From 2940d7cf1eb739031e75211372162fb8756407f6 Mon Sep 17 00:00:00 2001
From: Corentin Forler <corentin@dokos.io>
Date: Fri, 27 Sep 2024 17:58:25 +0200
Subject: [PATCH] feat(IPv6): Allow custom domains with AAAA domains

---
 press/api/site.py                             | 42 ++++++++++++++++++-
 .../press/doctype/site_domain/site_domain.py  |  5 ++-
 2 files changed, 44 insertions(+), 3 deletions(-)

diff --git a/press/api/site.py b/press/api/site.py
index 582399fd26..4140148b51 100644
--- a/press/api/site.py
+++ b/press/api/site.py
@@ -1615,6 +1615,37 @@ def check_dns_a(name, domain):
 	return result
 
 
+def check_dns_aaaa(name, domain):
+	result = {"type": "AAAA", "matched": False, "answer": ""}
+	try:
+		resolver = Resolver(configure=False)
+		resolver.nameservers = NAMESERVERS
+		answer = resolver.query(domain, "AAAA")
+		domain_ip = answer[0].to_text()
+		site_ip = resolver.query(name, "AAAA")[0].to_text()
+		result["answer"] = answer.rrset.to_text()
+		if domain_ip == site_ip:
+			result["matched"] = True
+		elif site_ip:
+			# We can issue certificates even if the domain points to the secondary proxies
+			server = frappe.db.get_value("Site", name, "server")
+			proxy = frappe.db.get_value("Server", server, "proxy_server")
+			secondary_ips = frappe.get_all(
+				"Proxy Server",
+				{"status": "Active", "primary": proxy, "is_replication_setup": True},
+				pluck="ip6",
+			)
+			if domain_ip in secondary_ips:
+				result["matched"] = True
+	except dns.exception.DNSException as e:
+		result["answer"] = str(e)
+	except Exception as e:
+		result["answer"] = str(e)
+		log_error("DNS Query Exception - AAAA", site=name, domain=domain, exception=e)
+	finally:
+		return result
+
+
 def ensure_dns_aaaa_record_doesnt_exist(domain: str):
 	"""
 	Ensure that the domain doesn't have an AAAA record
@@ -1639,7 +1670,7 @@ def ensure_dns_aaaa_record_doesnt_exist(domain: str):
 
 def check_dns_cname_a(name, domain):
 	check_domain_allows_letsencrypt_certs(domain)
-	ensure_dns_aaaa_record_doesnt_exist(domain)
+	# ensure_dns_aaaa_record_doesnt_exist(domain)
 	cname = check_dns_cname(name, domain)
 	result = {"CNAME": cname}
 	result.update(cname)
@@ -1651,6 +1682,15 @@ def check_dns_cname_a(name, domain):
 	result.update({"A": a})
 	result.update(a)
 
+	# Check that both A and AAAA records match a proxy
+	aaaa = check_dns_aaaa(name, domain)
+	result.update({"AAAA": aaaa})
+	a_found = a["answer"] and "does not contain an answer" not in a["answer"]
+	aaaa_found = aaaa["answer"] and "does not contain an answer" not in aaaa["answer"]
+	if a_found and aaaa_found and a["matched"] != aaaa["matched"]:
+		# There is both records but one does not match.
+		result["matched"] = False
+
 	return result
 
 
diff --git a/press/press/doctype/site_domain/site_domain.py b/press/press/doctype/site_domain/site_domain.py
index 71f38ca31c..9eff6efaf6 100644
--- a/press/press/doctype/site_domain/site_domain.py
+++ b/press/press/doctype/site_domain/site_domain.py
@@ -204,9 +204,10 @@ def update_dns_type():
 			return
 		try:
 			response = check_dns(domain.site, domain.domain)
-			if response["matched"] and response["type"] != domain.dns_type:
+			dns_type = "A" if response["type"] == "AAAA" else response["type"]
+			if response["matched"] and dns_type != domain.dns_type:
 				frappe.db.set_value(
-					"Site Domain", domain.name, "dns_type", response["type"], update_modified=False
+					"Site Domain", domain.name, "dns_type", dns_type, update_modified=False
 				)
 			pretty_response = json.dumps(response, indent=4, default=str)
 			frappe.db.set_value(