# Namecheap Operating Runbook
**Cold Bore Ballistics LLC — Confidential**
Last updated: 2026-06-07

> Day-to-day procedures for managing CBB domains via Namecheap. Namecheap is the **registrar only** — DNS records are managed in Azure DNS via Terraform (`cbb-infra/services/dns`). For account details and domain inventory see `Namecheap_Architecture_Reference.md`. For full from-scratch rebuild see `Namecheap_Rebuild_Guide.md`. For DNS record changes see `Azure/Azure_Operating_Runbook.md`.

---

## Prerequisites

### Credentials

Retrieve the API key from Key Vault before running any script:

```bash
export NAMECHEAP_API_USER=coldboreballistics
export NAMECHEAP_API_KEY=$(az keyvault secret show \
  --vault-name kv-cbb-shared-prod \
  --name namecheap-api-key \
  --query value -o tsv)
```

If the Azure CLI is not authenticated, run `az login` first.

The account password (for browser console access) is in the CBB 1Password vault.

### IP Whitelist

The Namecheap API only accepts calls from whitelisted IP addresses. Before running any script from a new machine or after your IP changes:

1. Open a browser and go to `https://www.namecheap.com`
2. Log in with the `coldboreballistics` account
3. Click your username (top right) → **Profile**
4. Click **Tools** in the left sidebar
5. Scroll to **API Access** → **Whitelisted IPs**
6. Click **Edit** and add your current public IP
7. Click **OK** to save

To find your current public IP:
```bash
curl -s https://ifconfig.me
```

Failure to whitelist results in an API error: `Parameter RequestIP is not allowed to access Namecheap's API.`

### Script location

`cbb-utils/namecheap/namecheap_dns.sh` is used for account-level operations only (NS cutover, domain listing, IP whitelist). **Do not use it to manage DNS records** — all records are Terraform-managed in Azure DNS.

---

## Procedure: List all domains in the account

```bash
bash cbb-utils/namecheap/namecheap_dns.sh list
```

Expected output: `coldboreballisticsllc.com`, `scope-dope.com`, `ballisticcomputer.com`, `ballisticscomputer.com` (and any others registered).

---

## Procedure: Cut NS delegation to Azure DNS (new domain or re-delegation)

Use when adding a new domain to Azure DNS or if NS records are ever reset at Namecheap. Get the nameservers from Terraform output:

```bash
cd cbb-infra/services/dns
terraform output
```

Then set them at Namecheap via the API:

```bash
export NAMECHEAP_API_USER=coldboreballistics
export NAMECHEAP_API_KEY=$(az keyvault secret show \
  --vault-name kv-cbb-shared-prod \
  --name namecheap-api-key \
  --query value -o tsv)

# Example for coldboreballisticsllc.com — use the actual NS values from terraform output
curl -s "https://api.namecheap.com/xml.response?ApiUser=${NAMECHEAP_API_USER}&ApiKey=${NAMECHEAP_API_KEY}&UserName=${NAMECHEAP_API_USER}&ClientIp=$(curl -s https://api.ipify.org)&Command=namecheap.domains.dns.setCustom&SLD=coldboreballisticsllc&TLD=com&Nameservers=ns1-XX.azure-dns.com,ns2-XX.azure-dns.net,ns3-XX.azure-dns.org,ns4-XX.azure-dns.info"
```

Verify propagation:
```bash
dig NS coldboreballisticsllc.com +short
```

---

## Procedure: Add or update a DNS record

All DNS records are managed via Terraform. Edit `cbb-infra/services/dns/main.tf`, then:

```bash
cd cbb-infra/services/dns
terraform plan    # review changes
terraform apply
```

See `Azure/Azure_Operating_Runbook.md` for the full DNS record change procedure.

---

## Procedure: Check domain availability

```bash
bash cbb-utils/namecheap/namecheap_dns.sh check <domain> [<domain2> ...]
```

---

## Procedure: Update the IP whitelist

Perform this any time you are working from a new machine or your ISP has changed your public IP.

1. Find your current IP: `curl -s https://ifconfig.me`
2. Log in to `https://www.namecheap.com` as `coldboreballistics`
3. Username (top right) → **Profile** → **Tools** → **API Access**
4. Click **Edit** next to Whitelisted IPs
5. Add the new IP; remove any stale entries that are no longer in use
6. Click **OK**

---

## Procedure: Rotate the API key

Use when the API key is suspected compromised, or on the annual rotation schedule.

1. Log in to `https://www.namecheap.com` as `coldboreballistics`
2. Username (top right) → **Profile** → **Tools** → **API Access**
3. Click **Reset API Key** — this immediately invalidates the current key
4. Copy the new key value shown on screen
5. Update Key Vault:
   ```bash
   az keyvault secret set \
     --vault-name kv-cbb-shared-prod \
     --name namecheap-api-key \
     --value "<new-key-value>"
   ```
6. Update `Namecheap_Architecture_Reference.md` — note the rotation date in the Credentials table

---

## Procedure: Renew a domain manually

Auto-renew is enabled on all CBB domains. If a domain lapses or auto-renew fails:

1. Log in to `https://www.namecheap.com` as `coldboreballistics`
2. Click **Domain List** in the left sidebar
3. Find the domain and click **Renew** next to it
4. Select renewal period (1 year minimum) and complete payment
5. Confirm the domain's expiry date updates in the Domain List view

> **Note:** After manual renewal, verify that auto-renew is still enabled on the domain — go to **Manage** → **Auto-Renew** toggle.

---

## Procedure: Verify DNS propagation

After any record change via Terraform, confirm propagation by querying the Azure DNS authoritative servers directly:

```bash
# Get the authoritative NS for a zone
dig NS coldboreballisticsllc.com +short   # e.g. ns1-08.azure-dns.com

# Query authoritative server directly (bypasses resolver cache)
dig MX coldboreballisticsllc.com +short @ns1-08.azure-dns.com
dig TXT coldboreballisticsllc.com +short @ns1-08.azure-dns.com
dig CNAME autodiscover.coldboreballisticsllc.com +short @ns1-08.azure-dns.com
dig A infra.coldboreballisticsllc.com +short @ns1-08.azure-dns.com
```

Azure DNS propagates new records globally within seconds of apply. TTL values on individual records govern how long resolver caches hold old values.

---

## Document Control

| Field | Value |
|---|---|
| **Document owner** | `jschwefel@coldboreballisticsllc.com` |
| **Classification** | Confidential (03_-_Confidential/) |
| **Location** | `OneDrive/CBB_Corporate/03_-_Confidential/Infrastructure/Namecheap/Namecheap_Operating_Runbook.md` |
| **Cross-references** | `Namecheap_Architecture_Reference.md`; `Namecheap_Rebuild_Guide.md` |
| **Created** | 2026-06-07 |
| **Last updated** | 2026-06-07 |
| **Next full review due** | 2027-06-07 |

---

## Revision Control Block

| Rev | Date | Changed By | Reviewed By | Approved By | Summary |
|-----|------|------------|-------------|-------------|---------|
| 0.9 | 2026-06-07 | jschwefel | — | — | Initial release |
