arbazkhan971 Activate When
/godmode:network, "configure DNS", "SSL certificate"- "CDN setup", "load balancer", "firewall rules"
- "502 bad gateway", "certificate expired", "VPC design"
Workflow
1. Network Discovery
dig +short <domain> A
dig +short <domain> CNAME
dig +short <domain> MX
dig +short <domain> TXT
nslookup <domain>
| Component | Provider | Status |
| DNS | <provider> | configured/missing |
| SSL/TLS | <issuer> | valid/expired/none |
| CDN | <provider> | active/none |
| LB | <type> | healthy/degraded |
| VPC | <provider> | configured/none |
2. DNS Configuration
| Record | Type | Value | TTL | Proxy |
| @ | A | <LB IP> | 300 | Yes |
| www | CNAME | @ | 300 | Yes |
| api | A | <API LB> | 60 | Yes |
| mail | MX | <server> | 3600 | N/A |
| @ | TXT | v=spf1.. | 3600 | N/A |
# Check propagation
dig @8.8.8.8 <domain> A +short
dig @1.1.1.1 <domain> A +short
IF domain not resolving: check NS records first. IF email not delivered: verify MX + SPF + DKIM + DMARC.
3. SSL/TLS Certificate Management
sudo certbot certonly --webroot \
-w /var/www/html -d <domain> -d www.<domain>
# Wildcard (DNS challenge)
sudo certbot certonly --dns-<provider> \
-d <domain> -d *.<domain>
Auto-renewal: ENABLED (certbot or cert-manager)
Alert: 14 days before expiry
TLS: min 1.2, prefer 1.3
HSTS: enabled with preload
IF cert expires < 30 days: renew immediately. IF TLS < 1.2: upgrade, disable SSLv3/TLS1.0/1.1.
4. CDN Configuration
Cache strategy:
| Asset | Cache-Control | CDN TTL |
| HTML | no-cache | 0 |
| JS/CSS (hashed) | immutable, max-age=31536000 | 1yr |
| Images | max-age=604800 | 7 days |
| Fonts | max-age=31536000 | 1 year |
| API | private, no-store | 0 |
5. Load Balancer
ALB: internet-facing, 2+ AZs, TLS termination
Health check: /healthz every 5s, rise 2, fall 3
Target groups by service, port-based routing
Nginx: least_conn, keepalive 32
Primary servers weighted, backup for failover
HAProxy: leastconn backend, 5s health interval
Max 1000 connections/server, 5s queue timeout
IF 502/503: check target health, SGs, port, path. IF high latency: check backend connections, keepalive.
6. Network Security
VPC: 10.0.0.0/16
Public: 10.0.1.0/24, 10.0.2.0/24 (ALB, NAT)
Private: 10.0.10.0/24, 10.0.11.0/24 (app)
Isolated: 10.0.20.0/24, 10.0.21.0/24 (DB)
SG: alb-sg (443 from 0.0.0.0/0)
app-sg (<port> from alb-sg only)
db-sg (5432 from app-sg only)
Defense in depth: WAF -> NACL -> SG -> NetworkPolicy
# Network diagnostics
curl -w "@curl-format.txt" -o /dev/null -s http://localhost:8080/health
dig +stats example.com
Quality Targets
- Target: <100ms DNS resolution time
- TLS handshake: <200ms for new connections
- Target: >99.9% packet delivery rate
- Max connection pool: <1000 concurrent connections per host
Hard Rules
- EVERY public endpoint: TLS 1.2+ with valid cert.
- NEVER expose DB ports to the internet.
- NEVER 0.0.0.0/0 in SG except ALB on 80/443.
- ALWAYS auto-renew certificates.
- Three-tier VPC: public, private, isolated.
TSV Logging
Append .godmode/network-results.tsv:
timestamp resource_type count tls_status status
Keep/Discard
KEEP if: validation passes AND connectivity confirmed
AND no security regressions.
DISCARD if: validation fails OR connectivity broken.
Validate: dig, openssl, curl, traceroute.
Stop Conditions
STOP when FIRST of:
- All components configured and validated
- curl -sI https://{domain} returns 200 + HSTS
- User requests stop
Autonomous Operation
On failure: git reset --hard HEAD~1. Never pause.
Error Recovery
| Failure | Action |
|---|---|
| TLS expires | Auto-renewal + alert at 30/14/7d |
| LB 502/503 | Target health, SGs, port, path |
| DNS wrong IP | Check A/AAAA, CDN proxy, TTL |