auto-update-daily-20260202
1#!/usr/bin/env bash
2# Update Gandi DNS records from NixOS DNS configuration
3# Usage: ./scripts/update-gandi-dns.sh [--dry-run]
4
5set -euo pipefail
6
7# Colors
8BOLD='\033[1m'
9GREEN='\033[0;32m'
10BLUE='\033[0;34m'
11YELLOW='\033[0;33m'
12RED='\033[0;31m'
13CYAN='\033[0;36m'
14RESET='\033[0m'
15
16DOMAIN="sbr.pm"
17API_URL="https://api.gandi.net/v5/livedns/domains/$DOMAIN/records"
18DRY_RUN=false
19
20# Parse arguments
21for arg in "$@"; do
22 case $arg in
23 --dry-run)
24 DRY_RUN=true
25 shift
26 ;;
27 esac
28done
29
30# Check for API key (using lego's environment variable name)
31if [[ -z "${GANDIV5_PERSONAL_TOKEN:-}" ]]; then
32 echo -e "${RED}Error: GANDIV5_PERSONAL_TOKEN environment variable not set${RESET}"
33 echo -e "${YELLOW}Please set it with: export GANDIV5_PERSONAL_TOKEN=your-api-key${RESET}"
34 echo -e "${CYAN}Or source it from the agenix secret on rhea:${RESET}"
35 echo -e "${CYAN} source /run/agenix/gandi.env${RESET}"
36 exit 1
37fi
38
39echo -e "${BOLD}${BLUE}Updating Gandi DNS records for $DOMAIN...${RESET}"
40if [[ "$DRY_RUN" == "true" ]]; then
41 echo -e "${YELLOW}DRY RUN MODE - No changes will be made${RESET}"
42fi
43echo
44
45# Get the DNS zone file content from Nix (using Gandi-specific config with VPN IPs)
46echo -e "${CYAN}Extracting DNS records from Nix configuration (Gandi/VPN version)...${RESET}"
47ZONE_FILE=$(nix eval --impure --raw --expr '
48 let
49 pkgs = import <nixpkgs> {};
50 dns = (builtins.getFlake (toString ./.)).inputs.dns;
51 globals = (import ./globals.nix) {};
52 zone = import ./systems/common/services/dns/sbr.pm-gandi.nix { inherit dns globals; };
53 in
54 dns.lib.toString "sbr.pm" zone
55' 2>&1 | grep -v "^warning:" | grep -v "^Using saved setting" | grep -v "^building ")
56
57if [[ -z "$ZONE_FILE" ]]; then
58 echo -e "${RED}Error: Could not generate zone file${RESET}"
59 exit 1
60fi
61
62echo -e "${GREEN}DNS records extracted${RESET}"
63echo
64
65# Create a temporary file for the zone
66TEMP_ZONE=$(mktemp)
67echo "$ZONE_FILE" > "$TEMP_ZONE"
68
69# Extract A records (excluding SOA, NS, and comments)
70# Format examples:
71# name.domain. IN A ip
72# name.domain. TTL IN A ip
73# *.name.domain. IN A ip
74RECORDS=$(grep -E "^\S+\s+(([0-9]+\s+)?IN\s+)?A\s+" "$TEMP_ZONE" | \
75 grep -v "SOA" | \
76 grep -v "^;" || true)
77
78rm -f "$TEMP_ZONE"
79
80if [[ -z "$RECORDS" ]]; then
81 echo -e "${YELLOW}No A records found in zone file${RESET}"
82 exit 0
83fi
84
85echo -e "${GREEN}Found $(echo "$RECORDS" | wc -l) A records to process${RESET}"
86echo
87
88# Get current DNS records from Gandi
89if [[ "$DRY_RUN" == "false" ]]; then
90 echo -e "${CYAN}Fetching current DNS records from Gandi...${RESET}"
91 CURRENT_RECORDS=$(curl -s \
92 -H "Authorization: Bearer $GANDIV5_PERSONAL_TOKEN" \
93 "$API_URL" || echo "[]")
94
