knot@surtr: firewall & inwx

1 files changed, 20 insertions, 0 deletions

diff --git a/hosts/surtr/dns/default.nix b/hosts/surtr/dns/default.nix
index 790e6850..3fe76dbf 100644
--- a/hosts/surtr/dns/default.nix
+++ b/hosts/surtr/dns/default.nix
@@ -5,6 +5,15 @@
       { device = "surtr/safe/var-lib-knot";
         fsType = "zfs";
       };
+
+    firewall = {
+      allowedTCPPorts = [
+        53 # DNS
+      ];
+      allowedUDPPorts = [
+        53 # DNS
+      ];
+    };
     
     services.knot = {
       enable = true;
@@ -22,6 +31,8 @@
            zonefile-load: difference-no-serial
            semantic-checks: on
            dnssec-signing: on
+           notify: inwx
+           acl: [inwx_acl]
 
         policy:
           - id: rsa
@@ -30,6 +41,15 @@
             zsk-size: 2048
             zsk-lifetime: 30d
 
+        remote:
+          - id: inwx
+            address: 185.181.104.96@53
+
+        acl:
+          - id: inwx_acl
+            address: 185.181.104.96
+            action: transfer
+
         zone:
           - domain: yggdrasil.li
             file: ${./zones/li.yggdrasil.soa}