Crate didbot_dns 

DNS providers for the records a deployment writes into its own zone.

Every agent gets its own hostname, because atproto supports “only hostname-level did:web DIDs”. Those hostnames resolve through one wildcard record the deployment’s zone holds (terraform-aws-didbot-pds/route53.tf), so minting an account writes nothing here — see docs/names.md. What a deployment does write is the pair of records a wildcard cannot stand in for: the TXT values an ACME DNS-01 challenge places at _acme-challenge.<zone>, and the CAA record at the apex that says which authority and which account may issue for the zone.

The trait is deliberately small and synchronous. A write here is a rare, coarse-grained operation on the certificate path, so nothing needs a runtime; a provider that talks to a hosted DNS API blocks on its own client without pushing an async runtime into every consumer.

InMemoryDns is the test double and the model of what a real provider’s bookkeeping looks like. route53::Route53Dns drives a real hosted zone and is the backend this server runs in production, behind the route53 feature so a build that does not need it does not pay for it. A provider that drives some other authoritative zone — a different hosted DNS API, a zone file, nsupdate — implements the same trait and slots in without a caller change.

DnsProvider::publish_txt, DnsProvider::withdraw_txt and DnsProvider::txt_values are an additive API over a set: the ACME DNS-01 challenge for a certificate covering both a name and its wildcard requires two values at one name simultaneously, and that is a set to add to and remove from, not a single slot to overwrite. DnsProvider::publish_caa is the opposite, a replacement: a zone’s issuance policy is one statement with one writer.

Modules

aws_fake

An in-process stand-in for the AWS surface this deployment talks to.

route53

Route53Dns: the production backend that writes a real hosted zone.

Structs

CaaRecords 🔒

Shared CAA bookkeeping.

CaaValue

One CAA property: RFC 8659’s flags, tag and value.

InMemoryDns

A provider that records everything and admits any hostname.

TxtRecords 🔒

Shared multi-value TXT bookkeeping.

Enums

DnsError

Why a record could not be published or withdrawn.

Traits

DnsProvider

A zone the records a certificate depends on can be written into.

Functions

log_caa 🔒

Renders a CAA set for one log line, so an operator reading the log sees the policy that was written rather than a count of properties.

normalize_host 🔒

Folds host to the form every bookkeeping map keys on.