carlos / platform Public

Fix on branch wildcard-zone-check (6e8de8c6, CI green), on behalf of James.

The problem

Once a box has a DNS-01 provider (CARLOS_DNSIMPLE_TOKEN, or CARLOS_DNS_PROVIDER=route53), the wildcard manager tries a certificate for every per-account platform parent (*.<sqid>.<apps-domain>), in addition to the static and delegated parents. parentsFor derives these from the route table, and nothing turns them off.

When the apps domain's zone is not in the provider's account, each attempt would:

1. place an ACME order;
2. fail at present with "no zone found";
3. deactivate the authorization;
4. retry an hour later.

That repeats forever, for every account. It doesn't hurt the rate limits: the authorization is deactivated and never validated, and the wildcard flow uses its own ACME account. But it is one pointless CA round trip and one journal line per parent per hour.

carlos.exciting.io hits exactly this. exciting.io is on Linode DNS, and the provider was armed only to get a wildcard for a customer domain (letsjelly.dev, through a Route53 delegation zone). Any deployment whose platform zone sits somewhere other than its DNS-01 provider will hit it too.

The fix

• Check before ordering. obtain asks the provider first, through an optional zoneChecker. DNSimple uses its zone suffix walk and Route53 its hosted-zone lookup, which are the lookups present already makes.
• No zone means no order. A miss is wrapped as errNoZone, and pass backs that parent off for 12h instead of 1h. A missing zone is configuration rather than a blip, but it is still re-checked, so a zone added later is picked up without a restart.

Evidence

• New tests: - the CA receives no request for a parent with no zone; - a writable zone still orders; - the 12h back-off; - the DNSimple check writes nothing.

The behaviour tests were watched to fail with the check removed.

• Live on carlos.exciting.io since 2026-10-05 (build 2cf481bc). *.bab, *.bac and *.bad.carlos.exciting.io are skipped with "no hosted zone", with no order placed. *.letsjelly.dev was obtained through the delegation zone 30s after --wildcard was set.

Open question

Should per-account platform parents be opt-in when the provider was armed for something else? A switch would make the intent explicit. The zone check makes it harmless either way, so I didn't add one.