src/openstreetmap.js

   1 D(DOMAIN, REGISTRAR, DnsProvider(PROVIDER),
   2
   3   // Publish CAA records indicating that only letsencrypt and globalsign (Fastly) should issue certificates
   4
   5   CAA_BUILDER({
   6     label: "@",
   7     ttl: "1h",
   8     iodef: "mailto:hostmaster@openstreetmap.org",
   9     issue: [
  10       "letsencrypt.org",
  11       "globalsign.com",   // Used by Fastly for CDN certificates
  12     ],
  13     issuewild: [
  14       "letsencrypt.org",
  15       "globalsign.com",   // Used by Fastly for CDN certificates
  16     ],
  17   }),
  18
  19   // Mail service
  20
  21   MX("@", 10, QUALIFY("a.mx")),
  22   MX("messages", 10, QUALIFY("a.mx")),
  23   MX("noreply", 10, QUALIFY("a.mx")),
  24   MX("otrs", 10, QUALIFY("a.mx")),
  25   MX("community", 10, QUALIFY("a.mx")),
  26   MX("supporting", 10, QUALIFY("a.mx")),
  27
  28   A("a.mx", IPV4["fafnir"]),
  29   AAAA("a.mx", IPV6["fafnir"]),
  30   A("mail", IPV4["fafnir"]),
  31   AAAA("mail", IPV6["fafnir"]),
  32   A("mta-sts", IPV4["fafnir"]),
  33   AAAA("mta-sts", IPV6["fafnir"]),
  34
  35   // Publish SPF records indicating that only shenron sends mail
  36
  37   SPF_BUILDER({
  38     label: "@",
  39     parts: [
  40       "v=spf1",
  41       "ip4:184.104.226.98",         // fafnir ipv4 (he.net)
  42       "ip6:2001:470:1:b3b::2",      // fafnir ipv6 (he.net)
  43       "ip4:87.252.214.98",          // fafnir ipv4 (equinix)
  44       "ip6:2001:4d78:fe03:1c::2",   // fafnir ipv6 (equinix)
  45       "ip4:193.60.236.0/24",        // ucl external
  46       "ip4:82.199.86.96/27",        // amsterdam external (equinix)
  47       "ip6:2001:4d78:500:5e3::/64", // amsterdam external (equinix)
  48       "ip4:87.252.214.96/27",       // dublin external (equinix)
  49       "ip6:2001:4d78:fe03:1c::/64", // dublin external (equinix)
  50       "ip4:184.104.179.128/27",     // amsterdam external (he.net)
  51       "ip6:2001:470:1:fa1::/64",    // amsterdam external (he.net)
  52       "ip4:184.104.226.96/27",      // dublin external (he.net)
  53       "ip6:2001:470:1:b3b::/64",    // dublin external (he.net)
  54       "mx",                         // safety net if we change mx
  55       "-all"
  56     ]
  57   }),
  58
  59   SPF_BUILDER({
  60     label: "messages",
  61     parts: [
  62       "v=spf1",
  63       "include:openstreetmap.org",  // main openstreetmap.org spf record
  64       "-all"
  65     ]
  66   }),
  67
  68   SPF_BUILDER({
  69     label: "noreply",
  70     parts: [
  71       "v=spf1",
  72       "include:openstreetmap.org",  // main openstreetmap.org spf record
  73       "-all"
  74     ]
  75   }),
  76
  77   SPF_BUILDER({
  78     label: "otrs",
  79     parts: [
  80       "v=spf1",
  81       "include:openstreetmap.org",  // main openstreetmap.org spf record
  82       "-all"
  83     ]
  84   }),
  85
  86   SPF_BUILDER({
  87     label: "community",
  88     parts: [
  89       "v=spf1",
  90       "include:openstreetmap.org",  // main openstreetmap.org spf record
  91       "-all"
  92     ]
  93   }),
  94
  95   SPF_BUILDER({
  96     label: "supporting",
  97     parts: [
  98       "v=spf1",
  99       "include:openstreetmap.org",  // main openstreetmap.org spf record
 100       "-all"
 101     ]
 102   }),
 103
 104   // Publish DKIM public key
 105
 106   TXT("20200301._domainkey", "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzvoNZVOGfw1V4A171hxHMhzVTAnIUQVJ8iX3wbqCld8A5iIaXeTGYvBmewymax/cYJS4QqzbpUzkgrrTA9avuZhd+QGJDgjADgx4VyMOaOS6FwAxS0uXtLrt+lsixRDx/feKyZHaxjzJAQy46ok77xXL4UXIaaovw6G6eZpIScMzZQ2zkKNJxTICzzSOduIilHhMWte4XP+/2PdRmD7Ge9jb0U4bZjswX0AqKSGzDKYw+yxVna9l53adeCnklqg2ofoXu+ResiH+kt05aCUOMo8en3em6yBnRCMalgi1E3Tt7I5BWcYFRkT/8agUGW4gGC6XMV9IskOsYL0emG0kGwIDAQAB", AUTOSPLIT),
 107
 108   // Publish DMARC report-only policy
 109
 110   DMARC_BUILDER({
