Improve Dynu env handling and document secrets/dynu.env

scripts/dynu/build_dns_inventory.sh

@@ -4,10 +4,23 @@ set -euo pipefail
 # This integration is intentionally read-only.
 # No Dynu mutations are permitted in this repo at this stage.
 
+# Optional convenience: auto-load local Dynu env file when variables are unset.
+if [[ -f "secrets/dynu.env" ]]; then
+  set -a
+  # shellcheck source=/dev/null
+  source "secrets/dynu.env"
+  set +a
+fi
+
 if [[ "${DYNU_READ_ONLY:-}" != "true" ]]; then
   echo "Refusing to run: DYNU_READ_ONLY must be exactly 'true'." >&2
   exit 2
 fi
 
+if [[ -z "${DYNU_API_KEY:-}" ]]; then
+  echo "Missing DYNU_API_KEY. Set it in env or secrets/dynu.env." >&2
+  exit 2
+fi
+
 python3 scripts/dynu/fetch_dynu_dns.py
 python3 scripts/dynu/correlate_dynu_with_traefik.py

scripts/dynu/fetch_dynu_dns.py

@@ -54,7 +54,13 @@ def get_json(base_url: str, api_key: str, path: str, query: Optional[Dict[str, A
             body = resp.read().decode("utf-8")
     except HTTPError as exc:
         detail = exc.read().decode("utf-8", errors="replace")
-        raise RuntimeError(f"Dynu API GET failed at {path}: HTTP {exc.code} {detail}") from exc
+        hint = ""
+        if exc.code == 401:
+            hint = (
+                " Check DYNU_API_KEY from secrets/dynu.env, verify it is a valid Dynu API key, "
+                "and ensure DYNU_BASE_URL points to the Dynu API endpoint."
+            )
+        raise RuntimeError(f"Dynu API GET failed at {path}: HTTP {exc.code} {detail}.{hint}") from exc
     except URLError as exc:
         raise RuntimeError(f"Dynu API GET failed at {path}: {exc}") from exc
 
@@ -177,8 +183,12 @@ def main() -> int:
     if not api_key:
         print("Missing DYNU_API_KEY. Refusing to call Dynu API.", file=sys.stderr)
         return 2
+    api_key = api_key.strip().strip("'").strip('"')
+    if not api_key:
+        print("DYNU_API_KEY is empty after trimming quotes/whitespace.", file=sys.stderr)
+        return 2
 
-    base_url = os.environ.get("DYNU_BASE_URL", DEFAULT_BASE_URL)
+    base_url = os.environ.get("DYNU_BASE_URL", DEFAULT_BASE_URL).strip().strip("'").strip('"')
 
     domains = list_domains(base_url, api_key)
     target = [d for d in domains if str(d.get("name", "")).strip(".").lower() == BASE_DOMAIN]