95 echo -e "${GREEN}Current records fetched${RESET}"
96 echo
97fi
98
99# Process each record
100UPDATED=0
101SKIPPED=0
102FAILED=0
103
104while IFS= read -r line; do
105 # Parse the line to extract: name, TTL, and value
106 # Handle various formats:
107 # name.sbr.pm. IN A value
108 # name.sbr.pm. TTL IN A value
109 # *.name.sbr.pm. TTL IN A value
110
111 # Extract components
112 FULL_NAME=$(echo "$line" | awk '{print $1}')
113
114 # Check if second field is a number (TTL) or "IN"
115 SECOND_FIELD=$(echo "$line" | awk '{print $2}')
116 if [[ "$SECOND_FIELD" =~ ^[0-9]+$ ]]; then
117 TTL="$SECOND_FIELD"
118 VALUE=$(echo "$line" | awk '{print $5}')
119 else
120 TTL=10800
121 VALUE=$(echo "$line" | awk '{print $4}')
122 fi
123
124 # Remove .sbr.pm. suffix and convert to Gandi format
125 NAME="${FULL_NAME%.sbr.pm.}"
126
127 # Convert wildcard format: *.name -> *.name (Gandi uses this format)
128 # Convert root wildcard: * -> @ (Gandi's root wildcard)
129 if [[ "$NAME" == "*" ]]; then
130 NAME="@"
131 fi
132
133 echo -e "${BLUE}Processing: ${RESET}$NAME.$DOMAIN A $VALUE (TTL: $TTL)"
134
135 if [[ "$DRY_RUN" == "true" ]]; then
136 echo -e " ${CYAN}[DRY RUN] Would update/create record${RESET}"
137 UPDATED=$((UPDATED + 1))
138 else
139 # Check if record exists and has same value
140 CURRENT_VALUE=$(echo "$CURRENT_RECORDS" | jq -r \
141 --arg name "$NAME" \
142 --arg type "A" \
143 '.[] | select(.rrset_name == $name and .rrset_type == $type) | .rrset_values[0]' \
144 2>/dev/null || echo "")
145
146 if [[ "$CURRENT_VALUE" == "$VALUE" ]]; then
147 echo -e " ${GREEN}✓ Record unchanged, skipping${RESET}"
148 SKIPPED=$((SKIPPED + 1))
149 else
150 if [[ -z "$CURRENT_VALUE" ]]; then
151 echo -e " ${YELLOW}Creating new record...${RESET}"
152 else
153 echo -e " ${YELLOW}Updating record (was: $CURRENT_VALUE)...${RESET}"
154 fi
155
156 # Update/create the record
157 RESPONSE=$(curl -s -w "\n%{http_code}" \
158 -X PUT \
159 -H "Authorization: Bearer $GANDIV5_PERSONAL_TOKEN" \
160 -H "Content-Type: application/json" \
161 -d "{\"rrset_values\": [\"$VALUE\"], \"rrset_ttl\": $TTL}" \
162 "$API_URL/$NAME/A")
163
164 HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
165 BODY=$(echo "$RESPONSE" | sed '$d')
166
167 if [[ "$HTTP_CODE" == "201" ]] || [[ "$HTTP_CODE" == "200" ]]; then
168 echo -e " ${GREEN}✓ Record updated successfully${RESET}"
169 UPDATED=$((UPDATED + 1))
170 else
171 echo -e " ${RED}✗ Failed to update record (HTTP $HTTP_CODE)${RESET}"
172 echo -e " ${RED}Response: $BODY${RESET}"
173 FAILED=$((FAILED + 1))
174 fi
175 fi
176 fi
177
178 echo
179done <<< "$RECORDS"
180
181echo -e "${BOLD}${GREEN}DNS update complete!${RESET}"
182echo
183echo -e "${CYAN}Summary:${RESET}"
184echo -e " Updated: $UPDATED"
185echo -e " Skipped (unchanged): $SKIPPED"
186if [[ $FAILED -gt 0 ]]; then
187 echo -e " ${RED}Failed: $FAILED${RESET}"
188fi