tiesa.tech · DNS options · TIESA-DNS/1.0

Start here — you decide

Edition TIESA-DNS/1.0 · companion REPORT.md · author Infrastructor · Private · en-GB

Pick how tiesa.tech DNS and Vercel domain attach should work after the mcp↔dora mix-up. Infrastructor recommends Option A: keep iv.lt nameservers and mail, silo CNAMEs only, carousel as paths, and an attach gate.

Private Recommend: Option A NS @ serveriai / iv.lt Hobby · karolisvalickas-5148 2026-09-25 · Europe/Vilnius

3Architectures to compare

1Attach owner: Infrastructor

0DNS edits per new carousel topic (A)

200Hobby project wall

Decision ask

Approve Option A, Option B (B2 if per-topic hosts; B1 only with MX/SPF copy), or stay as-is. Open the Compare tab for side-by-side diagrams.

✓ Approve Option A

Keep iv.lt NS + mail. Silo CNAMEs. Paths for topics. Infrastructor-only attach. ✓✓ recommended

Approve Option B2

Only if you want per-topic hostnames later. Wildcards + ACME at iv.lt; mail stays. LT reading changes.

Approve Option B1

Move apex NS to Vercel — copy MX/SPF first or mail breaks.

Stay as-is

Accept open attach risk and flat zone growth. Not recommended after incident.

Carousel rule (authoritative)

random.tiesa.tech/<slug>/ and visokia.tiesa.tech/<slug>/ — not per-topic CNAMEs. ✓✓ [SRC-010]

Compare

Three columns side-by-side at ≥1200px viewport · stack below. Same fact graph as REPORT.md Parts 5.1–5.3.

As-is now risk

As-is · flat zone + open attach

flowchart TB subgraph Reg["Registrar iv.lt / serveriai"] NS["NS apex"] MX["MX / SPF mail"] Zone["Flat zone · many CNAMEs"] end subgraph V["Vercel Hobby"] TR["tiesa-radau"] RM["radau-mcp"] TD["tiesa-dora"] Open["Open attach · any bot"] end NS --> Zone Zone -->|"manual CNAME + attach"| TR Zone --> RM Zone --> TD Open -.->|"mcp↔dora risk"| TD MX --- NS classDef bad fill:#4a1e1e,stroke:#e79a8d,color:#fdeaea classDef prod fill:#1e3a5f,stroke:#7eb8da,color:#e8f1f8 classDef dns fill:#333,stroke:#888,color:#ddd class Open,TD bad class TR,RM prod class Zone,NS dns

Mermaid source

flowchart TB
  subgraph Reg["Registrar iv.lt / serveriai"]
    NS["NS apex"]
    MX["MX / SPF mail"]
    Zone["Flat zone · many CNAMEs"]
  end
  subgraph V["Vercel Hobby"]
    TR["tiesa-radau"]
    RM["radau-mcp"]
    TD["tiesa-dora"]
    Open["Open attach · any bot"]
  end
  NS --> Zone
  Zone -->|"manual CNAME + attach"| TR
  Zone --> RM
  Zone --> TD
  Open -.->|"mcp↔dora risk"| TD
  MX --- NS
  classDef bad fill:#4a1e1e,stroke:#e79a8d,color:#fdeaea
  classDef prod fill:#1e3a5f,stroke:#7eb8da,color:#e8f1f8
  classDef dns fill:#333,stroke:#888,color:#ddd
  class Open,TD bad
  class TR,RM prod
  class Zone,NS dns

Cause: every host = manual iv.lt CNAME + Vercel attach
Effect: flat zone grows; mcp↔dora possible again
Mail OK at serveriai; carousel intended as paths but DNS already noisy

Option A recommended

Option A · silo + paths + gate

flowchart TB subgraph Reg["iv.lt · NS / MX kept"] NS["NS apex"] MX["MX / SPF untouched"] Silo["Silo CNAMEs only"] end subgraph Gate["Attach gate"] Inf["Infrastructor only"] Gram["grammar + collision"] end subgraph V["Vercel projects"] TR["tiesa-radau"] RM["radau-mcp"] TD["tiesa-dora"] Rpt["tiesa-assistant-reports"] end subgraph Paths["Carousel paths · zero DNS/topic"] R["random.tiesa.tech/slug/"] Vi["visokia.tiesa.tech/slug/"] end NS --> Silo Silo --> TR Silo --> RM Silo --> TD Silo --> Rpt Inf --> Gram --> Silo R --- TR Vi --- TR MX --- NS classDef ok fill:#1e4d3a,stroke:#7dcea0,color:#e8f8f0 classDef prod fill:#1e3a5f,stroke:#7eb8da,color:#e8f1f8 classDef gate fill:#5b3d1e,stroke:#d4a574,color:#f5e6d3 class Inf,Gram,Silo ok class TR,RM,TD,Rpt prod class R,Vi gate

