fix(dns): drop the comfyui CNAME, which never worked and never applied #920

Merged

coilyco-ops merged 1 commit from ops/914-drop-comfyui-cname into main

2026-08-25 04:34:24 +00:00

coilyco-ops commented

2026-08-25 04:32:42 +00:00

Member

Closes the last item in #914. Kai's call: tailscale serve on the tower, no Route53 record.

Repointing would not have worked

Three separate things were broken, and only the first is what a repoint fixes.

The target device is gone. comfyui.tail09a41b.ts.net was a Tailscale sidecar device belonging to the k3s ComfyUI pod, joined with /coilysiren/comfyui/ts-authkey. retire-zombie-namespaces.sh retired the comfyui namespace and the device went with it.
.ts.net names are not in public DNS on this tailnet. Verified against 8.8.8.8: neither the old sidecar name nor kai-tower-3026's own name resolves. A public CNAME into a .ts.net name dead-ends for any resolver that does not hand .ts.net off to MagicDNS, which is client-side split-DNS behavior and not guaranteed. This is very likely why the record was written but never applied.
Nothing would answer. https://comfyui.coilysiren.me needs something on 443 holding a certificate for that name. On kai-tower-3026, ports 443 and 80 are closed and ComfyUI serves 8188 over plain HTTP. The original browser-trusted URL came from cert-manager issuing a Let's Encrypt certificate for comfyui.coilysiren.me inside k3s, with the sidecar carrying traffic. That apparatus retired with the namespace.

Current live state on the tower

kai-tower-3026:8188   open, http 200, ComfyUI 0.29.0 (win32)
kai-tower-3026:443    closed
kai-tower-3026:80     closed

Why tailscale serve instead

It publishes 8188 at the machine's own tailnet name over HTTPS with a Tailscale-managed, browser-trusted certificate. MagicDNS resolves it, no Route53 record is involved, and there is no renewal to babysit. That is the goal the CNAME was written for, reached by the mechanism built for it.

Keeping the custom name and browser-trusted TLS would need a Let's Encrypt DNS-01 certificate for comfyui.coilysiren.me renewing on a Windows daily driver behind a reverse proxy. Real ongoing work for a desktop app.

Result

The module now plans with zero resource changes. Only the computed inventory and counts outputs move, route53_records from 17 to 15.

That closes the hazard #914 was opened for. Combined with the three deletions applied earlier, an untargeted just terraform-aws-inventory apply is now safe.

terraform validate passes, fmt -check clean, pre-commit run --all-files green. The README mail section is tightened in the same commit, since the new note pushed the file two lines past the 120-line catalog-doc-size cap.

🤖 Generated with Claude Code

Closes the last item in #914. Kai's call: `tailscale serve` on the tower, no Route53 record. ## Repointing would not have worked Three separate things were broken, and only the first is what a repoint fixes. 1. **The target device is gone.** `comfyui.tail09a41b.ts.net` was a Tailscale *sidecar* device belonging to the k3s ComfyUI pod, joined with `/coilysiren/comfyui/ts-authkey`. `retire-zombie-namespaces.sh` retired the `comfyui` namespace and the device went with it. 2. **`.ts.net` names are not in public DNS on this tailnet.** Verified against `8.8.8.8`: neither the old sidecar name nor `kai-tower-3026`'s own name resolves. A public CNAME into a `.ts.net` name dead-ends for any resolver that does not hand `.ts.net` off to MagicDNS, which is client-side split-DNS behavior and not guaranteed. This is very likely why the record was written but never applied. 3. **Nothing would answer.** `https://comfyui.coilysiren.me` needs something on 443 holding a certificate for that name. On `kai-tower-3026`, ports 443 and 80 are closed and ComfyUI serves 8188 over plain HTTP. The original browser-trusted URL came from cert-manager issuing a Let's Encrypt certificate for `comfyui.coilysiren.me` inside k3s, with the sidecar carrying traffic. That apparatus retired with the namespace. ## Current live state on the tower ``` kai-tower-3026:8188 open, http 200, ComfyUI 0.29.0 (win32) kai-tower-3026:443 closed kai-tower-3026:80 closed ``` ## Why tailscale serve instead It publishes 8188 at the machine's own tailnet name over HTTPS with a Tailscale-managed, browser-trusted certificate. MagicDNS resolves it, no Route53 record is involved, and there is no renewal to babysit. That is the goal the CNAME was written for, reached by the mechanism built for it. Keeping the custom name *and* browser-trusted TLS would need a Let's Encrypt DNS-01 certificate for `comfyui.coilysiren.me` renewing on a Windows daily driver behind a reverse proxy. Real ongoing work for a desktop app. ## Result The module now plans with **zero resource changes**. Only the computed `inventory` and `counts` outputs move, `route53_records` from 17 to 15. That closes the hazard #914 was opened for. Combined with the three deletions applied earlier, an untargeted `just terraform-aws-inventory apply` is now safe. `terraform validate` passes, `fmt -check` clean, `pre-commit run --all-files` green. The README mail section is tightened in the same commit, since the new note pushed the file two lines past the 120-line `catalog-doc-size` cap. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

coilyco-ops added 1 commit

2026-08-25 04:32:42 +00:00

fix(dns): drop the comfyui CNAME, which never worked and never applied

TruffleHog / Scan for secrets (pull_request) Successful in 4s

Details

CI / lint (pull_request) Successful in 41s

Details

660cc09b4f

Closes the last item in #914. The record sat in main.tf without ever
being applied, and repointing it would not have helped.

Three things were broken, not one. The target
comfyui.tail09a41b.ts.net was a Tailscale sidecar device belonging to
the k3s ComfyUI pod, joined with /coilysiren/comfyui/ts-authkey, and it
died when retire-zombie-namespaces.sh retired that namespace. This
tailnet's .ts.net names are not in public DNS, so a Route53 CNAME into
one dead-ends for any resolver that does not hand .ts.net to MagicDNS.
And nothing holds a certificate for a coilysiren.me name on that host
anyway.

ComfyUI now runs natively on kai-tower-3026, serving 8188 over plain
HTTP with 443 and 80 closed. tailscale serve publishes it at the
machine's own tailnet name with a browser-trusted certificate, which is
the goal this CNAME was written for, reached by the mechanism built for
it and with no renewal to babysit.

The module now plans with zero resource changes. The README mail section
is tightened in the same commit to stay under the 120-line cap.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Agent-Role: sysadmin

coilyco-ops merged commit a8751f7176 into main

2026-08-25 04:34:24 +00:00

coilyco-ops referenced this pull request from a commit

2026-08-25 04:34:25 +00:00

fix(dns): drop the comfyui CNAME, which never worked and never applied (#920)

coilyco-ops referenced this pull request

2026-08-25 04:35:04 +00:00

terraform/aws-inventory: decide whether comfyui.coilysiren.me should exist #914