 111     policy: "none",
 112     rua: [
 113       "mailto:openstreetmap-d@dmarc.report-uri.com"
 114     ],
 115     failureOptions: 1
 116   }),
 117
 118   // Announce MTA-STS policy and TLSRPT policy for error reports
 119
 120   TXT("_mta-sts", "v=STSv1; id=202001291805Z"),
 121   TXT("_smtp._tls", "v=TLSRPTv1; rua=mailto:openstreetmap-d@tlsrpt.report-uri.com"),
 122
 123   // Fastly cert domain ownership confirmation
 124
 125   TXT("@", "_globalsign-domain-verification=ps00GlW1BzY9c2_cwH_pFqRkvzZyaCVZ-3RLssRG6S"),
 126   TXT("@", "_globalsign-domain-verification=W0buKB5ZmL-VwwHw2oQyQImk3I1q3hSemf2qmB1hjP"),
 127
 128   // Facebook Business domain verification
 129
 130   TXT("@", "facebook-domain-verification=j5hix5i8r0kortfugqf2p9wx9x9by0"),
 131
 132   // Bluesky domain verification
 133
 134   TXT("_atproto", "did=did:plc:i6llv7iwybeipknl57v4dalb"),
 135
 136   // Delegate MTA-STS policy for subdomains
 137
 138   CNAME("_mta-sts.messages", QUALIFY("_mta-sts")),
 139   CNAME("_mta-sts.noreply", QUALIFY("_mta-sts")),
 140   CNAME("_mta-sts.otrs", QUALIFY("_mta-sts")),
 141   CNAME("_mta-sts.community", QUALIFY("_mta-sts")),
 142   CNAME("_mta-sts.supporting", QUALIFY("_mta-sts")),
 143
 144   // Google postmaster tools verification
 145
 146   CNAME("af323lytato5", "gv-o4v3qh5pfayqex.dv.googlehosted.com."),
 147   CNAME("irzdddnmh465", "gv-cwr6bvt7xsgact.dv.googlehosted.com."),
 148
 149   // Main web servers and their aliases
 150
 151   osm_web_service("@", [ "spike-06",
 152                          "spike-07",
 153                          "spike-08"
 154                        ], { cfproxy: true }),
 155
 156   osm_web_service("www", [ "spike-06",
 157                            "spike-07",
 158                            "spike-08"
 159                          ], { cfproxy: true }),
 160
 161   osm_web_service("api", [ "spike-06",
 162                            "spike-07",
 163                            "spike-08"
 164                          ], { cfproxy: true }),
 165
 166   osm_web_service("maps", [ "spike-06",
 167                             "spike-07",
 168                             "spike-08"
 169                           ], { cfproxy: true }),
 170
 171   osm_web_service("mapz", [ "spike-06",
 172                             "spike-07",
 173                              "spike-08"
 174                           ], { cfproxy: true }),
 175
 176   // Nominatim servers
 177
 178   CNAME("nominatim", "nominatim.geo.openstreetmap.org."),
 179   CNAME("qgis.nominatim", "nominatim.geo.openstreetmap.org."),
 180   CNAME("qa-tile.nominatim", "longma.openstreetmap.org."),
 181
 182   // Tile servers
 183
 184   CNAME("tile", "dualstack.n.sni.global.fastly.net."),
 185   CNAME("a.tile", "dualstack.n.sni.global.fastly.net."),
 186   CNAME("b.tile", "dualstack.n.sni.global.fastly.net."),
 187   CNAME("c.tile", "dualstack.n.sni.global.fastly.net."),
 188
 189   osm_web_service("render", [ "culebre",
 190                               "nidhogg"
 191                             ]),
 192
 193   // Vector tile servers
 194
 195   CNAME("vector", "dualstack.n.sni.global.fastly.net."),
 196
 197   // Planet servers
 198
 199   A("backup", IPV4["norbert"]),
 200   AAAA("backup", IPV6["norbert"]),
 201   // A("backup", IPV4["horntail"]),
 202   // AAAA("backup", IPV6["horntail"]),
 203
 204   osm_web_service("planet", "norbert"),
 205   // osm_web_service("planet", "horntail"),
 206
 207   // Development server with wildcard alias for user sites
 208
 209   osm_web_service("dev", "faffy"),
 210   osm_web_service("*.dev", "faffy"),
 211
 212   osm_web_service("ooc", "faffy"),
 213   osm_web_service("a.ooc", "faffy"),
 214   osm_web_service("b.ooc", "faffy"),
 215   osm_web_service("c.ooc", "faffy"),
 216
 217   osm_web_service("npe", "faffy"),
 218
 219   // Foundation server
 220
