3 files changed, 43 insertions, 2 deletions

diff --git a/hosts/surtr/dns/default.nix b/hosts/surtr/dns/default.nix
index 2079585c..971de5e8 100644
--- a/hosts/surtr/dns/default.nix
+++ b/hosts/surtr/dns/default.nix
@@ -25,6 +25,7 @@ in {
       enable = true;
       keyFiles = [
         config.sops.secrets."rheperire.org_acme_key.yaml".path
+        config.sops.secrets."webdav.141.li_acme_key.yaml".path
         config.sops.secrets."knot_local_key.yaml".path
       ];
       extraConfig = ''
@@ -50,6 +51,9 @@ in {
           - id: rheperire.org_acme_acl
             key: rheperire.org_acme_key
             action: update
+          - id: webdav.141.li_acme_acl
+            key: webdav.141.li_acme_key
+            action: update
           - id: local_acl
             key: local_key
             action: update
@@ -130,7 +134,12 @@ in {
 
           - domain: 141.li
             template: inwx_zone
+            acl: [local_acl, inwx_acl]
             file: ${./zones/li.141.soa}
+          - domain: _acme-challenge.webdav.141.li
+            template: acme_zone
+            acl: [webdav.141.li_acme_acl]
+            file: ${acmeChallengeZonefile "webdav.141.li"}
 
           - domain: kleen.li
             template: inwx_zone
@@ -150,8 +159,8 @@ in {
 
           - domain: rheperire.org
             template: inwx_zone
-            file: ${./zones/org.rheperire.soa}
             acl: [local_acl, inwx_acl]
+            file: ${./zones/org.rheperire.soa}
           - domain: _acme-challenge.rheperire.org
             template: acme_zone
             acl: [rheperire.org_acme_acl]
@@ -165,6 +174,11 @@ in {
         owner = "knot";
         sopsFile = ./keys/rheperire.org_acme.yaml;
       };
+      "webdav.141.li_acme_key.yaml" = {
+        format = "binary";
+        owner = "knot";
+        sopsFile = ./keys/webdav.141.li_acme.yaml;
+      };
       "knot_local_key.yaml" = {
         format = "binary";
         owner = "knot";
diff --git a/hosts/surtr/dns/keys/webdav.141.li_acme.yaml b/hosts/surtr/dns/keys/webdav.141.li_acme.yaml
new file mode 100644
index 00000000..b0f05df6
--- /dev/null
+++ b/hosts/surtr/dns/keys/webdav.141.li_acme.yaml
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:WNZ6BAzz5b0mnr2XqVQM82NFuQJz3bBK76DmnA/xvFPLvAmN4tCDzcu4NrdihcpQZ9J5ZiiIynJH1RBB/hd9ut+e/ByHv954XW3o/Ml5gb1Nl6zkCSAb3uxnjTlf5dm9ROWzx+NBLvIt8DELMYuV/NRtRq6w3ZCWbEp/I3N/r/VPhIw7PkagI9QWNkXp0l2qBml/xwxO2HnZxE7WXtphpOfNZtBuWPF49gO2UeVHrsAfxVgtGNmY9IjBExSQDThDJmo8nFUvrLVydQ==,iv:MQHy1Hi2kASjm684tL3JT5xcdc4mrTWjJWCB4adl1Uk=,tag:IzUtLbMoeRu/Km7o3RTxbg==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": null,
+                "lastmodified": "2022-02-22T12:22:44Z",
+                "mac": "ENC[AES256_GCM,data:tGfEoG8C+zqkBRtfaCNrmuR6dG8kmaRexM6szkSmOsFVgzl3wGsPmVai4rFhgXsozOmt2Lchc01uRqERA+HIkkaMFdVDLWzMEGytEeE1s1JYCVNEc/RmjgeKqxwHuAv5cFGn8ZNZ9JKMF566wUFjjWM/AQffNYCdtSni8tV6eWg=,iv:qoyig97CBgl9X9Z6qbKunu8fvbiiW4uRtErM8nrb9MM=,tag:zFuAbP7ZsEgKGDOo9ACmrw==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2022-02-22T12:22:44Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAEvqLWBZvD3I4xE6W7MKPD9eDGyKa3hpXracLRTHT4hYw\nqy+itvTL207VL0fU8Ve+rmxFjEaMvowFgwWk7+p98thgtbCcUNTxIF4gH2HjSOWS\n0l4Bb3G2vvDhUv1i0AR5WohSdfi5eyQjvt8HqJQ/0hBBwIL4IEcWjpBE+rX/460S\n4gigrXHpgSKZ/i/Aselm6XZhB0jNUf3pZ3pnCQPJpyrLGnFXwCSqB6EaREKU+6BK\n=dSPd\n-----END PGP MESSAGE-----\n",
+                                "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8"
+                        },
+                        {
+                                "created_at": "2022-02-22T12:22:44Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAWXk1C46X8TTkWhHfTMhgo1KnKlCl8A8lzsAo7mqnpzcw\ncoae53lNWGeoCSfOl5E2oSVCgZzEu5R9kC9aLRJgDushXZ56XtTUUF4ggCHogJqE\n0l4B942HOIlWHSlbfOs1/0R5QPnXC1OQ0E6XEVJmBgnUNB3EG473eCTJeabwlaq8\nNgFlL09go4ISjnlKDIgfQZGI9u1j0PyDJ3MtQTnb2j8kzfbcsGcpSLQRn7kzSsjO\n=x5xi\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.1"
+        }
+}
\ No newline at end of file
diff --git a/hosts/surtr/dns/zones/li.141.soa b/hosts/surtr/dns/zones/li.141.soa
index 8c357b35..fbff1cad 100644
--- a/hosts/surtr/dns/zones/li.141.soa
+++ b/hosts/surtr/dns/zones/li.141.soa
@@ -1,7 +1,7 @@
 $ORIGIN 141.li.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. root.yggdrasil.li. (
-  2022022102 ; serial
+  2022022200 ; serial
   10800      ; refresh
   3600       ; retry
   604800     ; expire
@@ -31,6 +31,7 @@ surtr                   IN      MX      0 ymir.yggdrasil.li
 surtr                   IN      TXT     "v=spf1 redirect=yggdrasil.li"
 
 webdav                  IN      CNAME   surtr.yggdrasil.li.
+_acme-challenge.webdav  IN      NS      ns.yggdrasil.li.
 
 ymir                    IN      A       188.68.51.254
 ymir                    IN      AAAA    2a03:4000:6:d004::