76826e95

Account provisioning

flowchart TD
  zone["the zone &mdash; three names, whatever the account count<br/><table><tr><td>DNS</td><td>A</td><td>pds.did.bot</td><td>the server, at the apex</td></tr><tr><td>DNS</td><td>A</td><td>*.pds.did.bot</td><td>every account hostname, synthesized</td></tr><tr><td>DNS</td><td>TXT</td><td>_acme-challenge.pds.did.bot</td><td>only while a certificate is issued</td></tr><tr><td>TLS</td><td></td><td>pds.did.bot and *.pds.did.bot</td><td>one certificate, one listener</td></tr></table>"]
  agent["the account &mdash; the hostname its DID is minted from<br/><table><tr><td>DNS</td><td></td><td>7f3a9c.pds.did.bot</td><td>answered by the wildcard, instantly</td></tr><tr><td>HTTPS</td><td></td><td>/.well-known/did.json</td><td>its DID document</td></tr><tr><td>HTTPS</td><td></td><td>/.well-known/atproto-did</td><td>its handle, where this is the only name</td></tr><tr><td></td><td></td><td>derived from the harness's own identifier</td><td>never renamed, never reused</td></tr></table>"]
  named["a second hostname &mdash; only where a namer is configured<br/><table><tr><td>DNS</td><td></td><td>basalt-kestrel.pds.did.bot</td><td>answered by the same wildcard</td></tr><tr><td>HTTPS</td><td></td><td>/.well-known/atproto-did</td><td>did:web:7f3a9c.pds.did.bot</td></tr><tr><td></td><td></td><td>issued by the namer the deployment runs</td><td>an alias; the DID never moves</td></tr></table>"]
  zone --> agent
  agent -.-> named

The zone holds three names however many accounts exist: the server at the apex, a wildcard every account hostname is answered by, and an acme-challenge record present only while a certificate is issued. One certificate covers the apex and the wildcard, and a TLS wildcard matches exactly one label, so it never covers the server's own name. An account takes one hostname under that wildcard, derived from the identifier its harness supplies: it serves the DID document, and where it is the account's only name it serves the handle too. A deployment that runs a namer issues a second hostname, which resolves back to that same DID.