Mermaid source

flowchart TB
  subgraph Reg["iv.lt · NS / MX kept"]
    NS["NS apex"]
    MX["MX / SPF untouched"]
    Silo["Silo CNAMEs only"]
  end
  subgraph Gate["Attach gate"]
    Inf["Infrastructor only"]
    Gram["grammar + collision"]
  end
  subgraph V["Vercel projects"]
    TR["tiesa-radau"]
    RM["radau-mcp"]
    TD["tiesa-dora"]
    Rpt["tiesa-assistant-reports"]
  end
  subgraph Paths["Carousel paths · zero DNS/topic"]
    R["random.tiesa.tech/slug/"]
    Vi["visokia.tiesa.tech/slug/"]
  end
  NS --> Silo
  Silo --> TR
  Silo --> RM
  Silo --> TD
  Silo --> Rpt
  Inf --> Gram --> Silo
  R --- TR
  Vi --- TR
  MX --- NS
  classDef ok fill:#1e4d3a,stroke:#7dcea0,color:#e8f8f0
  classDef prod fill:#1e3a5f,stroke:#7eb8da,color:#e8f1f8
  classDef gate fill:#5b3d1e,stroke:#d4a574,color:#f5e6d3
  class Inf,Gram,Silo ok
  class TR,RM,TD,Rpt prod
  class R,Vi gate

Cause: silo CNAMEs only + Infrastructor attach gate
Effect: fewer zone rows; mix-ups blocked; zero DNS per topic
NS / MX / SPF stay at serveriai — no mail risk

Option B Vercel-ward

Option B · B1 NS move / B2 wildcards

flowchart TB subgraph Reg["iv.lt"] NS["NS · B2 keep / B1 move"] W["*.random / *.visokia CNAME"] ACME["_acme-challenge → Vercel"] end subgraph V["Vercel DNS / API"] API["API-driven hosts"] TLS["Wildcard TLS"] end subgraph Trade["Tradeoffs"] Read["tema.random.tiesa.tech<br/>changes LT reading"] Mail["B1 mail if MX not copied"] end NS --> W --> API ACME --> TLS API --> Read NS -.-> Mail classDef warn fill:#5b3d1e,stroke:#d4a574,color:#f5e6d3 classDef bad fill:#4a1e1e,stroke:#e79a8d,color:#fdeaea classDef prod fill:#1e3a5f,stroke:#7eb8da,color:#e8f1f8 class Read,W warn class Mail bad class API,TLS prod

Mermaid source

flowchart TB
  subgraph Reg["iv.lt"]
    NS["NS · B2 keep / B1 move"]
    W["*.random / *.visokia CNAME"]
    ACME["_acme-challenge → Vercel"]
  end
  subgraph V["Vercel DNS / API"]
    API["API-driven hosts"]
    TLS["Wildcard TLS"]
  end
  subgraph Trade["Tradeoffs"]
    Read["tema.random.tiesa.tech<br/>changes LT reading"]
    Mail["B1 mail if MX not copied"]
  end
  NS --> W --> API
  ACME --> TLS
  API --> Read
  NS -.-> Mail
  classDef warn fill:#5b3d1e,stroke:#d4a574,color:#f5e6d3
  classDef bad fill:#4a1e1e,stroke:#e79a8d,color:#fdeaea
  classDef prod fill:#1e3a5f,stroke:#7eb8da,color:#e8f1f8
  class Read,W warn
  class Mail bad
  class API,TLS prod

B1: move NS → Vercel (copy MX/SPF first)
B2: keep NS; *.random / *.visokia + ACME NS
Nested hosts change LT reading vs paths

Incident — mcp ↔ dora

What happened

mcp.tiesa.tech was wrongly attached to project tiesa-dora and showed Dora. User remove-then-add onto radau-mcp. ✓✓ [SRC-013]

Field	Detail
Cause	Open attach — any bot with Vercel access could attach wrong project
Fix	Only Infrastructor attaches after grammar + collision check
Canonical product	RadauMCP
Canonical host	`mcp.tiesa.tech`
Canonical project	`radau-mcp`
Forbidden	`tiesa-mcp` as product/project/key; `tiesa-mcp.tiesa.tech`-style

Naming rules

Lithuanian sentence-building at the apex is first-class. Sub-subdomains must keep grammar.

Host	Reading	Badge
`radau.tiesa.tech`	≈ “I found the truth”	✓
`dora.tiesa.tech`	≈ “truth in Dora”	✓
`random.tiesa.tech/<slug>/`	EN carousel path (preferred)	✓✓
`visokia.tiesa.tech/<slug>/`	LT carousel path (preferred)	✓✓
`tema.random.tiesa.tech`	Nested — changes reading; only if B2 chosen	~

Forbidden names

Do not mint tiesa-mcp product/project/key or tiesa-mcp.tiesa.tech. Use RadauMCP / mcp.tiesa.tech / radau-mcp.

