AnyIP
=====
DNS server that resolves IP addresses embedded in hostnames.
Domain: tap.dev

-- DNS Resolution ------------------------------------------------------

  Format:
    IPv4:     {prefix}-{a}-{b}-{c}-{d}.tap.dev  ->  a.b.c.d
    IPv6:     dashes replace colons, double-dash for "::" compression
    Example:  2001-db8--1.tap.dev               ->  2001:db8::1
    Nested:   {any}.{ip-label}.tap.dev          ->  same IP

  Examples:
    dig 127-0-0-1.tap.dev +short          ->  127.0.0.1
    dig myapp-192-168-1-5.tap.dev +short  ->  192.168.1.5
    dig user1.127-0-0-1.tap.dev +short    ->  127.0.0.1

  NOTE: This instance only resolves private/reserved IPs.
  Allowed ranges:
    - 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16  (RFC 1918)
    - 127.0.0.0/8                                (loopback)
    - 100.64.0.0/10                              (CGNAT/Tailscale)
    - 169.254.0.0/16                             (link-local)
    - fc00::/7, fe80::/10, ::1/128               (IPv6 private)
  Public IPs will return empty (NODATA) responses.

-- Wildcard Certificate (*.tap.dev) ------------------------------------

  Auto-provisioned via Let's Encrypt.

  Endpoints:
    GET  /cert/fullchain.pem   PEM certificate chain
    GET  /cert/privkey.pem     PEM private key
    GET  /cert/info            JSON metadata (issuer, expiry, SANs)

  Example:
    $ curl https://tap.dev/cert/fullchain.pem -o fullchain.pem
    $ curl https://tap.dev/cert/privkey.pem -o privkey.pem

-- Subdomain Certificates (*.{ip}.tap.dev) -----------------------------

  On-demand wildcard certs for per-IP subdomains.
  Allowed labels: 127-0-0-1

  Endpoints (replace {label} with an allowed IP label):
    POST /cert/sub/{label}                Issue new certificate (JSON)
    GET  /cert/sub/{label}/fullchain.pem  PEM certificate chain
    GET  /cert/sub/{label}/privkey.pem    PEM private key
    GET  /cert/sub/{label}/info           JSON metadata

  Example:
    $ curl -X POST https://tap.dev/cert/sub/127-0-0-1
    $ curl https://tap.dev/cert/sub/127-0-0-1/fullchain.pem -o fullchain.pem

-- DNS over HTTPS (RFC 8484) -------------------------------------------

  Endpoint: /dns-query

    GET  /dns-query?name={hostname}&type={A|AAAA|CNAME}
         Response: application/dns-json

    POST /dns-query
         Content-Type: application/dns-message
         Response:     application/dns-message

  Example:
    $ curl "https://tap.dev/dns-query?name=127-0-0-1.tap.dev&type=A"

------------------------------------------------------------------------
Source: https://github.com/taptap/anyip