surtr: dns/tls: rfc2136

author: Gregor Kleen <gkleen@yggdrasil.li> 2022-02-22 15:48:59 +0100
committer: Gregor Kleen <gkleen@yggdrasil.li> 2022-02-22 15:48:59 +0100
commit: a7255ba16633d70c22e8bed75ae52c49f08e1c18 (patch)
tree: 71f1cdc442efef13fe239e8694b4fe9bcc58b923
parent: ef600c518e5fdb4962fdd4d4851413a024fa52f7 (diff)
download: nixos-a7255ba16633d70c22e8bed75ae52c49f08e1c18.tar
nixos-a7255ba16633d70c22e8bed75ae52c49f08e1c18.tar.gz
nixos-a7255ba16633d70c22e8bed75ae52c49f08e1c18.tar.bz2
nixos-a7255ba16633d70c22e8bed75ae52c49f08e1c18.tar.xz
nixos-a7255ba16633d70c22e8bed75ae52c49f08e1c18.zip
29 files changed, 468 insertions, 130 deletions
diff --git a/hosts/surtr/dns/Gupfile b/hosts/surtr/dns/Gupfile
new file mode 100644
index 00000000..ac96f620
--- /dev/null
+++ b/hosts/surtr/dns/Gupfile
@@ -0,0 +1,2 @@
+key.gup:
+  keys/*.yaml
+\ No newline at end of file
diff --git a/hosts/surtr/dns/default.nix b/hosts/surtr/dns/default.nix
index 5d55c815..57146d67 100644
--- a/hosts/surtr/dns/default.nix
+++ b/hosts/surtr/dns/default.nix
@@ -3,15 +3,38 @@
 with lib;
 let
-  acmeChallengeZonefile = domain: let
+  reverseDomain = domain: concatStringsSep "." (reverseList (splitString "." domain));
-    reverseDomain = concatStringsSep "." (reverseList (["_acme-challenge"] ++ splitString "." domain));
-  in pkgs.writeText "${reverseDomain}.zone" ''
+  acmeChallengeZonefile = domain: pkgs.writeText "${reverseDomain "_acme-challenge.${domain}"}.soa" ''
    $ORIGIN _acme-challenge.${domain}.
    $TTL 3600
    @ IN SOA ns.yggdrasil.li. root.yggdrasil.li. 2022022103 10800 3600 604800 30
      IN NS  ns.yggdrasil.li.
  '';
+  knotKeys = let
+    dir = ./keys;
+    toKeyInfo = name: v:
+      if v == "regular" || v == "symlink"
+      then { path = dir + "/${name}"; inherit name; }
+      else null;
+  in filter (v: v != null) (mapAttrsToList toKeyInfo (builtins.readDir dir));
+  indentString = indentation: str: concatMapStringsSep "\n" (str: "  ${str}") (splitString "\n" (removeSuffix "\n" str));
+  mkZone = {domain, path ? (./zones + "/${reverseDomain domain}.soa"), acmeDomains ? [domain]}: indentString "  " ''
+    - domain: ${domain}
+      template: inwx_zone
+      ${optionalString (acmeDomains != []) "acl: [local_acl, inwx_acl]"}
+      file: ${path}
+    ${concatMapStringsSep "\n" (acmeDomain: ''
+      - domain: _acme-challenge.${acmeDomain}
+        template: acme_zone
+        acl: [${assert (config.sops.secrets ? "${acmeDomain}_acme.yaml"); "${acmeDomain}_acme_acl"}]
+        file: ${acmeChallengeZonefile acmeDomain}
+    '') acmeDomains}
+  '';
 in {
  config = {
    fileSystems."/var/lib/knot" =
@@ -23,11 +46,7 @@ in {
    
    services.knot = {
      enable = true;
-      keyFiles = [
+      keyFiles = map ({name, ...}: config.sops.secrets.${name}.path) knotKeys;
-        config.sops.secrets."rheperire.org_acme_key.yaml".path
-        config.sops.secrets."webdav.141.li_acme_key.yaml".path
-        config.sops.secrets."knot_local_key.yaml".path
-      ];
      extraConfig = ''
        server:
          listen: 127.0.0.1@53
@@ -48,16 +67,23 @@ in {
          - id: inwx_acl
            address: 185.181.104.96
            action: transfer
-          - id: rheperire.org_acme_acl
-            key: rheperire.org_acme_key
-            action: update
-          - id: webdav.141.li_acme_acl
-            key: webdav.141.li_acme_key
-            action: update
          - id: local_acl
            key: local_key
            action: update
            update-type: DS
+        ${let
+          toACMEACL = { name, ... }:
+            if hasSuffix "_acme.yaml" name
+            then
+              let
+                base = removeSuffix ".yaml" name;
+              in indentString "  " ''
+                - id: ${base}_acl
+                  key: ${base}_key
+                  action: update
+              ''
+            else null;
+        in concatStringsSep "\n" (filter (v: v != null) (map toACMEACL knotKeys))}
        mod-rrl:
          - id: default
@@ -124,68 +150,33 @@ in {
            dnssec-policy: ed25519_local-push
        zone:
-          - domain: yggdrasil.li
+        ${concatMapStringsSep "\n" mkZone [
-            template: inwx_zone
+          { domain = "yggdrasil.li";
-            file: ${./zones/li.yggdrasil.soa}
+          }
+          { domain = "nights.email";
-          - domain: nights.email
+          }
-            template: inwx_zone
+          { domain = "141.li";
-            file: ${./zones/email.nights.soa}
+            acmeDomains = ["webdav.141.li" "141.li"];
+          }
-          - domain: 141.li
+          { domain = "kleen.li";
-            template: inwx_zone
+          }
-            acl: [local_acl, inwx_acl]
+          { domain = "xmpp.li";
-            file: ${./zones/li.141.soa}
+          }
-          - domain: _acme-challenge.webdav.141.li
+          { domain = "dirty-haskell.org";
-            template: acme_zone
+          }
-            acl: [webdav.141.li_acme_acl]
+          { domain = "praseodym.org";
-            file: ${acmeChallengeZonefile "webdav.141.li"}
+          }
+          { domain = "rheperire.org";
-          - domain: kleen.li
+          }
-            template: inwx_zone
+        ]}
-            file: ${./zones/li.kleen.soa}
-          - domain: xmpp.li
-            template: inwx_zone
-            file: ${./zones/li.xmpp.soa}
-          - domain: dirty-haskell.org
-            template: inwx_zone
-            file: ${./zones/org.dirty-haskell.soa}
-          - domain: praseodym.org
-            template: inwx_zone
-            file: ${./zones/org.praseodym.soa}
-          - domain: rheperire.org
-            template: inwx_zone
-            acl: [local_acl, inwx_acl]
-            file: ${./zones/org.rheperire.soa}
-          - domain: _acme-challenge.rheperire.org
-            template: acme_zone
