Starweb dev log #10

Starweb has domains now. There’s .web, with a DNS behind it.

StarDNS (name is temporary) is an authoritative server for the .web zone. It answers over UDP, falls back to TCP when a reply won’t fit, and reads records out of MongoDB. Three parts in one process: the resolver, a panel to manage names, and a CA that issues star:// certs.

the panel

Sign in, and you get three domains, each a single label under .web. Records are A, AAAA, CNAME, TXT with a TTL from 60 to 86400. The rules a resolver relies on are enforced on the way in: a CNAME can’t share a name with another record or sit at the apex. @ is the domain itself, *.dev is a wildcard, and a CNAME target with no dot is relative. It’s served with the starweb package, so you browse it in Starmap like any page. Every action is also a JSON route, so it’s scriptable from starweb post.

certificates

“Issue certificate” makes a P-256 leaf covering mysite.web and *.mysite.web, signed by the StarWeb root, valid 825 days. Stored in Mongo and written to dns/issued/; the key never touches the database. The root is name-constrained to .web now, so it can’t issue for a public name; ca.issue("www.google.com") fails its own verify, and a test holds it there.

resolving

The browser and client resolve .web themselves. A host in the zone gets asked straight to StarDNS over UDP (src/common/resolver.hpp), never getaddrinfo, which would leak the lookup to a public DNS. No fallback: if StarDNS can’t answer, the load fails instead of quietly asking the public resolver. Anything that isn’t .web still goes to the system resolver. It chases CNAMEs, queries A and AAAA separately, and caches by TTL so a page’s subresources cost one lookup. Point it elsewhere with STARWEB_DNS, or STARWEB_DNS=off to fall back.

Next is the look of the website.