Manage eblu.me DNS Records

How to add, change, and apply DNS records for eblu.me via pulumi.

Prerequisites

• Pulumi CLI installed (brew install pulumi)
• Pulumi ESC: stack eblu-me imports the blumeops/dns environment, which fetches the Gandi PAT from the pulumi-esc 1Password vault at run time (see pulumi/esc/)
• On the tailnet — Pulumi resolves indri’s IP via MagicDNS at apply time

Preview and apply

mise run dns-preview     # always do this first
mise run dns-up          # apply

The tasks only need the Pulumi access token; the Gandi PAT is fetched from 1Password automatically by the stack’s Pulumi ESC environment. The Pulumi program is in pulumi/gandi/; stack is eblu-me.

Adding a record

Edit pulumi/gandi/__main__.py and add a gandi.livedns.Record(...). The stack config (Pulumi.eblu-me.yaml) only holds domain and subdomain; everything else is in the program.

After editing, preview, then apply.

Break-glass: override the indri target IP

The wildcard *.ops.eblu.me is computed from indri.tail8d86e.ts.net via MagicDNS at apply time. If MagicDNS is unavailable:

export BLUMEOPS_REVERSE_PROXY_IP=<indri-tailscale-ip>
mise run dns-up

Find the IP via tailscale status or the Tailscale admin console.

Related

• gandi — Gandi reference card
• rotate-gandi-pat — Rotate the PAT shared with caddy
• pulumi — Pulumi tooling reference
• routing — Service URLs and routing architecture