-            acl: [rheperire.org_acme_acl]
-            file: ${acmeChallengeZonefile "rheperire.org"}
      '';
    };
-    sops.secrets = {
+    sops.secrets = listToAttrs (map ({name, path}: nameValuePair name {
-      "rheperire.org_acme_key.yaml" = {
+      format = "binary";
-        format = "binary";
+      owner = "knot";
-        owner = "knot";
+      sopsFile = path;
-        sopsFile = ./keys/rheperire.org_acme.yaml;
+    }) knotKeys);
-      };
-      "webdav.141.li_acme_key.yaml" = {
-        format = "binary";
-        owner = "knot";
-        sopsFile = ./keys/webdav.141.li_acme.yaml;
-      };
-      "knot_local_key.yaml" = {
-        format = "binary";
-        owner = "knot";
-        sopsFile = ./keys/local_key.yaml;
-      };
-    };
    fileSystems."/var/lib/unbound" =
      { device = "surtr/local/var-lib-unbound";
diff --git a/hosts/surtr/dns/key.gup b/hosts/surtr/dns/key.gup
new file mode 100644
index 00000000..32d4f7d6
--- /dev/null
+++ b/hosts/surtr/dns/key.gup
@@ -0,0 +1,6 @@
+#!/usr/bin/env zsh
+keyName=${${2:t}%.yaml}_key
+keymgr -t ${keyName} > $1
+sops -p '7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8,30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51' --input-type=binary --output-type=binary -e -i $1
+\ No newline at end of file
diff --git a/hosts/surtr/dns/keys/141.li_acme.yaml b/hosts/surtr/dns/keys/141.li_acme.yaml
new file mode 100644
index 00000000..77fbc4b2
--- /dev/null
+++ b/hosts/surtr/dns/keys/141.li_acme.yaml
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:2y3A/KCH2X8T/g9gVhNQuAHvorebyKnfAZc+kJE5hL06l7xieJsxpj7DBbWjh5y7Ae2fBNMFA1tU9Ig6S3qvjzxlCNQWSpq05GBTiU2AdUDWwn52gztEvNLEpFsdUDyUYZSPLy82dFckyegWuoBQbGe6vOPdXyM4aPCIuj3fp18A6cNSRp4YyERL/JoveLRQYFJUpV5Xr9JyNHj/4hDfikJJMG1OeKqCyeK5BTs6XbLN+70UO7R+orlh2F0=,iv:04N7t7lf0CG6Qbj3VqHmL9l+hl4PK6vahEHq8qJmjOs=,tag:x4H/oiDjvE/NzMKSeMO2NQ==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": null,
+                "lastmodified": "2022-02-22T14:12:08Z",
+                "mac": "ENC[AES256_GCM,data:At6rzhjC4EbtTjMaw44WKYNuT2XRniZpDAXGskxi9HW/xIQFghcWlgzXaddev5BUMkitz93gFCFD02YJOzOC12GXjDksoHGtvHKbxmodIgHTbhkXFYLe1JoFPrF14NsiIOmmoqcbrn03+iinNehkbJ2wXEkGyev4IMacQGqV7q0=,iv:7j26jeRvgBrnJRVHYay+3wug+IjOIpjFWLiccXD6Z8A=,tag:esnZH7MLQnqkxNVPdwmx8Q==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2022-02-22T14:12:08Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAvU6MNSb8ky78bJfnRRx14o4rA7Ezylbtc6cFUG+eGAow\nPvRGLI3qm36sDYXo6OHKS9A5DTxIQlQHQqj9U4CHGU/w4X8pCN2ulHkAh767DXV9\n0l4BHa/JTXNklF78vY3zUkySrIueA0QZXvmda2pcd3mO3M78J7812X9jCZ8LwrXz\nR3Wp77iQXW/0Tq83DMEkFwYmueFfZsCtRxQBL5f4NlyuLZizDb2s8YZzeRICz5w3\n=X6zh\n-----END PGP MESSAGE-----\n",
+                                "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8"
+                        },
+                        {
+                                "created_at": "2022-02-22T14:12:08Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAIbKybblH4bBEhKyup4r+KzKdHLZhBmR79o5A2DdD1mAw\n4KVInlvs+LAFksp1oCqSLd3r1foM3/QOrDdB1ExwTXrxlTgk/qM9eTXT4gIdXwt3\n0l4B5rqrDzCwp3DE2dC+UuBFB9g9YtF77xpfOFfcGLB3fKsPYEvrK6MwGMJqUtoI\nq19d8Cf/mir0mlYHBN+Vez/8jFi0HmrLlphhf4m0l0/6XNLdRbuSpb5T20ecJM2L\n=nRup\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.1"
+        }
+}
+\ No newline at end of file
diff --git a/hosts/surtr/dns/keys/dirty-haskell.org_acme.yaml b/hosts/surtr/dns/keys/dirty-haskell.org_acme.yaml
new file mode 100644
index 00000000..0037910f
--- /dev/null
+++ b/hosts/surtr/dns/keys/dirty-haskell.org_acme.yaml
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:Jxsg5dW3bhJKRHvigf9F5xkp+KdOd8OKibc1rKrqzwUPZcdebpzijFQMA5hRHwTJKdoqmk/aWosmqfBgmrUr9lrDQH2g1IzLoLYxLc8ssUuH9T4lLDMkSRa3PjL0jpW5ezDSb2omhE4EAJvRZF2nn1VC/IhKNCpY4oI/bLCt6unPiVYMi1ot+9JAl+9eRJS5UIYWp1DC/0oi8Uv6Ci3VwLmOFg1I/YcvXDkNdi0QpcGH3Ok241/O0HiOSboOfqCIwTy5v4P+Poko3dl9t3SkZK65,iv:HC+PzqqLgLWGijHYDC6MvIaB8T/sI1c6vTCf10DApFg=,tag:75fmY73TKw6bNz/xJp8q0A==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": null,
+                "lastmodified": "2022-02-22T14:20:35Z",
+                "mac": "ENC[AES256_GCM,data:pbKzZIor1lRxI20O4yi+h2Vk6yOL1MtTstx5A4Byul06uZiGMrNMFyBaVvGbb8evch9ptYm4TNiWZ3T8xHYTwy4HGV5HgOOqY2vJNwTSJ6Yi0F34UCQMIPnXHT/sqL+T1/etV5zY1eQhH6L7lXPtIh7TiYhV8o5y7tpSwhq2RUY=,iv:ZYhhncJv4AOkKDon/DIAYJUgDN4C/iVyukMDaqzu3k8=,tag:v2U/hTaRxk47UG+E6D4ExQ==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2022-02-22T14:20:35Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdA/I9pk6iikcFckUsUigf3MJSL1JN6HHUIG/PKeOoEMx4w\n6MoYrjveZeXJbQLJHEVwkanElOfmb7jNFfDQntu6VIEwxvb2vdFDY43JgX6SAuLf\n0l4BvsQcSIPm/3jZu14kLjZgK/S6wrQKbUmymLVQSADwYP2sq+u710bYnRk/QxGG\nRwo82yKyBAZ+EK4DWxB6VtAry8LBYlKY8uhJ17f1/95tc+GeuHEEqzcllz+le67l\n=AxIv\n-----END PGP MESSAGE-----\n",
+                                "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8"
+                        },
+                        {
+                                "created_at": "2022-02-22T14:20:35Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdACQne60rRG40kMku2GFVQhsrpa3RLAgjJGt2oPKrkgQ0w\nVWHpGyfpg0urSkS7+qecfhqeKAkaQ6CF2F6w2fCgn6Xdw28vs4pro1lHWhwYD+XT\n0l4BtxoVpKHysoL4qO9dQLjwAjHAcYnMPaNONIQMvU8DNrJ9ZiHkzJZPNQOeYL97\nEJCWUkR7V0OP8syMIKy37ii3l2aJd58w1DUd90BwvBrv5JBbNxIPalhZKULWI96U\n=dovS\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.1"
+        }
+}
+\ No newline at end of file
diff --git a/hosts/surtr/dns/keys/kleen.li_acme.yaml b/hosts/surtr/dns/keys/kleen.li_acme.yaml
new file mode 100644
index 00000000..18122f48
--- /dev/null
+++ b/hosts/surtr/dns/keys/kleen.li_acme.yaml
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:ClN4TVWJoCYh6Rl/Vp+x+jPlIDkkz9SV7qzLBenjPDviIzkBqGmNwySsV5Dy/uxbrmNkc+C4sYkv+5H+3O7R1fWwTDlZuiWpd+lAJrco9f8CjyZku2RQi1UfP31z+/nAKo4wSy22++UfLmYR5NGWWB6pbfm/KL27vC75RNOvPZXhOBxxl5imObdY6i3cJ7A5e9PsbR7qZq+gFBtq7IisSHD1sDvpiOAcstKo8ITsZ5bXCYmrFiJ41LJNSINN+/mE,iv:a/T6pQGuDW3qBzr2y0GrPyeoMRlCI0VvKUZJQFGYTew=,tag:2rL3o/L+xYAsP/vWbWFsOw==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": null,