 221   osm_web_service("blog", "ridley"),
 222   osm_web_service("foundation", "ridley"),
 223
 224   // Matomo server
 225
 226   osm_web_service("matomo", "smaug"),
 227   osm_web_service("piwik", "smaug"),
 228
 229   // Imagery servers
 230
 231   osm_web_service("agri", "lockheed"),
 232   osm_web_service("a.agri", "lockheed"),
 233   osm_web_service("b.agri", "lockheed"),
 234   osm_web_service("c.agri", "lockheed"),
 235
 236   osm_web_service("act-imagery", "lockheed"),
 237   osm_web_service("a.act-imagery", "lockheed"),
 238   osm_web_service("b.act-imagery", "lockheed"),
 239   osm_web_service("c.act-imagery", "lockheed"),
 240
 241   osm_web_service("au-vic-melbourne-imagery", "lockheed"),
 242   osm_web_service("a.au-vic-melbourne-imagery", "lockheed"),
 243   osm_web_service("b.au-vic-melbourne-imagery", "lockheed"),
 244   osm_web_service("c.au-vic-melbourne-imagery", "lockheed"),
 245
 246   osm_web_service("os", "lockheed"),
 247   osm_web_service("a.os", "lockheed"),
 248   osm_web_service("b.os", "lockheed"),
 249   osm_web_service("c.os", "lockheed"),
 250
 251   osm_web_service("tiler", "lockheed"),
 252
 253   osm_web_service("us-imagery", "lockheed"),
 254   osm_web_service("a.us-imagery", "lockheed"),
 255   osm_web_service("b.us-imagery", "lockheed"),
 256   osm_web_service("c.us-imagery", "lockheed"),
 257
 258   // Prometheus server and munin redirect
 259
 260   osm_web_service("prometheus", "stormfly-03"),
 261   osm_web_service("munin", "stormfly-03"),
 262
 263   // Management server
 264
 265   osm_web_service("acme", "idris"),
 266   osm_web_service("apt", "idris"),
 267   osm_web_service("chef", "idris"),
 268   osm_web_service("dns", "idris"),
 269   osm_web_service("git", "idris"),
 270   osm_web_service("hardware", "idris"),
 271
 272   // Bytemark machine, and the services which operate from it
 273
 274   osm_web_service("lists", "shenron"),
 275   osm_web_service("help", "shenron"),
 276
 277   // Naga services
 278
 279   osm_web_service("svn", "naga"),
 280   osm_web_service("trac", "naga"),
 281   osm_web_service("irc", "naga"),
 282   osm_web_service("blogs", "naga"),
 283   osm_web_service("welcome", "naga"),
 284   osm_web_service("operations", "naga"),
 285   osm_web_service("hot", "naga"),
 286   osm_web_service("dmca", "naga"),
 287   osm_web_service("otrs", "naga", { h1: true, h2: false }), // OTRS is not available using HTTPS/2
 288   osm_web_service("birthday20", "naga"),
 289
 290   // Wiki servers
 291
 292   osm_web_service("wiki", "konqi"),
 293   osm_web_service("test.wiki", "muirdris"),
 294
 295   // Overpass server
 296
 297   osm_web_service("query", "grisu"),
 298
 299   // GPS tile server
 300
 301   osm_web_service("gps-tile", "muirdris"),
 302   osm_web_service("a.gps-tile", "muirdris"),
 303   osm_web_service("b.gps-tile", "muirdris"),
 304   osm_web_service("c.gps-tile", "muirdris"),
 305   osm_web_service("gps.tile", "muirdris"),
 306   osm_web_service("gps-a.tile", "muirdris"),
 307   osm_web_service("gps-b.tile", "muirdris"),
 308   osm_web_service("gps-c.tile", "muirdris"),
 309
 310   // Donation site and new OSMF crm site
 311
 312   osm_web_service("donate", "ridley"),
 313   osm_web_service("support", "ridley"),
 314   osm_web_service("supporting", "ridley"),
 315
 316   // Discourse server ("community")
 317
 318   osm_web_service("community", "fume"),
 319   osm_web_service("communities", "fume"),
 320   osm_web_service("c", "fume"),
 321   osm_web_service("forum", "fume"),
 322
 323   CNAME("community-cdn", "dualstack.n.sni.global.fastly.net."),
 324   TXT("community", "google-site-verification=hQ8GZyj4KwnPqAX2oAzpbLrh6I5dfR08PSdL3icVkfg"),
 325
 326   // Taginfo and Staging Blog Server
 327
 328   osm_web_service("taginfo", "tabaluga"),
 329
 330   // Staging Blog Server
 331
 332   osm_web_service("staging.blog", "tabaluga"),
 333
 334 );