forked from
lass.pds.lassul.us/superconfig
This repository has no description
configs.dns: _acme-challenge zone for *.pds.lassul.us
Same delegation and TSIG key as for *.review.lassul.us, so lego can get
the wildcard cert for PDS handles via DNS-01.
author
Hermes
date
(Oct 20, 2026, 10:55 AM CEST)
commit
e1f89a4a
e1f89a4a472a206e54f73cb3f3becd6e9d5b2ffa
parent
2ec76648
2ec7664890deaaf42e3f0e2e92e615e60e94513a
+20
-14
+16
-14
configs/dns/knot.nix
+16
-14
configs/dns/knot.nix
···
8
8
ip4 = "95.217.192.59";
9
9
ip6 = "2a01:4f9:4a:4f1a::2";
10
10
# Delegated from lassul.us (NS ns1 only, the Hetzner secondaries never see
11
-
# it) so lego can do DNS-01 for *.review.lassul.us (configs/crit-proxy.nix)
12
-
# with RFC2136 updates, without touching the signed main zone.
13
-
acmeReviewZone = pkgs.writeText "_acme-challenge.review.lassul.us.zone" ''
14
-
@ 3600 IN SOA ns1.lassul.us. acme.lassul.us. 1 7200 3600 86400 60
15
-
@ 3600 IN NS ns1.lassul.us.
16
-
'';
11
+
# them) so lego can do DNS-01 for *.review.lassul.us (configs/crit-proxy.nix)
12
+
# and *.pds.lassul.us (configs/services/git/pds.nix) with RFC2136 updates,
13
+
# without touching the signed main zone.
14
+
acmeZone = domain: {
15
+
inherit domain;
16
+
file = "${pkgs.writeText "${domain}.zone" ''
17
+
@ 3600 IN SOA ns1.lassul.us. acme.lassul.us. 1 7200 3600 86400 60
18
+
@ 3600 IN NS ns1.lassul.us.
19
+
''}";
20
+
acl = [ "acme_review" ];
21
+
zonefile-sync = "-1";
22
+
zonefile-load = "difference-no-serial";
23
+
journal-content = "all";
24
+
};
17
25
# dyndns = domain:
18
26
# pkgs.writeText "${domain}.zone" ''
19
27
# @ 3600 IN SOA ${domain}. ns1.lassul.us. 2023101213 7200 3600 86400 3600
···
205
213
serial-policy = "dateserial";
206
214
journal-content = "all";
207
215
}
208
-
{
209
-
domain = "_acme-challenge.review.lassul.us";
210
-
file = "${acmeReviewZone}";
211
-
acl = [ "acme_review" ];
212
-
zonefile-sync = "-1";
213
-
zonefile-load = "difference-no-serial";
214
-
journal-content = "all";
215
-
}
216
+
(acmeZone "_acme-challenge.review.lassul.us")
217
+
(acmeZone "_acme-challenge.pds.lassul.us")
216
218
];
217
219
};
218
220
};
+4
configs/dns/lassul.us.zone
+4
configs/dns/lassul.us.zone
···
67
67
*.review IN CNAME neoprism
68
68
;; DNS-01 for the *.review wildcard cert, dynamic zone in knot.nix
69
69
_acme-challenge.review IN NS ns1
70
+
pds IN CNAME neoprism
71
+
*.pds IN CNAME neoprism
72
+
;; DNS-01 for the *.pds wildcard cert (PDS handles), dynamic zone in knot.nix
73
+
_acme-challenge.pds IN NS ns1
70
74
when IN CNAME neoprism
71
75
paperless IN CNAME neoprism
72
76