+                "lastmodified": "2022-02-22T14:43:57Z",
+                "mac": "ENC[AES256_GCM,data:KGOS17/BCjGbzBXOAJav9aAs1d0ymAISoAu14nGCVdxLrhySM+sRgoo7XO3kG5xCfIn7dJGMhC5vIyLoHLl7il0FuSjhFztr1AvSAvmb09CaQksj/KTSXk3N+Tp2++Lvn8xPtNGcYTu/pK+0WLC2jt52KcbsXTVRSMtZO59+ekg=,iv:l2tcVM8c1HkJ5W4rc8ZPffx5fzAKcn7IjgjU3zxSpdE=,tag:KRabrd9nNhqmN/2YtzzPig==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2022-02-22T14:43:57Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAyCmRdezTNHo04OWMJRfeOfkNwA8iN5ORlR4MSnxHvi8w\n5qxpEl+NtPyGunAOm58zc6Ai8+2yuXsCGoTVDar5jL1poNgYMecwCHkMopYBOreC\n0l4BcGGs4AkKTzqEU/tBe4YKqp/6QBZ3N0giPeGWedA248Vnz9Lq9eHynhCkCB1O\n8y0wUf6159s+00MEaMlAHODPKetBTve2xa8W+6OvQqIYSxaaTJ01cI9n1deYSa1e\n=ke67\n-----END PGP MESSAGE-----\n",
+                                "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8"
+                        },
+                        {
+                                "created_at": "2022-02-22T14:43:57Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAPlaZrCGl5FDZ3v+RG62I/FfyPA+qTepdegSTFo6m+lgw\nyEacJxkCO28hMsFgHhLXRveP7tKrWt7WAi91rU8j1LFrTLGV6PogA+jLGbAJeBQI\n0l4B8UDf/vNK7d1cWeScOO7a4HPsJ9jQDxEk3JB1c5funVqbK3h8HUMmbtbBABXF\n9ga0Ra4UC9s3pLUz8ykMQ5C/GCCd446HDHLbi9daXVTTGMnlkXhSgyA7VvCWUjnL\n=mwTD\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.1"
+        }
+}
+\ No newline at end of file
diff --git a/hosts/surtr/dns/keys/local_key.yaml b/hosts/surtr/dns/keys/knot_local.yaml
index a170ff72..a170ff72 100644
--- a/hosts/surtr/dns/keys/local_key.yaml
+++ b/hosts/surtr/dns/keys/knot_local.yaml
diff --git a/hosts/surtr/dns/keys/nights.email_acme.yaml b/hosts/surtr/dns/keys/nights.email_acme.yaml
new file mode 100644
index 00000000..5bf19aa9
--- /dev/null
+++ b/hosts/surtr/dns/keys/nights.email_acme.yaml
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:HAAFVb+g52gyAhYLsuqsVI4rPyl+jRTGm41Pf+AOykWK9cythHSTiUeCJGKQMvmSqjsCFqwswJWaFwz9qbSzGcrcI3CVLpjbi++x9sv5xhV+bSX9ROqpNSOtgHp08irgCST+rFXtwj7VX3SYZnV8NyEPzyk8ztPBZpn0VHIt7tS+t/oT7GHqhe0c4Ct8FXVzEkfBC28CQdJaJw4m1ZSE00Lm/sFj0On2y2BZfMhq4a3SnE1ktZNVHyBbCdVrMs83Zjq09DBSLDo=,iv:iRR3JPrl0sGij4WUNRaFna9ijKfeIPZusAiCYuS/faw=,tag:+txhhwlBbzncdUhRd0b2Ew==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": null,
+                "lastmodified": "2022-02-22T14:44:08Z",
+                "mac": "ENC[AES256_GCM,data:zsV4ZC/+H0d5EVRsGy7niGAXjhw9iEJ2IIT3ED8OaYd/TNDu/pCyCH5YvSnCGfi8/d4caaCUhUUKMCz8SG46lmvVPqHz516MfS2/lp21py8LhGuHReeAa6/xFrbBDmuECiY7RHv8tm8VnwQHOlZNFUpCIJufeZQUoAcYPXW+L7s=,iv:1wq8YlBhnzV6fofpA1QfX4mDcxJyzQUv+HphyjsvzcA=,tag:CEZIlqv0VfyKkFLxH3VK+A==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2022-02-22T14:44:08Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdA4RV9j0rSlCLozIMcNjo3GokziWshqVqu1WWuPDPpimMw\nZs/OH5ejj7cLMl/BddTZ8AAUrjAskRj3aqwYAt+BBc8dZYFVcuRuZzSGGSkMy6VN\n0l4BCBTyyU21D0uv6EEzqG4yiiOfs5JZmny3B7wMc0qh1vK4qClF4IUPmEvEpGuR\nTBOICnfuenUaDktMHixqgXFKx7SSF+8Qs0anlSP6OG8s2G82I2f2cN7lozdgGppG\n=WZxx\n-----END PGP MESSAGE-----\n",
+                                "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8"
+                        },
+                        {
+                                "created_at": "2022-02-22T14:44:08Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAAgoEDDUeIWqxm64kZ3DLaki5V5MFF3c7Kl/TbbmoKSww\nlZyHJtSACTrwfGBMAN+1NSKkTLTlE/q2FN7CtjfTyAWC0JLU9r3u5FVpQAXbBlht\n0l4BN8jltnkwlgw/CkKoq9rDHxfavDjfNBuSp4+8gzHj5XAvrKZKRWu0/T9LCr2A\nEon5f4kkjm99fiZVbojhjMM9drUrpaiofzMGvZeYgESRSmhTeLa1Qu6u7wb9ARkl\n=fqR3\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.1"
+        }
+}
+\ No newline at end of file
diff --git a/hosts/surtr/dns/keys/praseodym.org_acme.yaml b/hosts/surtr/dns/keys/praseodym.org_acme.yaml
new file mode 100644
index 00000000..ab0000c9
--- /dev/null
+++ b/hosts/surtr/dns/keys/praseodym.org_acme.yaml
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:c2hvYDv13AuxudKvGtbSYngACzJroxw9P98N/a8p9wB3K98vPY60JTVMxZkPQTbJGGCbi+FfqnezVSHNiSYtrD7RMeoh+BbOXfrWCkPUQ8vKP0P0F6CO3K3orFSckeSgi/NrkO9OD+8m2y19QGkgxd+BNs8KjCSYWruyt3kCuDvDN26vQY9AWD6HcPr/trDEY5uepQwjJFL4mT9JGGB5/B7G0d6VA61soJxVTdxp8oCzRGcSjaVoPlr77A8GDOJfFYviVfniLqZc6Q==,iv:MqhPxouSV5nQWXptSlINyW+AB5pwUVnSFT6R0+VZO0c=,tag:4p0wypyqWRk+ussoi9OXPw==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": null,
+                "lastmodified": "2022-02-22T14:43:36Z",
+                "mac": "ENC[AES256_GCM,data:YqS+uQXyBP0BMdz9R/SxjidSo7pVUFW78M8cPX6z55+j1gGKfDhEwQMUNZaGly1bvoma+a63NjUi4O4iEYR46fC3PUsVaf8S3Uqk0KYWIedDr9XqAxPBnb6wWFrNo4wwgq2mhaIitziK1QC6pdAgS/iNlGNNbCCbYmjzMLzQc8Q=,iv:BraowcHMeSQfImK1sONbefGIn2VWVGzLBBFLDwYGf10=,tag:oXvnGalny9kvvQpKMx8OcA==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2022-02-22T14:43:36Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAWVg759WL5YeSVLnx4g7PlD0DKo1+zBiZUOgnf9RHnl4w\n5wLTfTaYvXhd8j8y359dbvDER4r9isbpBfVZP+MGP4d3FdLgJCKm5WV6K5ES0bFN\n0l4BUX/KQeh0t/Phy2GZkmFyKu+3nr5Jl+veKIWJLZEfUCILX8c+X3e/4bZr8++n\nR2u5ZrFBENtaGxIdUpkxemQhGtd7BGtXyy/aCjRKY3MbCj4pmnAyushPaMC1+igp\n=LMQ4\n-----END PGP MESSAGE-----\n",
+                                "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8"
+                        },
+                        {
+                                "created_at": "2022-02-22T14:43:36Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAxpKmbaTfh5aDBOZWebVK/eA3T5sxS5fbW+cE/I54zF0w\ne0QDeamgTVrMQaDH1zCqoJcFNNkWnTErQVaOMSDBlwuFQ7KaoghONl8qCbY60MuI\n0l4Bt++Iu5e3bOLOkdl+RugclmGHpdpHAuJxbcnw88BKV/gYX1ntNEGgMHGcOl4R\nC8JjHYFdOtohPAUEbWf1ogkllwxxkCttWGFa01hL6W+ogJxGFhRcOm/zcjBE/3Vm\n=MKMA\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.1"
