inbuxa/inbuxa-admin
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 22 Wiki Activity Sponsor

DNS guide: leave CAA off by default and say why #162

Merged
jcoffey-dev merged 1 commits from fix/caa-default-off-292 into main 2026-11-05 05:54:43 +00:00
Conversation 0 Commits 1 Files Changed 2
+35 -3
jcoffey-dev commented 2026-11-05 04:37:16 +00:00
Owner
Copy link
Copy source

Part of inbuxa/inbuxa-server#292.

The DNS guide switched on every record type except TLSA, so it published CAA for anyone who took the defaults. A CAA record covers every name under the domain and ties it to this server's ACME account, so another ACME client there is refused at its next renewal.

CAA is now off in the guide's defaults, and its switch carries a warning. A domain that already publishes CAA still loads with it on, because the guide reads the stored list.

The server's matching default change is in inbuxa/inbuxa-server#294. This PR works on its own, since the guide sends an explicit list.

Tested: new records.test.ts, plus typecheck, lint, i18n check, full npm test, notice check and build. I didn't click through the guide in a browser.

Part of inbuxa/inbuxa-server#292. The DNS guide switched on every record type except TLSA, so it published CAA for anyone who took the defaults. A CAA record covers every name under the domain and ties it to this server's ACME account, so another ACME client there is refused at its next renewal. CAA is now off in the guide's defaults, and its switch carries a warning. A domain that already publishes CAA still loads with it on, because the guide reads the stored list. The server's matching default change is in inbuxa/inbuxa-server#294. This PR works on its own, since the guide sends an explicit list. Tested: new `records.test.ts`, plus typecheck, lint, i18n check, full `npm test`, notice check and build. I didn't click through the guide in a browser.
jcoffey-dev added 1 commit 2026-11-05 04:37:16 +00:00
DNS guide: leave CAA off by default and say why
ci / build (pull_request) Skipped
Details
ci / publish (pull_request) Skipped
Details
ci / notices (pull_request) Successful in 1m3s
Details
github/ci (branch) GitHub Actions
Details
ci / github (pull_request) Successful in 1m49s
Details
661092e184 
A CAA record covers every name under the domain and ties it to this server's
ACME account, so another ACME client there is refused at its next renewal.
The guide no longer switches it on by itself, and the switch now carries a
warning.

Part of inbuxa/inbuxa-server#292
jcoffey-dev merged commit d512295274 into main 2026-11-05 05:54:43 +00:00
jcoffey-dev deleted branch fix/caa-default-off-292 2026-11-05 05:54:43 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something isn't working
 dependencies
Dependency updates
 documentation
Docs, README or site copy
 duplicate
Already tracked elsewhere
 enhancement
New feature or improvement
 good first issue
Good for newcomers
 help wanted
Contributions welcome
 invalid
Not a valid issue
 needs info
Waiting on the reporter for details
 question
Needs an answer, not a code change
 security
Security issue or hardening
 translation
New language or translation fixes
 wontfix
Will not be worked on
priority
p1
High priority
priority
p2
Medium priority
priority
p3
Low priority
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
jcoffey-dev (John Coffey)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: inbuxa/inbuxa-admin#162