1 files changed, 23 insertions, 1 deletions

diff --git a/hosts/surtr/dns/default.nix b/hosts/surtr/dns/default.nix
index 5f69c350..695ac292 100644
--- a/hosts/surtr/dns/default.nix
+++ b/hosts/surtr/dns/default.nix
@@ -25,6 +25,7 @@ in {
       enable = true;
       keyFiles = [
         config.sops.secrets."rheperire.org_acme_key.yaml".path
+        config.sops.secrets."knot_local_key.yaml".path
       ];
       extraConfig = ''
         server:
@@ -38,6 +39,9 @@ in {
             address: 185.181.104.96@53
           - id: recursive
             address: ::1@5353
+          - id: local
+            address: ::1@53
+            key: local_key
 
         acl:
           - id: inwx_acl
@@ -46,6 +50,10 @@ in {
           - id: rheperire.org_acme_acl
             key: rheperire.org_acme_key
             action: update
+          - id: local_acl
+            key: local_key
+            action: update
+            update-type: DS
 
         mod-rrl:
           - id: default
@@ -75,6 +83,15 @@ in {
             ksk-lifetime: 360d
             signing-threads: 2
             ksk-submission: validating-resolver
+          - id: ed25519_local-push
+            algorithm: ed25519
+            nsec3: on
+            nsec3-iterations: 0
+            ksk-lifetime: 360d
+            signing-threads: 2
+            ksk-submission: validating-resolver
+            cds-cdnskey-publish: none
+            ds-push: [local]
 
         template:
           - id: default
@@ -98,7 +115,7 @@ in {
             journal-content: all
             semantic-checks: on
             dnssec-signing: on
-            dnssec-policy: ed25519
+            dnssec-policy: ed25519_local-push
 
         zone:
           - domain: yggdrasil.li
@@ -145,6 +162,11 @@ in {
         owner = "knot";
         sopsFile = ./keys/rheperire.org_acme.yaml;
       };
+      "knot_local_key.yaml" = {
+        format = "binary";
+        owner = "knot";
+        sopsFile = ./keys/local_key.yaml;
+      };
     };