+        }
+}
+\ No newline at end of file
diff --git a/hosts/surtr/dns/keys/xmpp.li_acme.yaml b/hosts/surtr/dns/keys/xmpp.li_acme.yaml
new file mode 100644
index 00000000..7d85bd25
--- /dev/null
+++ b/hosts/surtr/dns/keys/xmpp.li_acme.yaml
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:kivOcI972j/fbloZCjH+nD9mBnk5s25NA+WDud3Hhfk3C70GhGKQaTHgnNIH11z9Pst4DX4liAvFjCzGP/sUGQuJmEfIHKckAOMrz8m5796fUIAZjrH36/NwB7Ytk2pYKy3lGZgO+CAxDvH/pzxD6WQPoVrgnyM3rjw7rgKLTMr94mp8ui9j4DdIwScwyWhOit8WrivDVwnNOz8GpxI45qogyeYMRESfeka3brzXVJ871nLjhbokcrKsja7Yiw==,iv:HkS/b5YjJ7iS4hYIOl5DACf9g2zoTO7cEIKdocKzWpo=,tag:HFLzoTJu+i6nmT9NNC6NAg==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": null,
+                "lastmodified": "2022-02-22T14:43:10Z",
+                "mac": "ENC[AES256_GCM,data:RQ9MBn/V8k41ax6KKlCmtCwlVMBsSzYtsG1zpwIutmuWRb39n2v/1oolW3hRkagSS7Q2Nu03d7L09KntAv77yjFKRYwMI3CFqU1JTsKYmW8c3ggTMS9RXFme+tAk85Wl33QzCnIYgI071tgmnlzct8yimh/oR2XyvMrMXm6IsbI=,iv:I6Dxhv0Up7LVUZ7j7SD3gCsiqsCYh3N0GtMuxnMcctg=,tag:I5OqFU1WPBM/m/6OPpUdow==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2022-02-22T14:43:10Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdANreqp4K9J56f70slxXnpJfHu5evjcVByLbHVYav0FlMw\n17qsPAAo4F0mj0zatV5EfnfYuNSsXR3j/9YocSHcMvBVzLsYdtV61fVtSrHiLt2a\n0lwBTfysYjor4J5h7G6ew7f1zicup3t9/ZPT2Q5fneRukpKExyM8o2ldjjRW7bq3\nt9kbihbTtB2t6k4iZUQRoYsfBKcM3hHeszv2W0xN9yOa/C5M8mOGNDJi48dEDQ==\n=3MEN\n-----END PGP MESSAGE-----\n",
+                                "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8"
+                        },
+                        {
+                                "created_at": "2022-02-22T14:43:10Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdARVdKf6ppaqBQnaJ7WhwBPcdnbmjom9aNrXtymThq3TEw\nnjH6Emd1QLBaXGr1Eb7RNzrWkrU1P+n3ihLEvW0easkceRv8T3+xID1E/+6R06JK\n0lwBw53C9ExWPpy8CUGs6HeOK901cRRV6XWErHXF4QVSoqhNXjjJTzUmf+7zxKnR\npCZL0HOykPazHmkZHcKvkGSKoEiDmK/wStQwHoO+pLGbUvbsCX+GMlYV6ySljw==\n=RPEC\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.1"
+        }
+}
+\ No newline at end of file
diff --git a/hosts/surtr/dns/keys/yggdrasil.li_acme.yaml b/hosts/surtr/dns/keys/yggdrasil.li_acme.yaml
new file mode 100644
index 00000000..0eb8f2f4
--- /dev/null
+++ b/hosts/surtr/dns/keys/yggdrasil.li_acme.yaml
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:QhWlBM7VZOagGaQICX31aaC69E00xUcVMvusxLLSz4mNy2B0l1Ngp7XGONI5+viq+nq/P9KytxoFybGwxjnxEcu++efsc+BjbKuylzq93rspQOoI/WjRxE/DoZCWQzK/UKWd1x1L3a/1+9IfKswkBEesgWx0Ug/bLlbr7GfQ3cpI6EwRGMba4VzfdmWPYAqAsfJmmOIY/WTShUEVbAmYQuUMhmZ9geWfjHonX42w7G8ICtlPcMc68ApK0nuhgKpzKisfHC/ddg8=,iv:rOePsUqnm0SSxHm4lc4Ikq9tbOnIgunIw3tqeFsEFTs=,tag:ESzqhFRmTUBvZQBzISQ2Qg==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": null,
+                "lastmodified": "2022-02-22T14:43:23Z",
+                "mac": "ENC[AES256_GCM,data:g2DNekY/VbytxwTxxIgXH+RldXCab3wtx5cOYriKxC6MDr3/E1A/rZm6nWqRI6lvD/dsmLsYmfvwEpfkTMvSi3/kFJZSr2y0wUBHMsZSs2cqtmZ7i+9YHMLrb//KTbkZHFw/NiH2pra29oFN1vdVrHwMvf0uVazBXyHABSb+DJE=,iv:jc+4u9sgWfBpF4lJtv2T6vxN5xhG/z7Vf3eADI37rKo=,tag:hhaDRwsOgCUoTDHdr8y9DQ==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2022-02-22T14:43:23Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAzEmCD9ROaiWV0ludmvPP0qGXznkk2J6bQQr0rWCZv2Yw\nF9JbGeiFyqnlPJKDs6rQyIzqmK/1IDjLNJ7KArQaJX5Htua64Iyb1M+Rxc8ugG52\n0l4BPxSJ76HAI0iHLM0UdGRfeyyYuwnShaqM5X4qEQu7Mh7L83s8Ym8a4tJpv+Zq\nGh1Uz7G+MyevcAT4J+bZY5VDyk6rwuMpS4mrzIMl30gkoiorQMyoSmji4ymLJ8NS\n=tRMa\n-----END PGP MESSAGE-----\n",
+                                "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8"
+                        },
+                        {
+                                "created_at": "2022-02-22T14:43:23Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAmy1AUOAkS9tkTu+GbDAS7SD+cT83CnRYd1O1ZG+eYwcw\nou88Nz3AGUcSa99om+yVY22nvztrIDOmqMih27ArB1Ruqhh4l4cm4mMrt35Jgezv\n0l4BiKZMHk6cwYGDopEfGU9m1l7lWZJofYIJZ8W0WSUtbHBXzZjwh5N7rh6EF2Te\njRJ72f6+/IaVeyhQjZocwQvFr0mfezontWlJb8hTOGBiWt16UPZ2UUgWMNIhepcy\n=AlJs\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.1"
+        }
+}
+\ No newline at end of file
diff --git a/hosts/surtr/dns/zones/email.nights.soa b/hosts/surtr/dns/zones/email.nights.soa
index 0beba77a..84ea61cc 100644
--- a/hosts/surtr/dns/zones/email.nights.soa
+++ b/hosts/surtr/dns/zones/email.nights.soa
@@ -1,7 +1,7 @@
 $ORIGIN nights.email.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. root.yggdrasil.li. (
-  2022022102 ; serial
+  2022022200 ; serial
  10800      ; refresh
  3600       ; retry
  604800     ; expire
@@ -25,6 +25,8 @@ $TTL 3600
 *                       IN      MX      0 ymir.yggdrasil.li.
 *                       IN      TXT     "v=spf1 redirect=yggdrasil.li"
+_acme-challenge         IN      NS      ns.yggdrasil.li.
 ymir._domainkey         IN      TXT     ( 
  "v=DKIM1;k=rsa;p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq3cCKlk+VPhyAanLZTM0BCzUT/+fmxHioZcFk0uJk1akBYj7BRofR7eVNcLKpm3rwYMQgE+9vJH9p8SV6tws9EcWc8SMCqqGZlREYM7PmLDiTSK/vjCzkygfgFCb0EBNsY2A/fpP4rTeoxrbcBSvMkq97iY5rwyw4wXZVZXLiDaCj23s8POoxTk1ClqUJZJQ5x2"
  "qzrC0RfN5kLZ9A7Gq2jB09vNxpXHYqABA0bJv88JiZM7hfkp9IafJZ+yCVMaBcJs4DAxnTjNAuFD9gm+qSFVY8+yeXqL6Qjo5PbruhyZRBW8RgRYT8t5n07XRglMGKKGMwOGLanrltcyXqB+GsDZBD36RAAwjFadnxdpDyRv4SgRP7ff2tKRrORYpmpN+mKdqw5j3J/nP6bXV1oAkyh9XQkPEIDi81WT87EZziTElDzVp6A2qFOxqucAovoRk24"
diff --git a/hosts/surtr/dns/zones/li.141.soa b/hosts/surtr/dns/zones/li.141.soa
index fbff1cad..9419a4ad 100644
--- a/hosts/surtr/dns/zones/li.141.soa
+++ b/hosts/surtr/dns/zones/li.141.soa
@@ -1,7 +1,7 @@
 $ORIGIN 141.li.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. root.yggdrasil.li. (
-  2022022200 ; serial
+  2022022201 ; serial
  10800      ; refresh
  3600       ; retry
  604800     ; expire
@@ -25,6 +25,8 @@ $TTL 3600
 *                       IN      MX      0 ymir.yggdrasil.li.
