From 1318c7db1efc8c8260315008a455b33562d994c2 Mon Sep 17 00:00:00 2001 From: Hiroshi SHIBATA Date: Tue, 8 Sep 2026 14:03:36 +0900 Subject: [PATCH 1/3] Remove retired debian11 host Debian 11 LTS ended on 2026-08-31 and the instance is stopped. The rubyci.org server entry stays like the other EOL hosts so the archived build logs remain reachable. Co-Authored-By: Claude Opus 5 --- hosts.yml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/hosts.yml b/hosts.yml index d4be6a2..77f66ea 100644 --- a/hosts.yml +++ b/hosts.yml @@ -48,13 +48,6 @@ rhel8.rubyci.org: run_list: - recipes/default.rb -debian11.rubyci.org: - properties: - nopasswd_sudo: true - compress: false - run_list: - - recipes/default.rb - openbsd.rubyci.org: properties: attributes: From ade764d826a171cbe716dd1d81a84221cfdc62ab Mon Sep 17 00:00:00 2001 From: Hiroshi SHIBATA Date: Tue, 8 Sep 2026 14:25:37 +0900 Subject: [PATCH 2/3] Remove the debian11 DNS record Elastic IPs get reassigned to other rubyci hosts, so a record left behind for a retired host ends up resolving to a live machine. Co-Authored-By: Claude Opus 5 --- dns/rubyci.org/dnsconfig.js | 1 - 1 file changed, 1 deletion(-) diff --git a/dns/rubyci.org/dnsconfig.js b/dns/rubyci.org/dnsconfig.js index 8207d66..68e1bd2 100644 --- a/dns/rubyci.org/dnsconfig.js +++ b/dns/rubyci.org/dnsconfig.js @@ -7,7 +7,6 @@ D("rubyci.org", REG_NONE, A("amazon2023", "35.72.97.116"), A("arch", "35.72.171.27"), A("crossruby", "54.65.185.15"), - A("debian11", "54.178.164.239"), A("debian12", "18.177.243.215"), A("debian13", "35.72.238.43"), A("debian", "35.73.95.28"), From cd0a605444b7bd09301a0f05850f994bdd04018d Mon Sep 17 00:00:00 2001 From: Hiroshi SHIBATA Date: Tue, 8 Sep 2026 14:22:37 +0900 Subject: [PATCH 3/3] Fix the local dnscontrol credential steps ~/.config/cloudflare/*/token.sh no longer exists, so both documented command sequences failed. The token is an ordinary environment variable and 1Password is only one way to supply it, which matters for the ruby-lang.org zone shared with other maintainers. Co-Authored-By: Claude Opus 5 --- dns/README.md | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/dns/README.md b/dns/README.md index ebab34a..a84a277 100644 --- a/dns/README.md +++ b/dns/README.md @@ -5,8 +5,17 @@ DNSControl configuration for the Cloudflare zones. One directory per zone, each - `rubyci.org/` — the CI hosts. Every rubyci host is resolved through DNS rather than `~/.ssh/config`, so a new host needs its record here before `bin/hocho apply`. The apex uses Cloudflare's CNAME flattening, which DNSControl expresses as `ALIAS`. - `ruby-lang.org/` — the project zone. +## Credentials + The API tokens are zone-scoped and therefore different per zone, so each `creds.json` reads an environment variable named after its zone. `rubyci.org/creds.json` reads `CLOUDFLARE_API_TOKEN_RUBYCI` and `ruby-lang.org/creds.json` reads `CLOUDFLARE_API_TOKEN_RUBY_LANG_ORG`. +No token is stored here, so that variable has to be in the environment before `dnscontrol` runs. Export it, or inject it from whichever secret store holds it. With 1Password, wrap the commands below in `op run` with the env file for the zone: + +``` +cd dns/rubyci.org +op run --env-file ~/.config/credentials/cloudflare-rubyci.org.env -- dnscontrol preview --creds creds.json +``` + ## rubyci.org Applied from CI by `.github/workflows/dns.yml`: a pull request runs `dnscontrol preview`, and merging to `master` runs `dnscontrol push`. The token comes from the repository secret `CLOUDFLARE_API_TOKEN_RUBYCI`. @@ -14,7 +23,6 @@ Applied from CI by `.github/workflows/dns.yml`: a pull request runs `dnscontrol To preview locally: ``` -source ~/.config/cloudflare/rubyci.org/token.sh cd dns/rubyci.org dnscontrol preview --creds creds.json ``` @@ -24,7 +32,6 @@ dnscontrol preview --creds creds.json Not applied from CI. The zone is shared with other maintainers, so `push` is run by hand after the change is reviewed: ``` -source ~/.config/cloudflare/ruby-lang.org/token.sh cd dns/ruby-lang.org dnscontrol preview --creds creds.json dnscontrol push --creds creds.json