nx_golive_dns_gate.nx

nx_golive_dns_gate.nx -- GO-LIVE GATE: every hosted domain must be testable INTERNALLY and EXTERNALLY, by construction, so the "apex works but admin.<domain> is insecure on WiFi" class (2026-07-04/05 andelinwest arc) can never ship again. Data-driven from knowledge/hosting/golive_dns.conf (domain|public_ip|lan_ip|lan_wildcard). Per domain: [A] EXTERNAL AUTHORITY -- Porkbun API (sovereign TLS, uninterceptable): apex A == public_ip AND '*.domain' A == public_ip => any subdomain reaches the edge from the internet. [B] INTERNAL LAN -- query the LAN router (dnsmasq) directly: apex -> lan_ip; and when lan_wildcard=1 a CANARY subdomain (nx-golive-canary.<domain>) -> lan_ip. The canary is the whole point: per-host override lists pass apex/www and silently miss new subdomains; only a whole-domain wildcard answers a name nobody registered. [C] EDGE SERVE -- TLS 1.3 to lan_ip:443 with SNI apex (+ canary when lan_wildcard=1): served cert must VALIDATE for that SNI (chain + SAN + validity vs Mozilla store) and GET / must return HTTP 2xx/3xx => sni_router -> cert-select -> proxy -> daemon serve the whole domain. Every RED prints its exact remediation command. Exit 0 = all GREEN, 1 = any RED. Honest limit: true external-vantage serving (hairpin-free) still needs one off-LAN check (cellular funcheck row); [A]+[C] are the strongest in-LAN-provable superset. usage: nx_golive_dns_gate (run nx_secret_cli get porkbun first -> /tmp/nxsecret.out) license_tier: ORIGINAL