Secondary zones (kind=secondary) AXFR from configured masters into an
in-memory SecondaryStore so authority answers without writing primary
dns_records. Zone serial and SOA metadata update on successful transfer.
Only GET responses fill the shared cache key so HEAD misses cannot
poison later GETs with empty bodies. Reject Cache-Control private/
no-store and credential-sensitive Vary. Validate purge selectors
(coerce single strings; 400 on other non-lists). Document dual flags
and cache_authenticated shared-key semantics; sync OpenAPI; harden
put/purge against GenServer blips; batch byte LRU eviction.
Serve TCP zone transfers when DNS_SECONDARY_AXFR_ENABLED and per-zone ACL
allow the client. Unsigned path uses IP allow-lists only; require-TSIG
zones refuse until wire MAC verification lands.
Add zone-owned dns_tunnels credentials, write:edge/read:edge PAT scopes,
/_edge/tunnel/v1 register|refresh|ws|disconnect, Edge.Connector sessions,
length-prefixed frame codec, and a WebSockex-based outbound agent that
publishes only ORIGIN_URL. Feature defaults off via DNS_TUNNEL_ENABLED.
Also regroup timeline post_operations clauses so Elixir 1.20 compiles clean
under --warnings-as-errors.
Implement exchange-code Access for access_oidc rules using the platform
IdP only. Cookie is host-only and set solely on complete; open redirects
and non-owner users fail closed.
Add an opt-in ETS HTTP edge cache for proxied hosts, gated by
DNS_CACHE_ENABLED (default false) and matching edge-rule action type
"cache". Cache is single-node only: GET/HEAD 200 responses, never
Set-Cookie, and never Authorization/Cookie requests unless
cache_authenticated. LRU eviction honors max entries and bytes.
Introduce write:edge / read:edge PAT scopes and POST
/api/ext/v1/dns/zones/:id/cache/purge (write:edge) for local purge by
hosts, prefixes, or tags. Multi-node fanout is intentionally absent.
Register multi-node edge sites with per-site bearer heartbeats so proxied
DNS answers exclude down edge IPs while failing open if every site is down.
Instance-admin mint only; empty registry keeps env edge IPs as a singleton up site.
Add zone-scoped dns_edge_rules with a pure evaluation engine and wire
redirect/rate_limit/WAF/access placeholder into DNSEdgeProxy before origin
resolve. Feature defaults off (DNS_EDGE_RULES_ENABLED=false); empty rules
remain a no-op allow. Includes LiveView CRUD, write:dns ext API, and tests
for priority order and missing-origin redirects.