 *                       IN      TXT     "v=spf1 redirect=yggdrasil.li"
+_acme-challenge         IN      NS      ns.yggdrasil.li.
 surtr                   IN      A       202.61.241.61
 surtr                   IN      AAAA    2a03:4000:52:ada::
 surtr                   IN      MX      0 ymir.yggdrasil.li
diff --git a/hosts/surtr/dns/zones/li.kleen.soa b/hosts/surtr/dns/zones/li.kleen.soa
index eb998795..2e6326a4 100644
--- a/hosts/surtr/dns/zones/li.kleen.soa
+++ b/hosts/surtr/dns/zones/li.kleen.soa
@@ -1,7 +1,7 @@
 $ORIGIN kleen.li.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. root.yggdrasil.li. (
-  2022022102 ; serial
+  2022022200 ; serial
  10800      ; refresh
  3600       ; retry
  604800     ; expire
@@ -25,6 +25,8 @@ $TTL 3600
 *                       IN      MX      0 ymir.yggdrasil.li.
 *                       IN      TXT     "v=spf1 redirect=yggdrasil.li"
+_acme-challenge         IN      NS      ns.yggdrasil.li.
 ymir._domainkey         IN      TXT     ( 
  "v=DKIM1;k=rsa;p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq3cCKlk+VPhyAanLZTM0BCzUT/+fmxHioZcFk0uJk1akBYj7BRofR7eVNcLKpm3rwYMQgE+9vJH9p8SV6tws9EcWc8SMCqqGZlREYM7PmLDiTSK/vjCzkygfgFCb0EBNsY2A/fpP4rTeoxrbcBSvMkq97iY5rwyw4wXZVZXLiDaCj23s8POoxTk1ClqUJZJQ5x2"
  "qzrC0RfN5kLZ9A7Gq2jB09vNxpXHYqABA0bJv88JiZM7hfkp9IafJZ+yCVMaBcJs4DAxnTjNAuFD9gm+qSFVY8+yeXqL6Qjo5PbruhyZRBW8RgRYT8t5n07XRglMGKKGMwOGLanrltcyXqB+GsDZBD36RAAwjFadnxdpDyRv4SgRP7ff2tKRrORYpmpN+mKdqw5j3J/nP6bXV1oAkyh9XQkPEIDi81WT87EZziTElDzVp6A2qFOxqucAovoRk24"
diff --git a/hosts/surtr/dns/zones/li.xmpp.soa b/hosts/surtr/dns/zones/li.xmpp.soa
index 08c38bc4..7a10c957 100644
--- a/hosts/surtr/dns/zones/li.xmpp.soa
+++ b/hosts/surtr/dns/zones/li.xmpp.soa
@@ -1,7 +1,7 @@
 $ORIGIN xmpp.li.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. root.yggdrasil.li. (
-  2022022102 ; serial
+  2022022200 ; serial
  10800      ; refresh
  3600       ; retry
  604800     ; expire
@@ -25,6 +25,8 @@ $TTL 3600
 *                       IN      MX      0 ymir.yggdrasil.li.
 *                       IN      TXT     "v=spf1 redirect=yggdrasil.li"
+_acme-challenge         IN      NS      ns.yggdrasil.li.
 ymir._domainkey         IN      TXT     ( 
  "v=DKIM1;k=rsa;p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq3cCKlk+VPhyAanLZTM0BCzUT/+fmxHioZcFk0uJk1akBYj7BRofR7eVNcLKpm3rwYMQgE+9vJH9p8SV6tws9EcWc8SMCqqGZlREYM7PmLDiTSK/vjCzkygfgFCb0EBNsY2A/fpP4rTeoxrbcBSvMkq97iY5rwyw4wXZVZXLiDaCj23s8POoxTk1ClqUJZJQ5x2"
  "qzrC0RfN5kLZ9A7Gq2jB09vNxpXHYqABA0bJv88JiZM7hfkp9IafJZ+yCVMaBcJs4DAxnTjNAuFD9gm+qSFVY8+yeXqL6Qjo5PbruhyZRBW8RgRYT8t5n07XRglMGKKGMwOGLanrltcyXqB+GsDZBD36RAAwjFadnxdpDyRv4SgRP7ff2tKRrORYpmpN+mKdqw5j3J/nP6bXV1oAkyh9XQkPEIDi81WT87EZziTElDzVp6A2qFOxqucAovoRk24"
diff --git a/hosts/surtr/dns/zones/li.yggdrasil.soa b/hosts/surtr/dns/zones/li.yggdrasil.soa
index 0cd26ec1..8fbfd98f 100644
--- a/hosts/surtr/dns/zones/li.yggdrasil.soa
+++ b/hosts/surtr/dns/zones/li.yggdrasil.soa
@@ -1,7 +1,7 @@
 $ORIGIN yggdrasil.li.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. root.yggdrasil.li. (
-  2022022102 ; serial
+  2022022200 ; serial
  10800      ; refresh
  3600       ; retry
  604800     ; expire
@@ -28,6 +28,8 @@ ns			IN	AAAA	2a03:4000:52:ada::
 *                       IN      MX      0 ymir.yggdrasil.li.
 *                       IN      TXT     "v=spf1 redirect=yggdrasil.li"
+_acme-challenge         IN      NS      ns.yggdrasil.li.
 ymir                    IN      A       188.68.51.254
 ymir                    IN      AAAA    2a03:4000:6:d004::
 ymir                    IN      MX      0 ymir.yggdrasil.li.
diff --git a/hosts/surtr/dns/zones/org.dirty-haskell.soa b/hosts/surtr/dns/zones/org.dirty-haskell.soa
index ea7e0010..558d9817 100644
--- a/hosts/surtr/dns/zones/org.dirty-haskell.soa
+++ b/hosts/surtr/dns/zones/org.dirty-haskell.soa
@@ -1,7 +1,7 @@
 $ORIGIN dirty-haskell.org.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. root.yggdrasil.li. (
-  2022022102 ; serial
+  2022022200 ; serial
  10800      ; refresh
  3600       ; retry
  604800     ; expire
@@ -25,6 +25,8 @@ $TTL 3600
 *                       IN      MX      0 ymir.yggdrasil.li.
 *                       IN      TXT     "v=spf1 redirect=yggdrasil.li"
+_acme-challenge         IN      NS      ns.yggdrasil.li.
 ymir._domainkey         IN      TXT     ( 
  "v=DKIM1;k=rsa;p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq3cCKlk+VPhyAanLZTM0BCzUT/+fmxHioZcFk0uJk1akBYj7BRofR7eVNcLKpm3rwYMQgE+9vJH9p8SV6tws9EcWc8SMCqqGZlREYM7PmLDiTSK/vjCzkygfgFCb0EBNsY2A/fpP4rTeoxrbcBSvMkq97iY5rwyw4wXZVZXLiDaCj23s8POoxTk1ClqUJZJQ5x2"
  "qzrC0RfN5kLZ9A7Gq2jB09vNxpXHYqABA0bJv88JiZM7hfkp9IafJZ+yCVMaBcJs4DAxnTjNAuFD9gm+qSFVY8+yeXqL6Qjo5PbruhyZRBW8RgRYT8t5n07XRglMGKKGMwOGLanrltcyXqB+GsDZBD36RAAwjFadnxdpDyRv4SgRP7ff2tKRrORYpmpN+mKdqw5j3J/nP6bXV1oAkyh9XQkPEIDi81WT87EZziTElDzVp6A2qFOxqucAovoRk24"
diff --git a/hosts/surtr/dns/zones/org.praseodym.soa b/hosts/surtr/dns/zones/org.praseodym.soa
index 72f380bb..08f5d16d 100644
--- a/hosts/surtr/dns/zones/org.praseodym.soa
+++ b/hosts/surtr/dns/zones/org.praseodym.soa
@@ -1,7 +1,7 @@
 $ORIGIN praseodym.org.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. root.yggdrasil.li. (
-  2022022102 ; serial
+  2022022200 ; serial
  10800      ; refresh
  3600       ; retry
  604800     ; expire
@@ -25,6 +25,8 @@ $TTL 3600
 *                       IN      MX      0 ymir.yggdrasil.li.