Roles

Authority map

Role	Authority	Constraint
Infrastructor	All tiesa.tech DNS, Vercel projects, domains, naming, attach	Only role that attaches/moves production domains
Droplet	Randomness-carousel silo	Publish as paths under silo hosts — never self-attach
Experimenter	Research	Do not self-attach production domains
MCPator / MCP_Researcher	MCP product work	Request names; do not attach
COO	Ops coordination	Request names; do not attach

[SRC-010] ✓✓

Current map

DNS apex

NS at serveriai.lt / iv.lt
Root A 76.76.21.21
CNAMEs → cname.vercel-dns.com
MX/SPF via serveriai ✓✓

Vercel

Hobby · karolisvalickas-5148
tiesa-radau · radau-mcp · tiesa-dora
tiesa-assistant-reports not live yet

Carousel

random.tiesa.tech/<slug>/
visokia.tiesa.tech/<slug>/
Not per-topic CNAMEs

Projects

Project	Hosts	Status
tiesa-radau	tiesa.tech, www, radau, beta.radau, docs	Live
radau-mcp	mcp (+ beta.mcp once DNS)	Live · repaired
tiesa-dora	dora.tiesa.tech	Frozen PoC
tiesa-assistant-reports	reports.tiesa.tech (intended)	DNS CNAME exists · project not live · Infrastructor handoff · Kuglys/tiesa-assistant-reports

Hostname inventory (known)

Subset for human scan — full table in REPORT.md Part 6. CNAMEs → cname.vercel-dns.com unless noted.

Host	Family	Project	Status
`@` / www	apex	tiesa-radau	Live
radau / beta.radau	radau	tiesa-radau	Live
docs / beta.docs	docs	tiesa-radau	Live / reserved
mcp / beta.mcp	RadauMCP	radau-mcp	Live / beta pending
dora	dora	tiesa-dora	Frozen PoC
reports / ataskaitu	reports	tiesa-assistant-reports	DNS yes · project not live
random / beta.random	carousel EN	silo TBD	DNS · paths model
visokia / beta.visokia	carousel LT	silo TBD	DNS · paths model
surasta / rasta / ieskota / nerasta	past / state	—	DNS reserved
iso / iso.random / isomcp	ISO	partial	Mixed

Hobby limits

200Projects max

50Domains / project

100Deploys / day

1Concurrent build

Topic scale guidance

50 topics OK · 200 = Hobby wall · 500 needs Pro. Path model keeps DNS rows flat. [SRC-001] ✓✓

Diagram — As-is

Larger view of Compare column 1. Registrar/iv.lt, flat zone, open attach, mail MX.

As-is now · flat zone + open attach

Mermaid source

flowchart TB
  subgraph Reg["Registrar iv.lt / serveriai"]
    NS["NS apex"]
    MX["MX / SPF mail"]
    Zone["Flat zone · many CNAMEs"]
  end
  subgraph V["Vercel Hobby"]
    TR["tiesa-radau"]
    RM["radau-mcp"]
    TD["tiesa-dora"]
    Open["Open attach · any bot"]
  end
  NS --> Zone
  Zone -->|"manual CNAME + attach"| TR
  Zone --> RM
  Zone --> TD
  Open -.->|"mcp↔dora risk"| TD
  MX --- NS
  classDef bad fill:#4a1e1e,stroke:#e79a8d,color:#fdeaea
  classDef prod fill:#1e3a5f,stroke:#7eb8da,color:#e8f1f8
  classDef dns fill:#333,stroke:#888,color:#ddd
  class Open,TD bad
  class TR,RM prod
  class Zone,NS dns

NS at serveriai.lt; every hostname = manual CNAME + Vercel attach
Any bot with Vercel access can attach wrong project (mcp↔dora happened)
Carousel still intended as paths; DNS already has many beta.* / topic-looking rows

Diagram — Option A (recommended)

