forked from unom/punktfunk
enricobuehler
7e4fe80793
Two corrections and one thing actually done. DNS here is not a dashboard click. unom/infra owns the unom.io zone in OpenTofu (terraform/cloudflare/records.tf, applied by dns-cutover.yml), and that file's `local.hostnames` set carries its own invariant: "a name here with no vhost 404s, a vhost with no name here never cuts over." A record added by hand in Cloudflare is out-of-band and risks the duplicate-record round-robin the file documents a few lines further down — the same class of trap as hand-editing ~/caddy/Caddyfile on the box. The setup steps said "in the unom.io Cloudflare zone" as though it were a manual change; they now name both files, the workflow that applies them, and the one-added-record check to expect from `plan`. unom/infra#20 makes the change. The signing key is generated and `NIX_CACHE_SIGNING_KEY` is installed as a repo Actions secret, so its public half is no longer a placeholder: punktfunk-cache-1:yhOJmHxzg6tzXpxSFzlYn6Pc6r0jHprsWqt8MZC654o= pinned in both docs. The publish step still writes the same value to /punktfunk-cache.pub, so the docs can always be checked against the cache itself — and the wizard now compares the two and warns on a mismatch, because docs that disagree with the cache mean users reject everything it serves. The wizard drops to four stages. DNS and the vhost were separate stages when they looked like separate manual steps; they are one PR against one repo, so they are one stage. The key stage now detects the installed key, prints it, and refuses to casually regenerate — a new key invalidates every signature already published and breaks every user pinning the old one. Verified: shellcheck + `bash -n` clean, 4 stages against TOTAL_STAGES=4, and the already-installed path's key extraction tested against the real README.