 *                       IN      TXT     "v=spf1 redirect=yggdrasil.li"
+_acme-challenge         IN      NS      ns.yggdrasil.li.
 surtr                   IN      A       202.61.241.61
 surtr                   IN      AAAA    2a03:4000:52:ada::
 surtr                   IN      MX      0 ymir.yggdrasil.li
diff --git a/hosts/surtr/tls/Gupfile b/hosts/surtr/tls/Gupfile
new file mode 100644
index 00000000..13ba8cf6
--- /dev/null
+++ b/hosts/surtr/tls/Gupfile
@@ -0,0 +1,2 @@
+tsig_key.gup:
+  tsig_keys/*
+\ No newline at end of file
diff --git a/hosts/surtr/tls/default.nix b/hosts/surtr/tls/default.nix
index 01c9050e..b28d33e9 100644
--- a/hosts/surtr/tls/default.nix
+++ b/hosts/surtr/tls/default.nix
@@ -8,51 +8,6 @@ let
  tsigSecretName = domain: "${domain}_tsig-secret";
  cfg = config.security.acme;
-  knotCfg = config.services.knot;
-  
-  knotDNSCredentials = domain: let
-    zone = if cfg.domains.${domain}.zone == null then domain else cfg.domains.${domain}.zone;
-  in pkgs.writeText "lego-credentials" ''
-    EXEC_PATH=${knotDNSExec zone}/bin/update-dns.sh
-    EXEC_PROPAGATION_TIMEOUT=300
-    EXEC_POLLING_INTERVAL=5
-  '';
-  knotDNSExec = zone: pkgs.writeScriptBin "update-dns.sh" ''
-    #!${pkgs.zsh}/bin/zsh -xe
-    mode=$1
-    fqdn=$2
-    challenge=$3
-    owner=''${fqdn%".${zone}."}
-    commited=
-    function abort() {
-      [[ -n "''${commited}" ]] || ${knotCfg.cliWrappers}/bin/knotc zone-abort "${zone}"
-    }
-    ${knotCfg.cliWrappers}/bin/knotc zone-begin "${zone}"
-    trap abort EXIT
-    case "''${mode}" in
-      present)
-        if ${knotCfg.cliWrappers}/bin/knotc zone-get ${zone} "''${owner}" TXT; then
-          ${knotCfg.cliWrappers}/bin/knotc zone-unset ${zone} "''${owner}" TXT '""'
-        fi
-        ${knotCfg.cliWrappers}/bin/knotc zone-set ${zone} "''${owner}" 30 TXT "''${challenge}"
-        ;;
-      cleanup)
-        ${knotCfg.cliWrappers}/bin/knotc zone-unset ${zone} "''${owner}" TXT "''${challenge}"
-        ${knotCfg.cliWrappers}/bin/knotc zone-set ${zone} "''${owner}" 30 TXT '""'
-        ;;
-      *)
-        exit 2
-        ;;
-    esac
-    ${knotCfg.cliWrappers}/bin/knotc zone-commit "${zone}"
-    commited=yes
-  '';
  
  domainOptions = {
    options = {
@@ -111,10 +66,6 @@ in {
              extraDomainNames = optional cfg.domains.${domain}.wildcard "*.${domain}";
              dnsResolver = "127.0.0.1:5353";
            };
-            mkKnotc = shared // {
-              dnsProvider = "exec";
-              credentialsFile = knotDNSCredentials domain;
-            };
            mkRFC2136 = let
              tsigInfo = readYaml tsigPath;
            in shared // {
@@ -129,7 +80,7 @@ in {
                RFC2136_POLLING_INTERVAL=2
              '';
            };
-          in (if isTsig then mkRFC2136 else mkKnotc) // cfg.domains.${domain}.certCfg;
+          in assert isTsig; mkRFC2136 // cfg.domains.${domain}.certCfg;
        in genAttrs (attrNames cfg.domains) domainAttrset;
    };
diff --git a/hosts/surtr/tls/tsig_key.gup b/hosts/surtr/tls/tsig_key.gup
new file mode 100644
index 00000000..3d81b603
--- /dev/null
+++ b/hosts/surtr/tls/tsig_key.gup
@@ -0,0 +1,6 @@
+#!/usr/bin/env zsh
+keyFile=../dns/keys/${2:t}_acme.yaml
+gup -u $keyFile
+sops -d --input-type=binary --output-type=binary ${keyFile} | yq -r '.key[0].secret' > $1
+sops -p '7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8,30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51' --input-type=binary -e -i $1
+\ No newline at end of file
diff --git a/hosts/surtr/tls/tsig_keys/141.li b/hosts/surtr/tls/tsig_keys/141.li
new file mode 100644
index 00000000..f94b492f
--- /dev/null
+++ b/hosts/surtr/tls/tsig_keys/141.li
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:wjjG+kaLFnWG8vTKCMHRsTB2ksZEQV/lZON7OTGs4RGF2UGyzr7uFiaPEu69,iv:x29NlTSg48NuDZmNwQx7WFhKPanOLEziDF59GpAbYIU=,tag:U0jQimah+7dfJ8+rElb75w==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": null,
+                "lastmodified": "2022-02-22T14:15:30Z",
+                "mac": "ENC[AES256_GCM,data:NVzJqLoMPP1I322E002PPHB4hp6K2FpZTz1+E+eggsVnXtcU3da0zzRZTe+1JRRRLgTp1nFafxkDZbOF53byUgcuA+YVD0lIcX/Zk4JtkihS/AKBgCFSDXox+WFPulT+Jy8piRQuLFIj9m//FrPqbbZje4tT9MqtU8GFtQ/RZSA=,iv:ZXv5MXjUH939pbFZTHLICovdKgDxN3HkJWjzEBu0mIM=,tag:0h6XiH4oIeFEH3dFivHe2g==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2022-02-22T14:15:29Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdA3LvoKvgJIXhXYc5cnoUHE4k9EnJzrSokuwHX6vsXMF4w\nl/Am3E8SYCRLW6GH84v5nRogvRi4/njDTUMltRil4AreR8AKs6O22K/dotFDFpm8\n0l4BjzIFo5lin5t/fJQnam+Q9N0sRu6CKe74id93IEWn4fh8jnGm2z45VQf08edv\n5TT3atYJPXK3BoOGZqWLbYk1zZMxlj/yNDC/gsoNzkv7tFfQyd8Rk0pbGOELrvlq\n=QUbV\n-----END PGP MESSAGE-----\n",
+                                "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8"
+                        },
+                        {
+                                "created_at": "2022-02-22T14:15:29Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdApyLjA3a/6MiK3911+Dp7+GldIgztIqDfePqSVGQ9Tngw\n8ojc86qm6daCc2aceZGmmvt28kPX4XNmd5KOnFhF6B33o1tSI2duoVeYMOMY5sc0\n0l4BXL2CeNPvdX5To1I4OAUV6t3HEhgnW41/b6B3LqaGg34KBI4i7xNb8+djVSxu\nMEtYkD9QoSkDdNOpDAlH5GnPmrIVPHY9ml70agC1ctwET+P6L9qt0lzwCs2K1oT2\n=/Ukj\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.1"
+        }
+}
+\ No newline at end of file
diff --git a/hosts/surtr/tls/tsig_keys/dirty-haskell.org b/hosts/surtr/tls/tsig_keys/dirty-haskell.org
new file mode 100644
index 00000000..b9effeda
--- /dev/null
+++ b/hosts/surtr/tls/tsig_keys/dirty-haskell.org
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:c4XzB/MbBfDcgR+6/FRNxDsRxtfdOR8oaKj7eLByJfnDyDrnN/p5DHrwNOe+,iv:TmCVdXMFJtRb1eT0M8Tga23rxoyUldjPATPX04n7I18=,tag:AhqhULrs/FVtfPUeWv5SdQ==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": null,
