[thomasluizon]

Closes thomasluizon/orbit-tickets#824

Change

The apex record in infra/cloudflare.tf is now an unproxied CNAME to dns_apex_target. A Terraform moved block carries the existing apex_a state entry to apex_cname, so the type change is one planned replacement. infra/variables.tf defaults the target to orbit-landing-aaa7.onrender.com and validates it as a hostname. No other DNS record definitions changed.

infra/check-dns-cutover.sh verifies the flattened apex A answers against Render's target, checks the existing Render CNAMEs for app and www, and compares the remaining records with Spaceship. infra/README.md records the cutover domain values and verification steps. This keeps the current email and verification records under the existing comparison.

Test evidence

• terraform fmt -check -recursive infra, terraform -chdir=infra validate, bash -n infra/check-dns-cutover.sh, and git diff --check passed.
• A targeted plan with -refresh=false and placeholder provider tokens showed only cloudflare_dns_record.existing["apex_cname"] replacing the moved apex_a entry: 1 add, 0 change, 1 destroy. terraform -chdir=infra show -json local-apex.tfplan | node infra/check-web-plan.mjs passed.
• The full offline plan showed unrelated pending changes, including creation of aws_sns_topic_subscription.ses_events_staging_api and updates to Render resources. A refreshed live plan could not complete because RENDER_API_KEY and CLOUDFLARE_API_TOKEN were unavailable in this shell. The apex-only acceptance criterion still needs a clean refreshed plan before apply.
• Before apply, bash infra/check-dns-cutover.sh tom.ns.cloudflare.com failed only for the apex: Cloudflare returned 216.198.79.1 while the Render target returned 216.24.57.16 and 216.24.57.18.
• node --test infra/check-web-plan.test.mjs infra/ses-isolation.test.mjs passed all 9 tests. dotnet build Orbit.slnx completed with 0 errors. dotnet test --no-build passed all 6,830 tests.
• The DNS response shape used by the checker was observed with dig orbit-landing-aaa7.onrender.com A +noall +answer: two CNAME lines followed by IN A 216.24.57.18 and IN A 216.24.57.16 lines. dig @tom.ns.cloudflare.com app.useorbit.org CNAME +short returned orbit-web-3qmv.onrender.com. and the equivalent www query returned orbit-landing-aaa7.onrender.com.. Repeating those commands rechecks the parsed fields and trailing dot.

Assumptions

• landing_custom_domains lists only useorbit.org because Render adds www.useorbit.org as a redirect automatically; listing www separately was rejected. See Render custom domains.
• The cutover values for dns_app_target and dns_www_target follow the current authoritative Cloudflare answers; retaining the Vercel defaults as cutover values was rejected.
• A Terraform moved block preserves the managed record address across the key rename; a manual state move was rejected.

Manual steps

• In the infra/local.tfvars file used for the cutover, set dns_apex_target = "orbit-landing-aaa7.onrender.com" and retain dns_app_target = "orbit-web-3qmv.onrender.com" and dns_www_target = "orbit-landing-aaa7.onrender.com". The intended domain values are landing_custom_domains = ["useorbit.org"] and web_custom_domains = ["app.useorbit.org"]; retain their already applied values for an apex-only plan. A refreshed Terraform plan with valid RENDER_API_KEY, CLOUDFLARE_API_TOKEN, and AWS credentials must show only the apex replacement and pass infra/check-web-plan.mjs before applying the saved plan.
• In the Terraform CLI for infra, apply that reviewed saved plan. dig @tom.ns.cloudflare.com useorbit.org A +short and the corresponding query to candy.ns.cloudflare.com must return Render's flattened addresses, and bash infra/check-dns-cutover.sh <cloudflare-nameserver> must pass for each nameserver.
• In the Render Dashboard, open orbit-landing > Settings > Custom Domains and verify useorbit.org. The domain and certificate status must show verified after the DNS change.

[pullfrog]

✅ No new issues found.

Reviewed changes — Reviewed the apex DNS cutover, its Terraform state move, validation, verification script, and operator instructions.

• Apex record: Replaces the unproxied A record with a flattened CNAME to the Render landing hostname while preserving the Terraform instance through a moved block.
• Cutover checks: Compares the apex A answers with the Render target, verifies the app and www CNAMEs, and retains comparisons for mail and verification records.
• Operator guidance: Documents the Render targets, required custom domains, plan review, and post-apply DNS and certificate checks.

  ^{｜ View workflow run ｜ Using GPT Sol ｜ 𝕏}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud