Add DNS provider flow and demo site split

tests/test_dns.py

@@ -6,7 +6,7 @@ from pathlib import Path
 
 from ampg.cli import main
 from ampg.config import load_config
-from ampg.dns import dns_check
+from ampg.dns import ProviderDNSRecord, dns_check, merge_dns_records
 
 
 def _source(root: Path) -> Path:
@@ -137,6 +137,100 @@ class DNSTest(unittest.TestCase):
         self.assertEqual("matched", results[0].status)
         self.assertEqual(("203.0.113.10",), results[0].resolved)
 
+    def test_dns_records_include_service_and_transport_discovery(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp).resolve()
+            source = _source(root)
+            config_path = root / "gateway.toml"
+            config_path.write_text(
+                f"""
+[[site]]
+id = "example"
+domain = "example.test"
+
+[site.source]
+kind = "static-html"
+path = "{source}"
+
+[site.outputs]
+root = "{root / 'dist'}"
+
+[site.protocols.clearnet]
+enabled = true
+
+[site.protocols.tor]
+enabled = true
+fixture_url = "http://exampleabcdefghijklmnop.onion/"
+
+[site.protocols.i2p]
+enabled = true
+i2p_url = "exampleabcdefghijklmnop.b32.i2p"
+
+[site.protocols.gemini]
+enabled = true
+port = 1966
+
+[site.protocols.reticulum]
+enabled = true
+rns_url = "rns://0123456789abcdef/"
+port = 4242
+""",
+                encoding="utf-8",
+            )
+
+            status, output, error = _run_cli(
+                [
+                    "--config",
+                    str(config_path),
+                    "dns",
+                    "records",
+                    "--ipv4",
+                    "203.0.113.10",
+                    "--mail-policy",
+                    "disabled",
+                ]
+            )
+
+        self.assertEqual(0, status, error)
+        self.assertIn("AMPG_DNS_PROVIDER_RECORD site=example domain=example.test name=@", output)
+        self.assertIn("name=gemini type=A", output)
+        self.assertIn("name=reticulum type=A", output)
+        self.assertIn("name=_gemini._tcp type=SRV", output)
+        self.assertIn('value="0 0 1966 gemini.example.test."', output)
+        self.assertIn("name=_reticulum._tcp type=SRV", output)
+        self.assertIn("name=_tor type=TXT", output)
+        self.assertIn("name=_i2p type=TXT", output)
+        self.assertIn("name=_reticulum type=TXT", output)
+        self.assertIn("name=_dmarc type=TXT", output)
+
+    def test_merge_dns_records_preserves_unmanaged_records(self):
+        existing = (
+            ProviderDNSRecord("@", "A", "198.51.100.9"),
+            ProviderDNSRecord("@", "TXT", "google-site-verification=keep"),
+            ProviderDNSRecord("@", "TXT", "v=spf1 include:old.example -all"),
+            ProviderDNSRecord("@", "MX", "mail.example.test.", mx_pref=10),
+            ProviderDNSRecord("www", "CNAME", "parking.example.test."),
+            ProviderDNSRecord("notes", "TXT", "keep me"),
+        )
+        desired = (
+            ProviderDNSRecord("@", "A", "203.0.113.10"),
+            ProviderDNSRecord("www", "A", "203.0.113.10"),
+            ProviderDNSRecord("@", "TXT", "v=spf1 -all"),
+            ProviderDNSRecord("_dmarc", "TXT", "v=DMARC1; p=reject"),
+        )
+
+        merged = merge_dns_records(existing, desired, mail_policy="disabled")
+        identities = {(record.name, record.type, record.value) for record in merged}
+
+        self.assertIn(("@", "A", "203.0.113.10"), identities)
+        self.assertIn(("www", "A", "203.0.113.10"), identities)
+        self.assertIn(("@", "TXT", "google-site-verification=keep"), identities)
+        self.assertIn(("notes", "TXT", "keep me"), identities)
+        self.assertNotIn(("@", "A", "198.51.100.9"), identities)
+        self.assertNotIn(("@", "TXT", "v=spf1 include:old.example -all"), identities)
+        self.assertNotIn(("@", "MX", "mail.example.test."), identities)
+        self.assertNotIn(("www", "CNAME", "parking.example.test."), identities)
+
 
 if __name__ == "__main__":
     unittest.main()