negative trust anchors

1 files changed, 26 insertions, 6 deletions

diff --git a/hel.nix b/hel.nix
index d735a365..b08cf633 100644
--- a/hel.nix
+++ b/hel.nix
@@ -569,12 +569,32 @@
     '';
   };
 
-  systemd.network.networks."yggdrasil" = {
-    name = "yggdrasil";
-    networkConfig = {
-      DNSSECNegativeTrustAnchors = [ "10.in-addr.arpa" "yggdrasil" "168.192.in-addr.arpa" "box" ];
-    };
-  };
+  environment.etc."dnssec-trust-anchors.d/local-ip.negative".text = ''
+    10.in-addr.arpa
+    16.172.in-addr.arpa
+    17.172.in-addr.arpa
+    18.172.in-addr.arpa
+    19.172.in-addr.arpa
+    20.172.in-addr.arpa
+    21.172.in-addr.arpa
+    22.172.in-addr.arpa
+    23.172.in-addr.arpa
+    24.172.in-addr.arpa
+    25.172.in-addr.arpa
+    26.172.in-addr.arpa
+    27.172.in-addr.arpa
+    28.172.in-addr.arpa
+    29.172.in-addr.arpa
+    30.172.in-addr.arpa
+    31.172.in-addr.arpa
+    168.192.in-addr.arpa
+    d.f.ip6.arpa
+  '';
+
+  environment.etc."dnssec-trust-anchors.d/local-domains.negative" = ''
+    yggdrasil
+    box
+  '';
 
   system = {
     stateVersion = "16.09";