`finish_dns.sh`

55 lines
#!/bin/bash
# Run this AFTER:
#   1. Cancel Afternic marketplace listing (godaddy.com → My Products → Domains → philipperomano.com → Listings tab → "Cancel listing")
#   2. Add philipperomano.com to Cloudflare dashboard (cloudflare.com → Add a Site → Free plan)
# This script will: capture the CF NS pair, point GoDaddy NS at it, add A records, enable proxy.

set -euo pipefail

# Credentials must come from environment — no fallback literals (audit 2026-05-04).
# The previous fallback values are LEAKED (committed to source); rotate via /secrets.
: "${CLOUDFLARE_API_TOKEN:?CLOUDFLARE_API_TOKEN env var required}"
: "${GODADDY_API_KEY:?GODADDY_API_KEY env var required}"
: "${GODADDY_API_SECRET:?GODADDY_API_SECRET env var required}"

CF="$CLOUDFLARE_API_TOKEN"
GD_KEY="$GODADDY_API_KEY"
GD_SECRET="$GODADDY_API_SECRET"
GD_PAT="${GODADDY_PAT:-}"
# Prefer a Bearer Personal Access Token (TK-10 key rotation); fall back to legacy sso-key.
if [ -n "$GD_PAT" ]; then GD_AUTH="Bearer $GD_PAT"; else GD_AUTH="sso-key $GD_KEY:$GD_SECRET"; fi
DOMAIN="philipperomano.com"
ORIGIN_IP="45.61.58.125"

echo "Looking up zone $DOMAIN in Cloudflare..."
ZONE=$(curl -sS -H "Authorization: Bearer $CF" "https://api.cloudflare.com/client/v4/zones?name=$DOMAIN")
ZONE_ID=$(echo "$ZONE" | jq -r '.result[0].id // empty')
NS_JSON=$(echo "$ZONE" | jq -r '.result[0].name_servers // empty')
if [[ -z "$ZONE_ID" || "$ZONE_ID" == "null" ]]; then
  echo "ERROR: zone $DOMAIN not found in Cloudflare. Add it via dashboard first."
  exit 1
fi
echo "Zone: $ZONE_ID"
echo "Cloudflare NS: $NS_JSON"

echo ""
echo "=== Adding A records (proxied) ==="
for name in "$DOMAIN" "www.$DOMAIN"; do
  curl -sS -H "Authorization: Bearer $CF" -H "Content-Type: application/json" \
    -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records" \
    --data "{\"type\":\"A\",\"name\":\"$name\",\"content\":\"$ORIGIN_IP\",\"ttl\":1,\"proxied\":true}" \
    | jq '{ok: .success, name: .result.name, content: .result.content, proxied: .result.proxied, errors: .errors}'
done

echo ""
echo "=== Pointing GoDaddy NS at Cloudflare ==="
NS_PAIR=$(echo "$ZONE" | jq -c '.result[0].name_servers')
curl -sS -X PUT "https://api.godaddy.com/v1/domains/$DOMAIN" \
  -H "Authorization: $GD_AUTH" \
  -H "Content-Type: application/json" \
  --data "{\"nameServers\":$NS_PAIR}" \
  -w "GoDaddy NS update: HTTP %{http_code}\n"

echo ""
echo "Done. Check propagation with: dig +short NS $DOMAIN @1.1.1.1"