From 0de3ac2a0b52094a3bfb7524223cabaeb3c2d5db Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Fri, 17 Jul 2026 22:50:28 +1000
Subject: [PATCH] dns: fix dns-update fqdn() double-appending zone to FQDN
 records (#481)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Why
6 hosts (ausyd1nxvm2069-2073, 2098) ended up with a reverse PTR in bind-authoritative but **no forward A record**, and the `unkin.net` service records (git/grafana/auth/fafflix, all published by the halb host 2069) never landed at all.

VictoriaLogs (`dns-update-apply` on 2069 & 2070) shows the cause:
```
dns-update: nsupdate to 198.18.200.9 failed
invalid owner name: empty label
syntax error
```
`profiles::dns::record` publishes some records whose name is already fully-qualified (trailing dot) — e.g. `au-syd1-pve.main.unkin.net.`, `cobbler.main.unkin.net.`, `dashboard.ceph.unkin.net.`, and the halb CNAMEs. The `dns-update` script `fqdn()` unconditionally appended the zone, producing `…net..main.unkin.net.` — the `..` is an empty label, which nsupdate rejects, failing the entire per-zone `send`. The reverse-PTR send is sorted first and its name is always relative, so it still applied — hence "PTR but no A".

## Change
`fqdn()` now handles three cases:
- `@`/empty → zone apex (unchanged)
- name ending in `.` → already FQDN, used verbatim (**the fix**)
- otherwise → relative, append `.zone.` (unchanged)

Verified against all record shapes (relative host, apex, FQDN CNAME, reverse label) — no more `..`.

## After merge
Once puppet re-runs on the affected hosts their `main.unkin.net`/`unkin.net` updates succeed, filling in the missing A records and the `unkin.net` service zone. Pairs with argocd-apps#260 (adds the `ceph.unkin.net` zone so `dashboard.ceph.unkin.net` does not then hit NOTZONE).

Reviewed-on: https://git.unkin.net/unkin/puppet-prod/pulls/481
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
---
 site/profiles/templates/dns/dns-update.sh.epp | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/site/profiles/templates/dns/dns-update.sh.epp b/site/profiles/templates/dns/dns-update.sh.epp
index 9001b8d..ce3d872 100644
--- a/site/profiles/templates/dns/dns-update.sh.epp
+++ b/site/profiles/templates/dns/dns-update.sh.epp
@@ -20,7 +20,15 @@ applied="$(grep -vE '^[[:space:]]*(#|$)' "$STATE" 2>/dev/null | sort -u || true)
 [ "$desired" = "$applied" ] && exit 0
 
 fqdn() { # name zone
-  if [ -z "$1" ] || [ "$1" = "@" ]; then printf '%s.' "$2"; else printf '%s.%s.' "$1" "$2"; fi
+  # $1 may be relative to the zone, "@"/empty for the apex, or already a FQDN
+  # (trailing dot). Only append the zone in the relative case; appending it to
+  # an already-qualified name yields a "..", which nsupdate rejects as an
+  # "invalid owner name: empty label".
+  case "$1" in
+    ''|'@') printf '%s.' "$2" ;;
+    *.)     printf '%s' "$1" ;;
+    *)      printf '%s.%s.' "$1" "$2" ;;
+  esac
 }
 
 msg="$(mktemp)"