Request to create domain snowflake-broker-debianupgradestaging-j33r3zahe.torproject.net with correct CAA record

Hi! We are currently upgrading the version of debian distribution that is running snowflake broker, which is using an expired version of debian: tpo/anti-censorship/pluggable-transports/snowflake#40349 (closed)

And we have setup a new machine with an almost entirely new systemd based setup, which is currently operating as a staging environment and is awaiting a test before switching to production.

One of the thing that is currently untested is acme with CAA record, so I decided to request a staging domain be setup before we switch the dns record for the real domain and test the acme certificate issue setup.

The purposed domain name: snowflake-broker-debianupgradestaging-j33r3zahe.torproject.net is self-explainable in English and completely impossible to be typed in by mistake, so even in the very unlikely case if something goes wrong the scope is limited.

CAA information:

CA_EMAIL='shelikhoo@torproject.org'
ACCOUNT_URL='https://acme-v02.api.letsencrypt.org/acme/acct/1953474386'
CA_KEY_HASH='1Mm3ci9yVzfVPO1jl9QGgcXGbhv1RPtaOF84RXl4XkY='

This CAA information will be requested to be also added to snowflake-broker.torproject.net at a later time.

See also: #41462 (closed)

changed the description

added Next label

assigned to @anarcat

Actually there are some back and forth about the choice about ACME tool. Please try to make sure it would be possible or convenient to switch to another account in the future. tpo/anti-censorship/pluggable-transports/snowflake#40349 (comment 3081237) Thanks!

assigned to @lavamind and unassigned @anarcat

added Doing label and removed Next label

I can create a CAA record without issue, but perhaps you also need snowflake-broker-debianupgradestaging-j33r3zahe.torproject.net to actually point somewhere?

added Needs Information label and removed Doing label

Yes, please point it to:

37.218.242.175
2a00:c6c0:0:151:4:ae99:c0a9:d585

with CAA record updated to:

https://acme-v02.api.letsencrypt.org/acme/acct/1975112607

(I was asked to switch to certbot...)

Alright, new DNS records deployed!

closed

added Doing label and removed Needs Information label

marked this issue as related to #41878 (closed)