Skip to content

Commit bfefafc

Browse files
authored
Merge pull request #104 from stack127labs/chore/audit-directory-content
Add a monthly TLD directory check on homelab
2 parents dc277d2 + 66e6827 commit bfefafc

5 files changed

Lines changed: 153 additions & 1 deletion

File tree

‎content_docs/tld-directory/README.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,20 @@ Record a `checked_at` per row and show it. A directory that does not say when it
8282
6. What DNSSEC at the TLD level does and does not mean.
8383
7. Sources and refresh cadence, stated plainly.
8484

85+
## Refresh
86+
87+
A homelab timer runs `scripts/domain-tools/tld-directory-monthly.mjs` on the 1st of each month at 04:30 UTC. It refreshes `tlds.json`, `rdap-bootstrap.json`, `rdap-overrides.json`, `whois-servers.json`, `whois-reviewed.json`, and `tld-directory.json` in a throwaway checkout of `main`. If a fact changed, it opens one pull request on `chore/tld-directory-refresh`. If only dates and version numbers moved, it does nothing. A failed run shows in the automation monitor.
88+
89+
The job doesn't add RDAP or WHOIS servers. A new ending that needs one still gets a manual review through `rdap-overrides.json` or `whois-reviewed.json`.
90+
91+
Install on homelab from the main checkout:
92+
93+
```bash
94+
cp scripts/domain-tools/systemd/stack127-tld-directory-refresh.* ~/.config/systemd/user/
95+
systemctl --user daemon-reload
96+
systemctl --user enable --now stack127-tld-directory-refresh.timer
97+
```
98+
8599
## Placement
86100

87101
The canonical route is `/tld-directory`. It can appear in the domain collection and any future reference collection without changing its URL or ownership folder.
Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[Unit]
2+
Description=Check the TLD directory against IANA and open a pull request if facts changed
3+
After=network-online.target
4+
Wants=network-online.target
5+
6+
[Service]
7+
Type=oneshot
8+
WorkingDirectory=/srv/data/projects/stack127
9+
Environment=PATH=/home/teja/.local/bin:/usr/local/bin:/usr/bin:/bin
10+
Environment=NODE_NO_WARNINGS=1
11+
ExecStart=/usr/bin/node scripts/domain-tools/tld-directory-monthly.mjs
12+
TimeoutStartSec=1h
13+
Nice=15
14+
MemoryMax=1G
Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
[Unit]
2+
Description=Monthly TLD directory check on homelab
3+
4+
[Timer]
5+
OnCalendar=*-*-01 04:30:00 UTC
6+
Persistent=true
7+
Unit=stack127-tld-directory-refresh.service
8+
9+
[Install]
10+
WantedBy=timers.target
Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
#!/usr/bin/env node
2+
3+
/**
4+
* Monthly check behind /tld-directory. Run by a homelab timer; see
5+
* scripts/domain-tools/systemd/.
6+
*
7+
* Refreshes the datasets the directory reads in a throwaway checkout of main.
8+
* If a real fact changed, it opens one pull request for review. If only dates
9+
* and version numbers moved, it does nothing. Any failure exits non-zero, which
10+
* the automation monitor shows.
11+
*
12+
* --dry-run stops before the commit. --base <ref> checks out another ref.
13+
*/
14+
15+
import { execFileSync } from "node:child_process";
16+
import { mkdtempSync, readFileSync, rmSync } from "node:fs";
17+
import { tmpdir } from "node:os";
18+
import path from "node:path";
19+
20+
const BRANCH = "chore/tld-directory-refresh";
21+
const DATA_DIR = "lib/domain/data";
22+
const DATA_FILES = ["tlds.json", "rdap-bootstrap.json", "rdap-overrides.json", "whois-servers.json", "whois-reviewed.json", "tld-directory.json"];
23+
// These move on most runs without any fact changing.
24+
const VOLATILE_KEYS = new Set(["fetchedAt", "version", "publication", "tldListVersion"]);
25+
26+
const args = process.argv.slice(2);
27+
const dryRun = args.includes("--dry-run");
28+
const baseIndex = args.indexOf("--base");
29+
const base = baseIndex === -1 ? "origin/main" : args[baseIndex + 1];
30+
31+
const run = (command, commandArgs, cwd) =>
32+
execFileSync(command, commandArgs, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "inherit"], maxBuffer: 1 << 28 });
33+
34+
const facts = (text) =>
35+
JSON.stringify(Object.fromEntries(Object.entries(JSON.parse(text)).filter(([key]) => !VOLATILE_KEYS.has(key))));
36+
37+
function listChange(before, after) {
38+
const was = new Set(JSON.parse(before).tlds);
39+
const now = new Set(JSON.parse(after).tlds);
40+
return { added: [...now].filter((tld) => !was.has(tld)), removed: [...was].filter((tld) => !now.has(tld)) };
41+
}
42+
43+
function refresh(tree) {
44+
const script = (name) => path.join("scripts/domain-tools", name);
45+
const node = process.execPath;
46+
run(node, ["--experimental-strip-types", script("refresh-datasets.mjs")], tree);
47+
// That script also refreshes data the directory doesn't read. Leave it for its own release.
48+
const others = run("git", ["diff", "--name-only", "--", DATA_DIR], tree)
49+
.split("\n")
50+
.filter((file) => file && !DATA_FILES.includes(path.basename(file)));
51+
if (others.length) run("git", ["checkout", "--", ...others], tree);
52+
run(node, ["--experimental-strip-types", script("refresh-tld-directory.mjs")], tree);
53+
}
54+
55+
function changedFiles(tree) {
56+
return DATA_FILES.filter((file) => {
57+
const relative = path.posix.join(DATA_DIR, file);
58+
const before = run("git", ["show", `HEAD:${relative}`], tree);
59+
return facts(before) !== facts(readFileSync(path.join(tree, relative), "utf8"));
60+
});
61+
}
62+
63+
function pullRequestBody(tree, changed) {
64+
const tlds = path.posix.join(DATA_DIR, "tlds.json");
65+
const { added, removed } = listChange(run("git", ["show", `HEAD:${tlds}`], tree), readFileSync(path.join(tree, tlds), "utf8"));
66+
const lines = ["The monthly TLD directory check found changes in IANA's data.", "", "Changed files:", ...changed.map((file) => `- \`${file}\``)];
67+
if (added.length) lines.push("", `New endings: ${added.map((tld) => `\`.${tld}\``).join(", ")}. Check whether they need reviewed RDAP or WHOIS servers.`);
68+
if (removed.length) lines.push("", `Removed endings: ${removed.map((tld) => `\`.${tld}\``).join(", ")}.`);
69+
lines.push("", "Review the data diff and merge to update /tld-directory. Merging deploys.");
70+
return lines.join("\n");
71+
}
72+
73+
function publish(tree, changed) {
74+
// Read the old list for the description before the commit moves HEAD.
75+
const body = pullRequestBody(tree, changed);
76+
const title = `Update TLD directory data (${new Date().toISOString().slice(0, 7)})`;
77+
run("git", ["add", "--", ...DATA_FILES.map((file) => path.posix.join(DATA_DIR, file))], tree);
78+
run("git", ["commit", "--quiet", "-m", title], tree);
79+
// Stay detached: a local branch would outlive this checkout and block next month's run.
80+
run("git", ["push", "--quiet", "--force", "origin", `HEAD:refs/heads/${BRANCH}`], tree);
81+
const open = run("gh", ["pr", "list", "--head", BRANCH, "--state", "open", "--json", "number", "--jq", "length"], tree).trim();
82+
if (open !== "0") {
83+
run("gh", ["pr", "edit", BRANCH, "--title", title, "--body", body], tree);
84+
console.log(`Updated the open pull request on ${BRANCH}.`);
85+
return;
86+
}
87+
const url = run("gh", ["pr", "create", "--base", "main", "--head", BRANCH, "--title", title, "--body", body], tree).trim();
88+
console.log(`Opened ${url}`);
89+
}
90+
91+
const repo = run("git", ["rev-parse", "--show-toplevel"], process.cwd()).trim();
92+
const parent = mkdtempSync(path.join(tmpdir(), "stack127-tld-"));
93+
const tree = path.join(parent, "tree");
94+
95+
try {
96+
if (baseIndex === -1) run("git", ["fetch", "--quiet", "origin", "main"], repo);
97+
run("git", ["worktree", "add", "--quiet", "--detach", tree, base], repo);
98+
refresh(tree);
99+
const changed = changedFiles(tree);
100+
if (!changed.length) {
101+
console.log("No TLD directory facts changed. Nothing to do.");
102+
} else if (dryRun) {
103+
console.log(`Dry run. Would open a pull request:\n${pullRequestBody(tree, changed)}`);
104+
} else {
105+
publish(tree, changed);
106+
}
107+
} finally {
108+
try {
109+
run("git", ["worktree", "remove", "--force", tree], repo);
110+
} finally {
111+
rmSync(parent, { recursive: true, force: true });
112+
}
113+
}

