This repository has no description
dns: fix glue, enable dnssec
author
lassulus
date
(Oct 22, 2023, 7:15 PM CEST)
commit
80756f9b
80756f9bf8f80e8f1e6a521cbda148cc3f92eb4d
parent
4976c28c
4976c28cb505c6fd9bc8603a1d789529d15b0e5f
+11
-5
+7
-4
2configs/dns/knot.nix
+7
-4
2configs/dns/knot.nix
···
117
117
}];
118
118
119
119
policy = [{
120
-
id = "default";
120
+
id = "rsa2k";
121
121
algorithm = "RSASHA256";
122
122
ksk-size = 4096;
123
123
zsk-size = 2048;
124
+
nsec3 = true;
124
125
}];
125
126
126
-
127
-
template = [
128
-
];
129
127
zone = [
130
128
{
131
129
domain = "lassul.us";
132
130
file = "${./lassul.us.zone}";
133
131
notify = [ "hetzner_ip4_1" "hetzner_ip4_2" "hetzner_ip4_3" "hetzner_ip6_1" "hetzner_ip6_2" "hetzner_ip6_3" ];
134
132
acl = [ "hetzner_ip4_1" "hetzner_ip4_2" "hetzner_ip4_3" "hetzner_ip6_1" "hetzner_ip6_2" "hetzner_ip6_3" ];
133
+
dnssec-signing = true;
134
+
dnssec-policy = "rsa2k";
135
135
}
136
136
];
137
137
};
138
138
};
139
+
140
+
# disable to enable auto key generation
141
+
systemd.services.knot.serviceConfig.SystemCallFilter = lib.mkForce [];
139
142
140
143
networking.firewall.allowedTCPPorts = [ 53 ];
141
144
networking.firewall.allowedUDPPorts = [ 53 ];
+4
-1
2configs/dns/lassul.us.zone
+4
-1
2configs/dns/lassul.us.zone
···
24
24
neoprism IN AAAA 2a01:4f9:4a:4f1a::2
25
25
6.neoprism IN AAAA 2a01:4f9:4a:4f1a::2
26
26
27
+
;; GLUE
28
+
ns1 IN A 95.217.192.59
29
+
ns1 IN AAAA 2a01:4f9:4a:4f1a::2
30
+
27
31
* IN CNAME www
28
32
29
-
ns1 IN CNAME neoprism
30
33
www IN CNAME prism
31
34
cache IN CNAME prism
32
35
cgit IN CNAME prism