Superuser login for the asxp.io admin moves to admin.asxp.io, which
Traefik only serves to WireGuard and the VPC. The public A record is
there for the Let's Encrypt HTTP challenge, like gf; clients reach it
through split-horizon hosts entries.
Assisted-by: Claude:opus-5-5
Grafana is WireGuard-only; WireGuard clients map the name to the ops
WireGuard address. A public AAAA record made browsers prefer the public
path, where the allowlist answers 403.
Assisted-by: Claude:opus-5-5
Same pattern as traefik.asxp.io: public records to asxpio-ops, so
Traefik gets a Let's Encrypt certificate over HTTP-01, while an IP
allowlist limits it to WireGuard.
Assisted-by: Claude:opus-5-5
The zones were edited by hand in the console, and it showed: dozens of
records for servers that no longer existed, a CNAME and a TXT record
missing their trailing dot, and a 24 h default TTL that made today's
XMPP move linger in resolver caches.
Now both zones live in the asxpio project, so describe them here,
adopted with import blocks (the first apply imported 87 and changed
nothing but protection). Our servers' records reference hcloud_server
instead of literal IPs. Every record set is change-protected except
those of the test XMPP servers, and both zones are delete-protected.
Assisted-by: Claude:opus-5-5
