`bulk-dns.sh`

62 lines
#!/usr/bin/env bash
# bulk-dns.sh [vendor_code ...]   — ONE-TIME throttled A-records -> 45.61.58.125
#
# GATED: DNS change (customer-facing infra). Do NOT run without Steve's approval.
#
# Creates a Cloudflare A record <subdomain>.designerwallcoverings.com -> 45.61.58.125
# for each subdomain in the manifest (or only the vendor_codes passed as args).
# Throttled 1 request/sec to respect Cloudflare's API rate limit. DNS-only (proxied=false)
# so the nginx wildcard cert + listen-IP vhost serve directly (matches cowtan).
#
# Token: CLOUDFLARE_API_TOKEN from ~/Projects/secrets-manager/.env
# Zone:  e4b88c70e4c949f4556cc693133c2f42 (designerwallcoverings.com)
set -euo pipefail

REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
MANIFEST="$REPO/manifest.json"
ZONE="e4b88c70e4c949f4556cc693133c2f42"
IP="45.61.58.125"
ENVF="$HOME/Projects/secrets-manager/.env"

TOKEN="$(grep -E '^CLOUDFLARE_API_TOKEN=' "$ENVF" 2>/dev/null | head -1 | cut -d= -f2- | tr -d '"'"'"' ' || true)"
[ -z "$TOKEN" ] && { echo "bulk-dns: CLOUDFLARE_API_TOKEN not found in $ENVF" >&2; exit 1; }

# build the subdomain list
if [ "$#" -gt 0 ]; then
  SUBS="$(python3 -c "
import json,sys
m=json.load(open('$MANIFEST'))
want=set(sys.argv[1:])
for code,v in (m.get('vendors') or {}).items():
    if code in want and v.get('subdomain') and v.get('build_status','').startswith('BUILT'):
        print(v['subdomain'])
" "$@")"
else
  SUBS="$(python3 -c "
import json
m=json.load(open('$MANIFEST'))
for code,v in (m.get('vendors') or {}).items():
    if v.get('subdomain') and v.get('build_status','').startswith('BUILT'):
        print(v['subdomain'])
")"
fi

[ -z "$SUBS" ] && { echo "bulk-dns: no matching BUILT subdomains in manifest" >&2; exit 1; }

echo "== creating A records -> $IP (throttled 1/sec) =="
while IFS= read -r sub; do
  [ -z "$sub" ] && continue
  name="${sub}.designerwallcoverings.com"
  echo -n "  ${name} ... "
  resp="$(curl -s -X POST "https://api.cloudflare.com/client/v4/zones/${ZONE}/dns_records" \
    -H "Authorization: Bearer ${TOKEN}" \
    -H "Content-Type: application/json" \
    --data "{\"type\":\"A\",\"name\":\"${name}\",\"content\":\"${IP}\",\"ttl\":300,\"proxied\":false}")"
  ok="$(echo "$resp" | python3 -c 'import sys,json;print(json.load(sys.stdin).get("success"))' 2>/dev/null || echo False)"
  if [ "$ok" = "True" ]; then echo "OK"; else
    echo "FAIL: $(echo "$resp" | python3 -c 'import sys,json;d=json.load(sys.stdin);print(d.get("errors"))' 2>/dev/null || echo "$resp")"
  fi
  sleep 1
done <<< "$SUBS"
echo "== DONE =="