Option A · keep iv.lt · silo CNAMEs · path hosts · attach gate

Mermaid source

flowchart TB
  subgraph Reg["iv.lt · NS / MX kept"]
    NS["NS apex"]
    MX["MX / SPF untouched"]
    Silo["Silo CNAMEs only"]
  end
  subgraph Gate["Attach gate"]
    Inf["Infrastructor only"]
    Gram["grammar + collision"]
  end
  subgraph V["Vercel projects"]
    TR["tiesa-radau"]
    RM["radau-mcp"]
    TD["tiesa-dora"]
    Rpt["tiesa-assistant-reports"]
  end
  subgraph Paths["Carousel paths · zero DNS/topic"]
    R["random.tiesa.tech/slug/"]
    Vi["visokia.tiesa.tech/slug/"]
  end
  NS --> Silo
  Silo --> TR
  Silo --> RM
  Silo --> TD
  Silo --> Rpt
  Inf --> Gram --> Silo
  R --- TR
  Vi --- TR
  MX --- NS
  classDef ok fill:#1e4d3a,stroke:#7dcea0,color:#e8f8f0
  classDef prod fill:#1e3a5f,stroke:#7eb8da,color:#e8f1f8
  classDef gate fill:#5b3d1e,stroke:#d4a574,color:#f5e6d3
  class Inf,Gram,Silo ok
  class TR,RM,TD,Rpt prod
  class R,Vi gate

Keep apex NS / MX / SPF at serveriai
One CNAME per silo host only: random, visokia, reports, mcp, radau, dora, docs, …
Topics live as paths; only Infrastructor attaches; no nested wildcards required

Diagram — Option B

Option B · B1 NS to Vercel / B2 wildcards + ACME

Mermaid source

flowchart TB
  subgraph Reg["iv.lt"]
    NS["NS · B2 keep / B1 move"]
    W["*.random / *.visokia CNAME"]
    ACME["_acme-challenge → Vercel"]
  end
  subgraph V["Vercel DNS / API"]
    API["API-driven hosts"]
    TLS["Wildcard TLS"]
  end
  subgraph Trade["Tradeoffs"]
    Read["tema.random.tiesa.tech<br/>changes LT reading"]
    Mail["B1 mail if MX not copied"]
  end
  NS --> W --> API
  ACME --> TLS
  API --> Read
  NS -.-> Mail
  classDef warn fill:#5b3d1e,stroke:#d4a574,color:#f5e6d3
  classDef bad fill:#4a1e1e,stroke:#e79a8d,color:#fdeaea
  classDef prod fill:#1e3a5f,stroke:#7eb8da,color:#e8f1f8
  class Read,W warn
  class Mail bad
  class API,TLS prod

B1: move apex nameservers to Vercel — copy MX/SPF first or mail breaks
B2: keep NS at iv.lt; add *.random / *.visokia CNAME + _acme-challenge.<silo> NS to Vercel
Effect: more API-driven DNS; nested hostnames change Lithuanian reading vs paths
If per-topic hostnames preferred → choose B2, not B1

Option comparison matrix

Full matrix

Criterion	As-is	Option A	B1	B2
Apex NS	iv.lt	iv.lt kept	→ Vercel	iv.lt kept
Mail MX/SPF	serveriai	untouched	must copy first	untouched
Zone rows	many flat	silo only	Vercel-managed	silo + wildcards
New carousel topic	tempt DNS	zero DNS	API optional	API nested optional
Attach control	open	Infrastructor gate	Infra + API	Infra + API
LT grammar	at risk	preserved	depends	nested changes
Mail risk	low	lowest	highest if slip	low
Complexity	medium mess	low process	high cutover	medium once

ADRs

ID	Decision	Status
ADR-DNS-01	Infrastructor sole attach authority	Proposed with A
ADR-DNS-02	Carousel topics = paths under random/visokia	Affirmed
ADR-DNS-03	Forbidden tiesa-mcp*; canonical RadauMCP / mcp / radau-mcp	Affirmed
ADR-DNS-04	Keep apex NS + MX/SPF at serveriai unless B1 chosen	Recommended
ADR-DNS-05	If per-topic hosts later → prefer B2 over B1	Contingent
ADR-DNS-06	reports.tiesa.tech → tiesa-assistant-reports handoff	Open action

Limitations

No live zone re-export

Inventory inherits PBS / Experimenter facts this edition.

MX/SPF RDATA omitted

Treated as serveriai-managed ~.

Hobby quotas snapshot

Vercel docs as of 2026-09-25; may change.

Diagrams ≠ runbooks

Decision aids only — human gate before zone edits.

Formative ≠ validated

Awaiting approve Option A / B / stay as-is.

Sources

ID	Source	Tier
SRC-001	Vercel Docs — Limits / Hobby (200 projects, 50 domains/project, 100 deploys/day, 1 concurrent build)	Official
SRC-010	Experimenter / Droplet / house facts — roles, carousel paths, LT sentence-building	Operator
SRC-011	Architecture PBS twin 2026-09-25_tiesa-architecture-pbs — inventory, apex A	Internal
SRC-012	Vercel project map — tiesa-radau / radau-mcp / tiesa-dora / reports handoff	Operator
SRC-013	Incident mcp↔dora wrong attach; repaired onto radau-mcp	Operator ✓✓