+                "lastmodified": "2022-02-22T14:20:36Z",
+                "mac": "ENC[AES256_GCM,data:AZxoNR2oE7c5LXEg8o3cBYTflBMeGadPWr1cJ5GEyBJUJUloN9V9iTjnN/62Pj1zkTQvOhL4vkoOd0q812mOV1QgCi/RbLTPIn55dDWJ8d8jYQLlqrMV3LR+xtsGDDBDOPWJ8pNIug9D7f3BwVQpbvj3W2WOnJvm3oAZNHa0RJ8=,iv:YVFNSC74bZQgGpVLxWFCkC1oouSYwJjQ+k3beSeXUJc=,tag:oi7bSs83GsDl4qpsJ8zqCw==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2022-02-22T14:20:35Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAhNF59zErbJlEDeJjF5kFLUVeAF81ageD34K/7NjVf3Ew\nFAn32mbWKZmoY4ekfOyZesKWTvpaYH8vnLj0r0vTc4nnqIejrVbz5T7nxl9mKgxX\n0l4BS9jVKuC7mGvTlKvpABPEP7uQS083JRVdTQ9nLFF3kOgf3rHWTX7I+QNMT+7E\nWqdm0q8OV09wk0I94lpRVjQjeosZmLGV58E8Q1D5x9xKjwS1Z9IT2SHONaZDAc5a\n=jdQT\n-----END PGP MESSAGE-----\n",
+                                "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8"
+                        },
+                        {
+                                "created_at": "2022-02-22T14:20:35Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAMpNL9Ff2tSQLZYJlJCc3zUeTIiJYBwPXngz89tnrtxMw\n7cBQezv8MW/nKS5+8VPsr5NA2EfbPRlPAGDs3i7c82iNyaq8wjlZ7E5kJt9Cp1UA\n0l4BUddH560+QD8JZ7Tas943jI0GvBSrP3gm/dpILXS6APmIo8cY1Ex8Qkyvp0vn\nfumu+TRaUIjgSo5ZbqbJx+/duUjTg+j+p0Zu1xvBDQizbP894y5LFfsEsWQB2tkC\n=QZbr\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.1"
+        }
+}
+\ No newline at end of file
diff --git a/hosts/surtr/tls/tsig_keys/kleen.li b/hosts/surtr/tls/tsig_keys/kleen.li
new file mode 100644
index 00000000..3f31b1ec
--- /dev/null
+++ b/hosts/surtr/tls/tsig_keys/kleen.li
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:Jjw1uufbrTcNTY9QLDbC98BXyDsUpO7jlS56qHmrIC4gBT0DF29v4thHgDe/,iv:AJeaK7SA2dlVMZKT7VGYXpjYOvIlWsSPghylvwq5hfE=,tag:af6RdYpyPSioqiTpnuLYNQ==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": null,
+                "lastmodified": "2022-02-22T14:43:58Z",
+                "mac": "ENC[AES256_GCM,data:Ws+LHpDFB9tKzfV5zVg5POTbzwb5KNFigPCQON85yIupazVMKesW5mpBZTzbknL0IwPfVnCQNX92bnJ6RBqJ+vIdOdax/eZzuIMvXyUGw1gjafkE3F9gv0CWu3n34SoLOynEIHXOrM/nTVWOLs6+DP1fH8MmscjhvaX52yIxe8E=,iv:OhYYyc0tcI2BrL8i2ZWADso9AcHzhb/wNrqVEnTXUJY=,tag:+GoBXxlveNe2puCbFz2foQ==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2022-02-22T14:43:58Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAHUWRBd0g/lAt4SNSRTyY084xlAmLVFiWY38oItiWEzUw\ngFigoJRqCtFsfRgmPC/VyasEAsUCSmmA15rGH+C1DA0HRyXLNUVGEcsnL1J7yNxS\n0lwBVaPi+AgmKtV48v6YzArTeY36TA9CInZl588Wy/YFitnTX6wqIuoZeJlDgEhN\nVF4XQVjb1mQhHFHbgD7SJSW6fHi8KWb+B3Tr6qt+p+CzwCycH/IaDbWbhIRSZg==\n=06jP\n-----END PGP MESSAGE-----\n",
+                                "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8"
+                        },
+                        {
+                                "created_at": "2022-02-22T14:43:58Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAZbcJU1YXpht/sVq+NgOi23+BCjuiT/DH2Q4o9oQwEBkw\nLlQGzqtLfKPAjZWCECgsgz7ssAQVY90S9MDM3fUYWX56TXZabFkgz18Bn0cq1Ywa\n0lwBeS1RQX6gyjLNrO3B52eL9t/FW01RtWWS51nGN0WafVgoIaohV00lDCFZPAD/\noajw9vLd7Njjk11Pqv6H7pUanQOk69+tX5pKpzwGlRE0eZre6OSPZp9WTgfLTQ==\n=Af2i\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.1"
+        }
+}
+\ No newline at end of file
diff --git a/hosts/surtr/tls/tsig_keys/nights.email b/hosts/surtr/tls/tsig_keys/nights.email
new file mode 100644
index 00000000..5e387091
--- /dev/null
+++ b/hosts/surtr/tls/tsig_keys/nights.email
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:WrhKcorA/PdPrt6tr1eDuVA/Wdr/DaRtc5ETixVKZtxDZzKQakF5ltVB49Dj,iv:f/1Ko1m064gAVPEbt2SnHt7zee/PQvMZb+/qneVc0ls=,tag:qimiralQNxwOZ/uAs1T7/g==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": null,
+                "lastmodified": "2022-02-22T14:44:08Z",
+                "mac": "ENC[AES256_GCM,data:+/9QfW6yc0AXNKu73Mkp7hK98lWWyNn3WLJ2wdi6mh7dAR/pYxcuIa8a9b8Kv41WrExwExVbWbI886v2hC63GMI+rZeiOXAZEEFNCpYQwyog0bzWedZ9gE5ZmymaErrPsVJYauys+8NYomhtj+3ufB5FZNwfmEOO76dzcr10qZY=,iv:ecyJqhBYHHNj97JvOCFgFg4jxaBySUdj3ZgZKY6ulLw=,tag:a62hRw50887xQarS6O/GgA==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2022-02-22T14:44:08Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAwkyJitOwmF+FeN4F3Z72t5wf8vTizR+TjlBPU/OwRUYw\nYVBQCma/uqjRj4UZeWXo6lq3weKI+gRp17z3Fvzc0YCWdtGq7lKyVtmwPltrvEXc\n0l4B4h6XT2+EcPuqtvkpNwIUoNphYZV8xGUD4v6lAQqUOYFsJvZfZbYe7tukcAQg\nwvbuWE2Hht0cxPpY65cVURA92wEcs7aP6Bp9Mqb/lQn7Ju1sv1a4bAvYvNVFnqu2\n=OkoI\n-----END PGP MESSAGE-----\n",
+                                "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8"
+                        },
+                        {
+                                "created_at": "2022-02-22T14:44:08Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAFIJLO7eo3lhEVg13E2zI8DMn3ljuQv9JggBD2mHk4Xcw\nDjk54ugbH3AacQN4zsoGJsAjZEUpfCBhGl/fpVZYEVzgMLzA2SRqRol94YPyNpM3\n0l4Bived0rDJwIYAEhpCplpX/JKAN48BaauPC14QuWDxgBpZTWSKqa+BoYpTbBoc\nN0amWuqWp7WGLrRizpfah1w/+Og6QycgccXzG/dz5aRVC71ddxycvjbR2k6sH3tr\n=m8ZH\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.1"
+        }
+}
+\ No newline at end of file
diff --git a/hosts/surtr/tls/tsig_keys/praseodym.org b/hosts/surtr/tls/tsig_keys/praseodym.org
new file mode 100644
index 00000000..c4afce5d
--- /dev/null
+++ b/hosts/surtr/tls/tsig_keys/praseodym.org
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:LLr/euxUJL1qSnjx2HlUG/X5dIg15WXb3VryAnVtHCLHUxnfrUF2PNlAoneL,iv:7OeUpmgXb7PfyDwfgNvaqhnPn9UKqYd4ug8as01gIDU=,tag:CYKMKyol09ahPr6SKGB9kA==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": null,
+                "lastmodified": "2022-02-22T14:43:37Z",
