src/openstreetmap.js

   1 D(DOMAIN, REGISTRAR, DnsProvider(PROVIDER),
   2
   3   // Publish CAA records indicating that only letsencrypt and globalsign (Fastly) should issue certificates
   4
   5   CAA_BUILDER({
   6     label: "@",
   7     ttl: "1h",
   8     iodef: "mailto:hostmaster@openstreetmap.org",
   9     issue: [
  10       "letsencrypt.org",
  11       "globalsign.com",   // Used by Fastly for CDN certificates
  12     ],
  13     issuewild: [
  14       "letsencrypt.org",
  15       "globalsign.com",   // Used by Fastly for CDN certificates
  16     ],
  17   }),
  18
  19   // Mail service
  20
  21   MX("@", 10, QUALIFY("a.mx")),
  22   MX("messages", 10, QUALIFY("a.mx")),
  23   MX("noreply", 10, QUALIFY("a.mx")),
  24   MX("otrs", 10, QUALIFY("a.mx")),
  25   MX("community", 10, QUALIFY("a.mx")),
  26   MX("supporting", 10, QUALIFY("a.mx")),
  27
  28   A("a.mx", IPV4["fafnir.he"]),
  29   AAAA("a.mx", IPV6["fafnir.he"]),
  30   A("mail", IPV4["fafnir.he"]),
  31   AAAA("mail", IPV6["fafnir.he"]),
  32   A("mta-sts", IPV4["fafnir.he"]),
  33   AAAA("mta-sts", IPV6["fafnir.he"]),
  34
  35   // Publish SPF records indicating that only shenron sends mail
  36
  37   SPF_BUILDER({
  38     label: "@",
  39     parts: [
  40       "v=spf1",
  41       "ip4:184.104.226.98",         // fafnir ipv4 (he.net)
  42       "ip6:2001:470:1:b3b::2",      // fafnir ipv6 (he.net)
  43       "ip4:87.252.214.98",          // fafnir ipv4 (equinix)
  44       "ip6:2001:4d78:fe03:1c::2",   // fafnir ipv6 (equinix)
  45       "ip4:193.60.236.0/24",        // ucl external
  46       "ip4:82.199.86.96/27",        // amsterdam external (equinix)
  47       "ip6:2001:4d78:500:5e3::/64", // amsterdam external (equinix)
  48       "ip4:87.252.214.96/27",       // dublin external (equinix)
  49       "ip6:2001:4d78:fe03:1c::/64", // dublin external (equinix)
  50       "ip4:184.104.179.128/27",     // amsterdam external (he.net)
  51       "ip6:2001:470:1:fa1::/64",    // amsterdam external (he.net)
  52       "ip4:184.104.226.96/27",      // dublin external (he.net)
  53       "ip6:2001:470:1:b3b::/64",    // dublin external (he.net)
  54       "mx",                         // safety net if we change mx
  55       "-all"
  56     ]
  57   }),
  58
  59   SPF_BUILDER({
  60     label: "messages",
  61     parts: [
  62       "v=spf1",
  63       "include:openstreetmap.org",  // main openstreetmap.org spf record
  64       "-all"
  65     ]
  66   }),
  67
  68   SPF_BUILDER({
  69     label: "noreply",
  70     parts: [
  71       "v=spf1",
  72       "include:openstreetmap.org",  // main openstreetmap.org spf record
  73       "-all"
  74     ]
  75   }),
  76
  77   SPF_BUILDER({
  78     label: "otrs",
  79     parts: [
  80       "v=spf1",
  81       "include:openstreetmap.org",  // main openstreetmap.org spf record
  82       "-all"
  83     ]
  84   }),
  85
  86   SPF_BUILDER({
  87     label: "community",
  88     parts: [
  89       "v=spf1",
  90       "include:openstreetmap.org",  // main openstreetmap.org spf record
  91       "-all"
  92     ]
  93   }),
  94
  95   SPF_BUILDER({
  96     label: "supporting",
  97     parts: [
  98       "v=spf1",
  99       "include:openstreetmap.org",  // main openstreetmap.org spf record
 100       "-all"
 101     ]
 102   }),
 103
 104   // Publish DKIM public key
 105
 106   TXT("20200301._domainkey", "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzvoNZVOGfw1V4A171hxHMhzVTAnIUQVJ8iX3wbqCld8A5iIaXeTGYvBmewymax/cYJS4QqzbpUzkgrrTA9avuZhd+QGJDgjADgx4VyMOaOS6FwAxS0uXtLrt+lsixRDx/feKyZHaxjzJAQy46ok77xXL4UXIaaovw6G6eZpIScMzZQ2zkKNJxTICzzSOduIilHhMWte4XP+/2PdRmD7Ge9jb0U4bZjswX0AqKSGzDKYw+yxVna9l53adeCnklqg2ofoXu+ResiH+kt05aCUOMo8en3em6yBnRCMalgi1E3Tt7I5BWcYFRkT/8agUGW4gGC6XMV9IskOsYL0emG0kGwIDAQAB", AUTOSPLIT),
 107
 108   // Publish DMARC report-only policy
 109
 110   DMARC_BUILDER({
 111     policy: "none",
 112     rua: [
