From b8f09b7f75874af8316d3667cf52eb615bd22dee Mon Sep 17 00:00:00 2001
From: Jeremy Daer <jeremydaer@gmail.com>
Date: Sat, 11 Oct 2025 15:57:47 -0700
Subject: [PATCH] Deploy to fully-qualified domain names to eliminate DNS
 search path driven query amplification (#1293)

---
 .kamal/hooks/pre-connect     | 29 +++++++++++++++++++++++++++--
 config/deploy.beta.yml       | 12 ++++++------
 config/deploy.production.yml | 12 ++++++------
 config/deploy.staging.yml    | 12 ++++++------
 4 files changed, 45 insertions(+), 20 deletions(-)

diff --git a/.kamal/hooks/pre-connect b/.kamal/hooks/pre-connect
index 11cbb0a33..2b6d9af42 100755
--- a/.kamal/hooks/pre-connect
+++ b/.kamal/hooks/pre-connect
@@ -1,7 +1,32 @@
 #!/usr/bin/env bash
-#
-# Verify Tailscale connection and SSH authentication before deploying.
 
+# Validate hostnames are FQDNs ending in -int.37signals.com
+if command -v yq >/dev/null 2>&1; then
+  declare -A SUGGESTIONS
+  while IFS= read -r host; do
+    if [[ ! $host =~ -int\.37signals\.com$ ]]; then
+      if [[ $host =~ -4[0-9]{2}$ ]]; then
+        SUGGESTIONS["$host"]="$host.df-ams-int.37signals.com"
+      elif [[ $host =~ -1[0-9]{2}$ ]]; then
+        SUGGESTIONS["$host"]="$host.df-iad-int.37signals.com"
+      else
+        SUGGESTIONS["$host"]="$host.sc-chi-int.37signals.com"
+      fi
+    fi
+  done < <(bin/kamal config -d "${KAMAL_DESTINATION:-production}" 2>/dev/null | yq '.":hosts"[]')
+
+  if [ ${#SUGGESTIONS[@]} -gt 0 ]; then
+    echo "Unqualified hostnames found in config/deploy.${KAMAL_DESTINATION:-production}.yml:" >&2
+    echo "" >&2
+    echo "Update to use fully-qualified hostnames:" >&2
+    for host in "${!SUGGESTIONS[@]}"; do
+      echo "  $host → ${SUGGESTIONS[$host]}" >&2
+    done
+    exit 1
+  fi
+fi
+
+# Verify Tailscale connection and SSH authentication before deploying.
 tailscale_cmd() {
   if command -v tailscale >/dev/null 2>&1; then
     tailscale "$@"
diff --git a/config/deploy.beta.yml b/config/deploy.beta.yml
index 711730945..8dfb783ff 100644
--- a/config/deploy.beta.yml
+++ b/config/deploy.beta.yml
@@ -1,13 +1,13 @@
 servers:
   web:
     hosts:
-      - fizzy-beta-app-01
-      - fizzy-beta-app-101
+      - fizzy-beta-app-01.sc-chi-int.37signals.com
+      - fizzy-beta-app-101.df-iad-int.37signals.com
     labels:
       otel_scrape_enabled: true
   jobs:
     hosts:
-      - fizzy-beta-app-01
+      - fizzy-beta-app-01.sc-chi-int.37signals.com
     labels:
       otel_scrape_enabled: true
 
@@ -42,12 +42,12 @@ accessories:
       - fizzy:/home/beamer
     cmd: beamer run --retention=1h --metrics-port=9000
     hosts:
-      - fizzy-beta-app-01
-      - fizzy-beta-app-101
+      - fizzy-beta-app-01.sc-chi-int.37signals.com
+      - fizzy-beta-app-101.df-iad-int.37signals.com
 
   load-balancer:
     image: basecamp/kamal-proxy:lb
-    host: fizzy-beta-lb-01
+    host: fizzy-beta-lb-01.sc-chi-int.37signals.com
     options:
       publish:
         - 80:80
diff --git a/config/deploy.production.yml b/config/deploy.production.yml
index b21749c26..cc92bf005 100644
--- a/config/deploy.production.yml
+++ b/config/deploy.production.yml
@@ -1,13 +1,13 @@
 servers:
   web:
     hosts:
-      - fizzy-app-101
-      - fizzy-app-102
+      - fizzy-app-101.df-iad-int.37signals.com
+      - fizzy-app-102.df-iad-int.37signals.com
     labels:
       otel_scrape_enabled: true
   jobs:
     hosts:
-      - fizzy-app-101
+      - fizzy-app-101.df-iad-int.37signals.com
     labels:
       otel_scrape_enabled: true
 
@@ -42,12 +42,12 @@ accessories:
       - fizzy:/home/beamer
     cmd: beamer run --retention=1h --metrics-port=9000
     hosts:
-      - fizzy-app-101
-      - fizzy-app-102
+      - fizzy-app-101.df-iad-int.37signals.com
+      - fizzy-app-102.df-iad-int.37signals.com
 
   load-balancer:
     image: basecamp/kamal-proxy:lb
-    host: fizzy-lb-101
+    host: fizzy-lb-101.df-iad-int.37signals.com
     labels:
       otel_role: load-balancer
       otel_service: fizzy-load-balancer
diff --git a/config/deploy.staging.yml b/config/deploy.staging.yml
index 7335abd97..fe2d3bf01 100644
--- a/config/deploy.staging.yml
+++ b/config/deploy.staging.yml
@@ -1,13 +1,13 @@
 servers:
   web:
     hosts:
-      - fizzy-staging-app-01
-      - fizzy-staging-app-101
+      - fizzy-staging-app-01.sc-chi-int.37signals.com
+      - fizzy-staging-app-101.df-iad-int.37signals.com
     labels:
       otel_scrape_enabled: true
   jobs:
     hosts:
-      - fizzy-staging-app-01
+      - fizzy-staging-app-01.sc-chi-int.37signals.com
     labels:
       otel_scrape_enabled: true
 
@@ -42,12 +42,12 @@ accessories:
       - fizzy:/home/beamer
     cmd: beamer run --retention=1h --metrics-port=9000
     hosts:
-      - fizzy-staging-app-01
-      - fizzy-staging-app-101
+      - fizzy-staging-app-01.sc-chi-int.37signals.com
+      - fizzy-staging-app-101.df-iad-int.37signals.com
 
   load-balancer:
     image: basecamp/kamal-proxy:lb
-    host: fizzy-staging-lb-01
+    host: fizzy-staging-lb-01.sc-chi-int.37signals.com
     labels:
       otel_role: load-balancer
       otel_service: fizzy-load-balancer