# Duckdns Url Bookmark

> USER-INVOKED. Bookmark any URL -- a DuckDNS domain of your own or anything else -- so it appears as a link on the VPN-egress GUI status page AND becomes part of the outside-the-network sweep. Use when the user says 'bookmark this URL', '/duckdns-url-bookmark', 'add this to my bookmarks', 'add this domain to the sweep', or hands over a URL they want tracked. Also covers listing, removing, and checking bookmarks from the external vantage point.

- Skill: `therocksss/duckdns-url-bookmark` (Agent Skill)
- Install (CLI): `npx skillmds@latest add therocksss/duckdns-url-bookmark`
- Raw SKILL.md: https://api.skillmd.com/api/skills/therocksss/duckdns-url-bookmark/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: THEROCKSSS (https://skillmd.com/u/therocksss)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/therocksss/duckdns-url-bookmark

---


# DuckDNS URL Bookmark

Bookmark a URL once; get two things.

1. It renders as a link on the **status page** at `:3081`, inside the browser
   that exits through the Mullvad tunnel — so it is one click from a genuine
   outside-the-network view.
2. It joins the **sweep**, so `check-domains.js` tests it from that same exit
   without anyone maintaining a second list.

That is the whole reason bookmarks live in a file rather than in a browser
profile: a browser bookmark only helps a human, and only on one machine.

## Bookmark something

```bash
cd projects/vpn-egress
bash tools/bookmark.sh add <url>
```

Takes several URLs at once. A bare hostname is fine — `example.com` becomes
`https://example.com`. Duplicates are ignored rather than erroring.

```bash
bash tools/bookmark.sh list
bash tools/bookmark.sh remove <url>
```

## Check a bookmark from outside

```bash
bash tools/bookmark.sh check              # every bookmark
bash tools/bookmark.sh check <url>        # just one
```

This runs the normal tunnel-gated path, so the result carries the exit IP it
came from — and refuses to report anything if egress can't be confirmed. Read
the exit code the usual way: `0` reachable, `1` checked and down, **`2` no
answer obtained** (never "the site is down").

## Rules that matter

**Only `http` and `https` are accepted.** The status page assigns each entry
straight to a link's `href`, and that page is the one origin holding the exit
IP and the whole bookmark list. A `javascript:` or `data:` entry would execute
there. The tool refuses anything else — don't work around it.

**The list is gitignored, and must stay that way.** It lives at
`scripts/local/domains.json`. This repo is publicly mirrored, and which
domains you own — plus which are currently broken — is an inventory that
should not be published. Never move it to a tracked path, never paste the
list into an issue, and never commit it.

**Changes appear on the status page within ~15 seconds.** The page polls; no
restart needed. If a bookmark doesn't show up, the file is probably not valid
JSON — `tools/bookmark.sh list` will say so, where the status page just shows
an empty state.

**No host Node required.** The tool uses host `node` when present, and
otherwise does the edit in a throwaway `node:22-alpine` container labelled
`lab.ephemeral=true` that removes itself.

## Related

- `vpn-egress-testing` — checking a specific URL, the common case.
- `vpn-egress-setup` — the stack won't start.
- `projects/vpn-egress/docs/USAGE.md` — reading a check result properly.