Fleetworks · DNS
DNS, opt-in by default.
Chorus keeps every DNS record and domain your organization owns in one place, with unix-style permissions on each record. Records are private by default; publishing one is a deliberate, guarded action.
What an organization holds
Everything belongs to exactly one organization. Roles decide what a member may do there; each record’s mode can only narrow that, never widen it.
- 01
Domain
A DNS name the organization registers so records can be created under it. A domain cannot be deleted while records reference it.
- 02
DNS record
One entry under a domain: a record name, a record type (A, CNAME, TXT or SRV), content, a TTL and a routing policy.
- 03
Mode
A 9-bit, chmod-style value on each record and domain: view, edit and delete bits for the record owner, the organization and everyone else.
- 04
Member
A user who holds a role in the organization: org:admin, org:contributor or org:viewer. Admins and contributors may change records.
- 05
Service account
A non-human principal in one organization. It signs in with a PAT, and the PAT carries exactly that account’s role.
- 06
Webhook
An HTTPS endpoint the organization registers to receive events, such as dns.record.created or dns.record.published, signed with HMAC-SHA256.
Read a mode like a file
The default is 0o770: the record owner and the organization can view, edit and delete; everyone else gets nothing. Publishing sets the other-view bit, and published records stay read-only to everyone else.
0o770| class | view | edit | delete |
|---|---|---|---|
| owner | yes | yes | yes |
| group | yes | yes | yes |
| other | – | – | – |
The record owner and the organization’s members can view, edit and delete. Nobody else sees it.
0o774| class | view | edit | delete |
|---|---|---|---|
| owner | yes | yes | yes |
| group | yes | yes | yes |
| other | yes | – | – |
The other-view bit is set, so the record appears in the public directory. Other-edit and other-delete are refused: published is always read-only.
What Chorus does
- 01
Records and domains
A, CNAME, TXT and SRV records under the domains an organization registers, managed in the dashboard or through the API.
- 02
chmod-style permissions
A 9-bit mode on every record and domain: view, edit and delete for the record owner, the organization and everyone else.
- 03
Public directory
An anonymous, searchable listing of published records and domains, through a strict field allowlist.
- 04
Record linter
Deterministic rules that catch common record mistakes, shown on request in the API and in the dashboard’s Health column.
- 05
Signed webhooks
Record, domain and report changes become events, delivered to the HTTPS endpoints an organization registers, signed with HMAC-SHA256.
- 06
Roles and members
Each user holds a role in an organization: org:admin, org:contributor or org:viewer. Admins grant and revoke them.
Published records are one request away
The public directory needs no credentials and returns published records only, through a strict field allowlist. Everything else needs a signed-in member or a service account. The API describes itself at /openapi.json.
# published records, no credentials
curl "https://chorus-api.fleetworks.dev/public/search?q=api"
# signed in, with lint findings
curl -H "Authorization: Bearer $TOKEN" \
"https://chorus-api.fleetworks.dev/list?domain=example.com&lint=1"From a domain to a published record
- Step 1
Register a domain
An org:admin creates a domain for the organization. Records can only be created under a domain the organization has registered.
- Step 2
Create records
A member with a writer role, or a service account with a PAT, creates a record: a name host under that domain, a record type, content, a TTL and a routing policy.
- Step 3
Check them
Ask for lint findings with GET /list?lint=1, or read the Health column in the dashboard. Each finding names its rule and a severity of error or warning.
- Step 4
Publish what should be public
The record owner or an org:admin chmods a record to set its other-view bit. Only then does it appear in the public directory, read-only.
Keep your organization’s DNS records in one place
Sign in with your Fleetworks account, or search the public directory first, which needs no account.