec/`:
```
rspec './spec/check-dns_spec.rb[1:3]' # sslip.io nameserver ns-ovh.sslip.io.'s NS records match whois's ["ns-ovh.sslip.io.", "ns-hetzner.sslip.io.", "ns-do-sg.sslip.io."], `dig @ns-ovh.sslip.io. ns sslip.io +short`
rspec './spec/check-dns_spec.rb[1:18]' # sslip.io nameserver ns-hetzner.sslip.io.'s NS records match whois's ["ns-ovh.sslip.io.", "ns-hetzner.sslip.io.", "ns-do-sg.sslip.io."], `dig @ns-hetzner.sslip.io. ns sslip.io +short`
rspec './spec/check-dns_spec.rb[1:33]' # sslip.io nameserver ns-do-sg.sslip.io.'s NS records match whois's ["ns-ovh.sslip.io.", "ns-hetzner.sslip.io.", "ns-do-sg.sslip.io."], `dig @ns-do-sg.sslip.io. ns sslip.io +short`
```
We replace `ns-ovh-sg` with `ns-do-sg`; this is a purely financial
decision: `ns-ovh-sg` costs $60/month, $720/year.
`ns-do-sg` (Digital Ocean), is also a Singapore-based DNS server. It's a
basic-regular-2vcpu-4GiB RAM-80GB SSD-4TiB bandwidth for $24/month,
$288/year.
That's a yearly savings of $432.
I had originally overspec'ed the Singapore server because I suspected
that there was a ton of traffic in Asia; I was wrong. It's not even 20%
the traffic of Europe or North America. I am confident the Digital Ocean
server will be able to handle it.
I also reintroduce `ns-gce` as the second server in North America, backing
up `ns-hetzner`. My hope is that `ns-hetzner` carries most of the load,
and `ns-gce` carries the rest, but not so much as to trigger Google
Cloud Platform's (GCP's) expensive bandwidth billing.
| DNS server | Queries / second |
|:-----------|-----------------:|
| ns-hetzner | 10706.4 |
| ns-ovh | 10802.0 |
| ns-ovh-sg | 1677.7 |
When tests with long output fail, I have difficulty troubleshooting
because Gomega truncates the output at 4000 bytes. With this commit, we
tell Gomega not to truncate the output, which allows me to see what's
broken, which is invariably at the end of the output.
Fixes, when running `gingko -r .`:
```
Gomega truncated this representation as it exceeds 'format.MaxLength'.
Consider having the object provide a custom 'GomegaStringer' representation
or adjust the parameters in Gomega's 'format' package.
```