 113       "mailto:openstreetmap-d@dmarc.report-uri.com"
 114     ],
 115     failureOptions: 1
 116   }),
 117
 118   // Announce MTA-STS policy and TLSRPT policy for error reports
 119
 120   TXT("_mta-sts", "v=STSv1; id=202001291805Z"),
 121   TXT("_smtp._tls", "v=TLSRPTv1; rua=mailto:openstreetmap-d@tlsrpt.report-uri.com"),
 122
 123   // Fastly cert domain ownership confirmation
 124
 125   TXT("@", "_globalsign-domain-verification=ps00GlW1BzY9c2_cwH_pFqRkvzZyaCVZ-3RLssRG6S"),
 126   TXT("@", "_globalsign-domain-verification=W0buKB5ZmL-VwwHw2oQyQImk3I1q3hSemf2qmB1hjP"),
 127
 128   // Facebook Business domain verification
 129
 130   TXT("@", "facebook-domain-verification=j5hix5i8r0kortfugqf2p9wx9x9by0"),
 131
 132   // Bluesky domain verification
 133
 134   TXT("_atproto", "did=did:plc:i6llv7iwybeipknl57v4dalb"),
 135
 136   // Delegate MTA-STS policy for subdomains
 137
 138   CNAME("_mta-sts.messages", QUALIFY("_mta-sts")),
 139   CNAME("_mta-sts.noreply", QUALIFY("_mta-sts")),
 140   CNAME("_mta-sts.otrs", QUALIFY("_mta-sts")),
 141   CNAME("_mta-sts.community", QUALIFY("_mta-sts")),
 142   CNAME("_mta-sts.supporting", QUALIFY("_mta-sts")),
 143
 144   // Google postmaster tools verification
 145
 146   CNAME("af323lytato5", "gv-o4v3qh5pfayqex.dv.googlehosted.com."),
 147   CNAME("irzdddnmh465", "gv-cwr6bvt7xsgact.dv.googlehosted.com."),
 148
 149   // Main web servers and their aliases
 150
 151   osm_web_service("@",    [ "spike-06",
 152                             "spike-07",
 153                             "spike-08"
 154                           ], { cfproxy: true }),
 155
 156   osm_web_service("www", [  "spike-06",
 157                             "spike-07",
 158                             "spike-08"
 159                           ], { cfproxy: true }),
 160
 161   osm_web_service("api", [  "spike-06",
 162                             "spike-07",
 163                             "spike-08"
 164                           ], { cfproxy: true }),
 165
 166   osm_web_service("maps", [ "spike-06",
 167                             "spike-07",
 168                             "spike-08"
 169                           ], { cfproxy: true }),
 170
 171   osm_web_service("mapz", [ "spike-06",
 172                             "spike-07",
 173                             "spike-08"
 174                           ], { cfproxy: true }),
 175
 176   // Nominatim servers
 177
 178   CNAME("nominatim", "nominatim.geo.openstreetmap.org."),
 179   CNAME("qgis.nominatim", "nominatim.geo.openstreetmap.org."),
 180   CNAME("qa-tile.nominatim", "longma.openstreetmap.org."),
 181
 182   // Tile servers
 183
 184   CNAME("tile", "dualstack.n.sni.global.fastly.net."),
 185   CNAME("a.tile", "dualstack.n.sni.global.fastly.net."),
 186   CNAME("b.tile", "dualstack.n.sni.global.fastly.net."),
 187   CNAME("c.tile", "dualstack.n.sni.global.fastly.net."),
 188
 189   osm_web_service("render", [ "culebre.he",
 190                               "nidhogg"
 191                             ]),
 192
 193   // Vector tile servers
 194
 195   CNAME("vector", "dualstack.n.sni.global.fastly.net."),
 196
 197   // Planet servers
 198
 199   A("backup", IPV4["norbert"]),
 200   AAAA("backup", IPV6["norbert"]),
 201   // A("backup", IPV4["horntail.he"]),
 202   // AAAA("backup", IPV6["horntail.he"]),
 203
 204   osm_web_service("planet", "norbert"),
 205   // osm_web_service("planet", "horntail.he"),
 206
 207   // Development server with wildcard alias for user sites
 208
 209   osm_web_service("dev",   "faffy"),
 210   osm_web_service("*.dev", "faffy"),
 211   osm_web_service("ooc",   "faffy"),
 212   osm_web_service("a.ooc", "faffy"),
 213   osm_web_service("b.ooc", "faffy"),
 214   osm_web_service("c.ooc", "faffy"),
 215   osm_web_service("npe",   "faffy"),
 216
 217   // Foundation server
 218
 219   osm_web_service("blog",       "ridley"),
 220   osm_web_service("foundation", "ridley"),
 221