+                "mac": "ENC[AES256_GCM,data:dMgOwAv7CWEsP568dNX/1mGOcVIXc/eU92gJUSkZaQBWoJExa7Y1K0Ocyin9YsdQsFGcBFgjyo1DtdVUrf8j5/V69CG8xXiWwf82O247lifK+V2/Etgys7W71GZXxX+C5+fnN8SgsVQeOKX47ljiDeajKMXOptQEx7Awooe1vYM=,iv:GP57gibgf20yrZTgGzGxewOEWnu+1E7uJUYYJO85n9Q=,tag:Zhl9FmLYUyydiNzbXjLN4g==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2022-02-22T14:43:37Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAEwneu5Lzspri3SHXIFgp8G+nTOpl3DGEoQTCaxeJvkgw\n/q3IUfiNFbpH32V7V07oOk3CD3SIlVVLNcxD/3DuOLHLeCehnWJ6OAtzaakvR2zW\n0l4BEBu/NBzhrtxbOt2vJnUyIoPwJIQuzQ92nUppd3gdaMoHyA+Wk/CAByTZ6+Gu\nq4jPWyeVwGeItpQ3PfpnCKJJQGhs/2E9TQrrovr2vhurnaxiEW80U/NdCQ3eMXiw\n=vKZP\n-----END PGP MESSAGE-----\n",
+                                "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8"
+                        },
+                        {
+                                "created_at": "2022-02-22T14:43:37Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdA1KY9DWpdJsUWLsvl4jJWel1tsdiNJ4z1VJw1W1Uiti0w\nLBhjFCiX4trrvYZf/s27t3CEE3j1xHpk+nhG+5rvh4PKOy9+4Z4dQ7ePr3khWK8d\n0l4BrSZXnmP1+i49AjR4F94EvezVS5MMNlqbHOfChBaybXO95oXl8CamSu2X0kSC\naJJe/ovfYblK2QCD1+kAb/e4LOedAHkL/YSOFtKa0WVhKNJoRIocAAYfCAXuQSRP\n=GWol\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.1"
+        }
+}
+\ No newline at end of file
diff --git a/hosts/surtr/tls/tsig_keys/xmpp.li b/hosts/surtr/tls/tsig_keys/xmpp.li
new file mode 100644
index 00000000..35acd462
--- /dev/null
+++ b/hosts/surtr/tls/tsig_keys/xmpp.li
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:Bice54S+zPCtUASZD0wnqFeBDekIKAfaZmNc4BJ8yFzzP1AeenJqOow69lf/,iv:dsBceXehjvhfTSd+KXE2QOvpTwNTY7gr9ef0hNFdDms=,tag:6iMISbLkELFP5OBbRgcdqA==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": null,
+                "lastmodified": "2022-02-22T14:43:10Z",
+                "mac": "ENC[AES256_GCM,data:IACasoGWgaouc0QnJAztTJkRnD60D0r0pXdxhXnDqpsz3qeS4Nnc5wgjMjSC6iTLNTDsGHw5s8egoIYKNhMVv1Gi7jYPgaIMGkjtg5iGIGmd12dqQTT4LPTfvrA0zqvu6BjzjO1BEBaJ26u8SBWw6yIg76b0BPpmM6afmyKo4X0=,iv:el8SzvnpQzURe1POMWNI3d2vYbAHqgfWzkzFi6GTQx8=,tag:HWABf4iOAZZLiJiMivGQ7Q==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2022-02-22T14:43:10Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAqBgOG0dMrKdKrPfL605eIH0q4zc/qLSepP3Mbi4wUCAw\nwVXV+LDTZKtCiT3RioyM3Vlf6blY1i5A8VgCKPHKFSy7TEMmhsHKKQGExahE35tm\n0l4BSmNYGiyW6mdiOlVS4uHlztG0SkzxAKoWs7lgwXufP97M0c9GaGLwVUCaOrWj\n416XfTI1wL8HmLBHaa8s2GyVPo+VWRKUpPu9gXAjTpqmRxeFjt7j749nIK8X27y8\n=2zXf\n-----END PGP MESSAGE-----\n",
+                                "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8"
+                        },
+                        {
+                                "created_at": "2022-02-22T14:43:10Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdA4FILrqlN0ta93yHezBedT+3UuCQqonGlarHvrwi77DUw\nIi4IxaLcYRwqISIhsjz0k7MzJ/BlP1/Qg/NMaB9CoSQIoVc8P7TK/gdP81ORE+r2\n0l4BT9n00HJPJ4IHJKcKmG+Ta5xOPHsVqRNgLSp7Ss71I0HLEa6YqhE/4z3kwvcE\nD7fWKVLkMuA6PMzjEa+ZGY/baqHL0VFW+Vy3/Fn+E0nStUT17Ya0ANB5kuyRp/v6\n=cwHX\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.1"
+        }
+}
+\ No newline at end of file
diff --git a/hosts/surtr/tls/tsig_keys/yggdrasil.li b/hosts/surtr/tls/tsig_keys/yggdrasil.li
new file mode 100644
index 00000000..7c75602c
--- /dev/null
+++ b/hosts/surtr/tls/tsig_keys/yggdrasil.li
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:nfXCp4v2HFGHzceTQJY7knQ3ci8sPUGdiYL5Cy9epu3LK1QULNFb+eA+vFHG,iv:xBdtLNYMgGQfLsdjj63uwc9NWe8UvVnVmyuMAM0S1bQ=,tag:9xSy1U4+crLKvWr7eKti4w==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": null,
+                "lastmodified": "2022-02-22T14:43:24Z",
+                "mac": "ENC[AES256_GCM,data:DzSO3ir1Q2KWzwcmrW9ksw9GFRJXOVkb2tuhgDQxzV+sHC8O6VLMvYUZCNrYSKlZR0i2xiGuQD+3cO09YRYMF9MoR3ODl1BAGi5C0z0UKYPxf8BE/8x1qj2ak4Qdp7BHtaAQHo+IU+dX8AK64DJ5b2pJ/ThZzRSlfaeYp3X8cgA=,iv:FeuDzZzI8R2sZxWry5Jr1eoUWQlLkSqiNLutrvBviKI=,tag:VQJoQSodDkHIkrDXsnPG7Q==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2022-02-22T14:43:23Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAP/YAe2yfGvQ3TcChWjoRsi1bSezMKA2VDWPgRZuA1xQw\nEXhjL2Iu/ORRaktmd6ortqSxckYo2WOosqLXLLWXSnSpBK0mpSFO4/DJbMeKapCA\n0lwB0Tq0hP1Knh7jrTm/9mj2zcqonJY4P8mDwobBI4p1Ll29HxG4KCExrsxFFV6S\nQj1/r9Sz3SLsA9+z8hS8SQO3+877ITmAF518LTjs5clelO4I3KYCQqezXTVOSA==\n=2jir\n-----END PGP MESSAGE-----\n",
+                                "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8"
+                        },
+                        {
+                                "created_at": "2022-02-22T14:43:23Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdArOyejysX1GDvK5g928BoioPtvEz1VzindL8Ng3Ta/Bcw\nUCB1/NKkCM8Ex2jALoGrBeZ5GdL2eRAOmQysaYPpeYRSG84/6e3DUixsbavL63tO\n0lwB+fVTe4tsLKFQ/j+GRJrBkHWNLVSjq50t68OhqTMQ31e8FejeTdAmsFG33MjH\ntumC/AGjz9qAGR7G690wu6WZaJRFD+aPMAJdFN2Fu3A+Imdra3hlTExs8ZAVaA==\n=7NiP\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.1"
+        }
+}
+\ No newline at end of file
diff --git a/shell.nix b/shell.nix
index a8239dc8..d7d42460 100644
--- a/shell.nix
+++ b/shell.nix
@@ -22,5 +22,7 @@ in pkgs.mkShell {
    nftables
    deploy-rs
    tai64dec
+    knot-dns
+    yq
  ];
 }
author	Gregor Kleen <gkleen@yggdrasil.li>	2022-02-22 15:48:59 +0100
committer	Gregor Kleen <gkleen@yggdrasil.li>	2022-02-22 15:48:59 +0100
commit	a7255ba16633d70c22e8bed75ae52c49f08e1c18 (patch)
tree	71f1cdc442efef13fe239e8694b4fe9bcc58b923
parent	ef600c518e5fdb4962fdd4d4851413a024fa52f7 (diff)
download	nixos-a7255ba16633d70c22e8bed75ae52c49f08e1c18.tar nixos-a7255ba16633d70c22e8bed75ae52c49f08e1c18.tar.gz nixos-a7255ba16633d70c22e8bed75ae52c49f08e1c18.tar.bz2 nixos-a7255ba16633d70c22e8bed75ae52c49f08e1c18.tar.xz nixos-a7255ba16633d70c22e8bed75ae52c49f08e1c18.zip