From 6ea1b0f5f253ca337ec1e507822ee75c2bca244c Mon Sep 17 00:00:00 2001 From: Jens Ahrensfeld Date: Sun, 26 Jul 2026 10:30:44 +0200 Subject: [PATCH] Confirm uschi dyndns migration live, note test-collision wrinkle Real FritzBox update authenticated as uschi landed after a WAN IP change, confirmed via dig. Documented the earlier test-value collision where a verification write clobbered the device's first post-migration update, resolved by its next natural IP change - no lasting impact, but noted as a lesson for future verification steps. Co-Authored-By: Claude Sonnet 5 --- TODO.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/TODO.md b/TODO.md index c7dfb62..6b849fc 100644 --- a/TODO.md +++ b/TODO.md @@ -154,6 +154,19 @@ Nothing here is urgent; all are low-risk, no-downtime changes. of any kind. The `jens` `.htpasswd` account itself was left in place (not asked to remove it, and it's now inert for DNS updates anyway since it has no hostname or grant left to use). + **`uschi` migration confirmed live 2026-07-26**: after the legacy + fallback was removed, a real WAN IP change (connection recycle, not + a test) produced a genuine `Fritz!Box DDNS/1.0.3` request + authenticated as `uschi` updating `uschi.dyndns.jayfield.org` to + `92.252.63.190`, confirmed via `dig`. (One wrinkle along the way: an + earlier verification test of mine — writing `uschi`'s old IP back + to confirm the fix — landed moments after that device's *first* + post-migration update and clobbered it back to the stale value; the + device's next natural IP change overwrote it correctly, so no + lasting effect, but a reminder to use non-colliding test values when + a real device might update concurrently.) Both `uschi` and `vpn` are + now fully migrated to dedicated per-host logins with no legacy + exceptions remaining anywhere in the setup. - [x] **dyndns/default-vhost access logging is a no-op** — done 2026-07-25 found 2026-07-20 while investigating the command injection below.