DNS, domains and certificates

Current state

eratic.ro is registered through ird.ro until 2027-08-04, auto-renewing, with DNS hosted on ns1.ird.ro / ns2.ird.ro. Every record points at the personal-sites VPS:

TTL is currently 300 seconds — short, which is convenient while things are changing. Once you are settled, raise it:

ird dns set eratic.ro blog A 178.104.116.235 --ttl 3600 -y

The ird CLI

Already authenticated on this machine as [redacted].

ird dns records eratic.ro          # the whole zone
ird dns set eratic.ro blog A 1.2.3.4
ird dns delete eratic.ro old-name A
ird status                         # domains, servers, credits at a glance
ird credits

ird dns set replaces every existing value of that name and type, rather than adding one. That is usually what you want and occasionally a surprise.

If ird ever asks you to log in again, note that ird login is a two-step device flow that requires a real TTY — it will not work through a pipe. Run it yourself in a terminal. ird keys can mint a long-lived API key if you need unattended access, e.g. from CI.

Certificates

There is nothing to do. Caddy obtains a Let's Encrypt certificate on the first request for each hostname and renews automatically, roughly a third of the way before expiry.

The prerequisites, in the order they bite:

1. The name resolves to 178.104.116.235 — Let's Encrypt validates over HTTP from the public internet.
2. Port 80 is open. It is, in ufw. Closing it breaks renewals, not just issuance.
3. The hostname appears in a site block in /opt/web/caddy/etc/conf.d/.

Checking:

ssh -i ~/.ssh/id_ed25519_eratic root@178.104.116.235 \
  'docker logs web-caddy 2>&1 | grep -i -E "certificate|acme" | tail -20'

curl -sS -o /dev/null -w '%{ssl_verify_result}\n' https://blog.eratic.ro/   # 0 = valid

Let's Encrypt rate-limits repeated failures for the same name. If issuance is failing, fix the cause and wait rather than retrying in a loop.

The certificates and the ACME account key live in the caddy-data Docker volume. Losing it is survivable — Caddy re-issues everything — but it counts against rate limits, so it is worth not destroying casually.

Adding a subdomain

Say notes.eratic.ro:

ird dns set eratic.ro notes A 178.104.116.235 -y
ird dns set eratic.ro notes AAAA 2a01:4f8:1c1a:9e3::1 -y

Then add a site block to deploy/eratic.caddy and npm run deploy. The certificate arrives on the first request.

Adding a whole other domain

You also own cheri.ro, agoreni.ro and agoresti.ro. The server was built to host them side by side — see the "Adding another domain later" section of docs/03-deploy.md. In short: point DNS at the same IP, put the built files in /opt/web/sites/<name>/, drop a <name>.caddy into /opt/web/caddy/etc/conf.d/, reload.

Note that agoresti.ro currently has api.agoresti.ro pointing at the other server, the one running the Agora API (49.13.192.39). Those are separate records on a separate machine; nothing here touches them.

Email

No MX records are set, so hello@eratic.ro does not receive mail yet. If you want it to, the two realistic options are a hosted mailbox (Fastmail, Migadu, Purelymail) or forwarding — running your own mail server for a personal domain is a deliverability project, not an afternoon.

Whatever you choose, add SPF, DKIM and DMARC records. Without them a domain with no mail configuration is attractive to spoof.