‎stack127_docs/monitoring.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@
4343
{"key": "bloxodes-vps/basebuddy-demo-reset", "group": "Basebuddy", "name": "Basebuddy demo reset", "about": "Every night, wipes and re-seeds the public Basebuddy demo so visitors start from clean sample data."},
4444
{"key": "bloxodes-vps/collector", "group": "Basebuddy", "name": "Basebuddy GitHub traffic", "about": "Every 6 hours, saves GitHub traffic numbers for the Basebuddy repository, because GitHub only keeps 14 days."},
4545
{"key": "bloxodes-vps/umami-selfhost-svdgnp-github-collector-1", "group": "Basebuddy", "name": "Umami GitHub collector", "about": "A container that sends GitHub traffic numbers to Umami analytics. It has been restarting in a loop."},
46-
{"key": "homelab/stack127-shared-env", "group": "Developer setup", "name": "Share env files with worktrees", "about": "Every 30 seconds, keeps stack127's private env files linked into every worktree on the homelab."}
46+
{"key": "homelab/stack127-shared-env", "group": "Developer setup", "name": "Share env files with worktrees", "about": "Every 30 seconds, keeps stack127's private env files linked into every worktree on the homelab."},
47+
{"key": "homelab/stack127-tld-directory-refresh", "group": "Releases and checks", "name": "TLD directory check", "about": "On the 1st of each month at 04:30 UTC (10:00 IST), checks the TLD directory against IANA's data and opens a pull request only if a fact changed.", "impact": "New, removed, or changed domain endings stay out of /tld-directory until someone refreshes it by hand."}
4748
]
4849
}

0 commit comments

Comments
 (0)