From d49177642c80a857d90872497094b707ef9fa307 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Thu, 10 Sep 2026 13:57:28 -0400
Subject: [PATCH] Move domain information to all in private

---
 server/lib/dns/generateDomains.ts         |  3 ++
 server/lib/readConfigFile.ts              | 17 --------
 server/private/lib/dns/generateDomains.ts | 47 +++++++++++++++++++++++
 server/private/lib/readConfigFile.ts      |  2 +-
 server/routers/domain/createOrgDomain.ts  | 18 ++-------
 5 files changed, 54 insertions(+), 33 deletions(-)
 create mode 100644 server/lib/dns/generateDomains.ts
 create mode 100644 server/private/lib/dns/generateDomains.ts

diff --git a/server/lib/dns/generateDomains.ts b/server/lib/dns/generateDomains.ts
new file mode 100644
index 000000000..cde08254f
--- /dev/null
+++ b/server/lib/dns/generateDomains.ts
@@ -0,0 +1,3 @@
+export function createCname(domainId: string, baseDomain: string) {}
+
+export function createNs() {}
diff --git a/server/lib/readConfigFile.ts b/server/lib/readConfigFile.ts
index c685821d1..9cf0568b4 100644
--- a/server/lib/readConfigFile.ts
+++ b/server/lib/readConfigFile.ts
@@ -493,23 +493,6 @@ export const configSchema = z
                     .prefault({})
             })
             .optional()
-            .prefault({}),
-        dns: z
-            .object({
-                nameservers: z
-                    .array(z.string().optional().optional())
-                    .optional()
-                    .default([
-                        "ns1.pangolin.net",
-                        "ns2.pangolin.net",
-                        "ns3.pangolin.net"
-                    ]),
-                cname_extension: z
-                    .string()
-                    .optional()
-                    .default("cname.pangolin.net")
-            })
-            .optional()
             .prefault({})
     })
     .refine(
diff --git a/server/private/lib/dns/generateDomains.ts b/server/private/lib/dns/generateDomains.ts
new file mode 100644
index 000000000..070a45dac
--- /dev/null
+++ b/server/private/lib/dns/generateDomains.ts
@@ -0,0 +1,47 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { build } from "@server/build";
+import privateConfig from "#private/lib/config";
+
+export function createCname(domainId: string, baseDomain: string) {
+    if (!privateConfig.getRawPrivateConfig().dns?.cname_extension) {
+        throw new Error("CNAME extension not configured");
+    }
+
+    let cnameRecords = [
+        {
+            value: `${domainId}.${privateConfig.getRawPrivateConfig().dns?.cname_extension}`,
+            baseDomain: baseDomain
+        },
+        {
+            value: `_acme-challenge.${domainId}.${privateConfig.getRawPrivateConfig().dns?.cname_extension}`,
+            baseDomain: `_acme-challenge.${baseDomain}`
+        }
+    ];
+
+    return cnameRecords;
+}
+
+export function createNs() {
+    if (!privateConfig.getRawPrivateConfig().dns?.nameserver_name) {
+        throw new Error("Nameservers not configured");
+    }
+
+    const nsRecords = [
+        privateConfig.getRawPrivateConfig().dns?.nameserver_name,
+        ...(privateConfig.getRawPrivateConfig().dns?.alternate_nameservers ||
+            [])
+    ] as string[];
+    return nsRecords;
+}
diff --git a/server/private/lib/readConfigFile.ts b/server/private/lib/readConfigFile.ts
index 2071ddeaa..bfe7734c2 100644
--- a/server/private/lib/readConfigFile.ts
+++ b/server/private/lib/readConfigFile.ts
@@ -229,7 +229,7 @@ export const privateConfigSchema = z
                     .number()
                     .int()
                     .positive()
-                    .default(60000),
+                    .default(5000),
                 // Kept safely under Let's Encrypt's ~20 req/s limit since this
                 // budget is shared across all pops workers and only covers the
                 // request-issuing calls we make directly (not every request
diff --git a/server/routers/domain/createOrgDomain.ts b/server/routers/domain/createOrgDomain.ts
index 4fd4f9957..e783de52c 100644
--- a/server/routers/domain/createOrgDomain.ts
+++ b/server/routers/domain/createOrgDomain.ts
@@ -21,6 +21,7 @@ import { LimitId } from "@server/lib/billing";
 import { isSecondLevelDomain, isValidDomain } from "@server/lib/validators";
 import { build } from "@server/build";
 import config from "@server/lib/config";
+import { createNs, createCname } from "#dynamic/lib/dns/generateDomains";
 
 const paramsSchema = z.strictObject({
     orgId: z.string()
@@ -283,8 +284,7 @@ export async function createOrgDomain(
 
             // TODO: This needs to be cross region and not hardcoded
             if (type === "ns") {
-                nsRecords = config.getRawConfig().dns.nameservers as string[];
-
+                nsRecords = createNs();
                 // Save NS records to database
                 for (const nsValue of nsRecords) {
                     recordsToInsert.push({
@@ -296,19 +296,7 @@ export async function createOrgDomain(
                     });
                 }
             } else if (type === "cname") {
-                cnameRecords = [
-                    {
-                        value: `${domainId}.${config.getRawConfig().dns.cname_extension}`,
-                        baseDomain: baseDomain
-                    }
-                ];
-
-                if (build == "saas") {
-                    cnameRecords.push({
-                        value: `_acme-challenge.${domainId}.${config.getRawConfig().dns.cname_extension}`,
-                        baseDomain: `_acme-challenge.${baseDomain}`
-                    });
-                }
+                cnameRecords = createCname(domainId, baseDomain);
 
                 // Save CNAME records to database
                 for (const cnameRecord of cnameRecords) {