knot@surtr: yggdrasil.li dnssec

1 files changed, 8 insertions, 0 deletions

diff --git a/hosts/surtr/dns/default.nix b/hosts/surtr/dns/default.nix
index 23edfab5..5afdfedf 100644
--- a/hosts/surtr/dns/default.nix
+++ b/hosts/surtr/dns/default.nix
@@ -15,10 +15,18 @@
           listen: 202.61.241.61@53
           listen: 2a03:4000:52:ada::@53
 
+        policy:
+          - id: rsa
+            algorithm: RSASHA256
+            ksk-size: 4096
+            zsk-size: 2048
+            zsk-lifetime: 30d
+
         zone:
           - domain: yggdrasil.li
             file: ${./zones/li.yggdrasil.soa}
             semantic-checks: on
+            dnssec-signing: on
       '';
     };
   };