 222   // Matomo server
 223
 224   osm_web_service("matomo", "smaug.he"),
 225   osm_web_service("piwik",  "smaug.he"),
 226
 227   // Imagery servers
 228
 229   osm_web_service("agri",   "lockheed"),
 230   osm_web_service("a.agri", "lockheed"),
 231   osm_web_service("b.agri", "lockheed"),
 232   osm_web_service("c.agri", "lockheed"),
 233
 234   osm_web_service("act-imagery",   "lockheed"),
 235   osm_web_service("a.act-imagery", "lockheed"),
 236   osm_web_service("b.act-imagery", "lockheed"),
 237   osm_web_service("c.act-imagery", "lockheed"),
 238
 239   osm_web_service("au-vic-melbourne-imagery",   "lockheed"),
 240   osm_web_service("a.au-vic-melbourne-imagery", "lockheed"),
 241   osm_web_service("b.au-vic-melbourne-imagery", "lockheed"),
 242   osm_web_service("c.au-vic-melbourne-imagery", "lockheed"),
 243
 244   osm_web_service("os",   "lockheed"),
 245   osm_web_service("a.os", "lockheed"),
 246   osm_web_service("b.os", "lockheed"),
 247   osm_web_service("c.os", "lockheed"),
 248
 249   osm_web_service("tiler", "lockheed"),
 250
 251   osm_web_service("us-imagery",   "lockheed"),
 252   osm_web_service("a.us-imagery", "lockheed"),
 253   osm_web_service("b.us-imagery", "lockheed"),
 254   osm_web_service("c.us-imagery", "lockheed"),
 255
 256   // Prometheus server and munin redirect
 257
 258   osm_web_service("prometheus", "stormfly-03"),
 259   osm_web_service("munin",      "stormfly-03"),
 260
 261   // Management server
 262
 263   osm_web_service("acme",     "idris.he"),
 264   osm_web_service("apt",      "idris.he"),
 265   osm_web_service("chef",     "idris.he"),
 266   osm_web_service("dns",      "idris.he"),
 267   osm_web_service("git",      "idris.he"),
 268   osm_web_service("hardware", "idris.he"),
 269
 270   // Bytemark machine, and the services which operate from it
 271
 272   osm_web_service("lists", "shenron"),
 273   osm_web_service("help",  "shenron"),
 274
 275   // Naga services
 276
 277   osm_web_service("svn",        "naga.he"),
 278   osm_web_service("trac",       "naga.he"),
 279   osm_web_service("irc",        "naga.he"),
 280   osm_web_service("blogs",      "naga.he"),
 281   osm_web_service("welcome",    "naga.he"),
 282   osm_web_service("operations", "naga.he"),
 283   osm_web_service("hot",        "naga.he"),
 284   osm_web_service("dmca",       "naga.he"),
 285   osm_web_service("otrs",       "naga.he", { h1: true, h2: false }), // OTRS is not available using HTTPS/2
 286   osm_web_service("birthday20", "naga.he"),
 287
 288   // Wiki servers
 289
 290   osm_web_service("wiki", "konqi.he"),
 291
 292   // Overpass server
 293
 294   osm_web_service("query", "grisu.he"),
 295
 296   // GPS tile server
 297
 298   osm_web_service("gps-tile",   "muirdris.he"),
 299   osm_web_service("a.gps-tile", "muirdris.he"),
 300   osm_web_service("b.gps-tile", "muirdris.he"),
 301   osm_web_service("c.gps-tile", "muirdris.he"),
 302   osm_web_service("gps.tile",   "muirdris.he"),
 303   osm_web_service("gps-a.tile", "muirdris.he"),
 304   osm_web_service("gps-b.tile", "muirdris.he"),
 305   osm_web_service("gps-c.tile", "muirdris.he"),
 306
 307   // Donation site and new OSMF crm site
 308
 309   osm_web_service("donate",     "ridley"),
 310   osm_web_service("support",    "ridley"),
 311   osm_web_service("supporting", "ridley"),
 312
 313   // Discourse server ("community")
 314
 315   osm_web_service("community",   "fume.he"),
 316   osm_web_service("communities", "fume.he"),
 317   osm_web_service("c",           "fume.he"),
 318   osm_web_service("forum",       "fume.he"),
 319
 320   CNAME("community-cdn", "dualstack.n.sni.global.fastly.net."),
 321   TXT("community", "google-site-verification=hQ8GZyj4KwnPqAX2oAzpbLrh6I5dfR08PSdL3icVkfg"),
 322
 323   // Taginfo and Staging Blog Server
 324
 325   osm_web_service("taginfo", "tabaluga"),
 326
 327   // Staging Blog Server
 328
 329   osm_web_service("staging.blog", "tabaluga"),
 330
 331 );