From a7255ba16633d70c22e8bed75ae52c49f08e1c18 Mon Sep 17 00:00:00 2001 From: Gregor Kleen Date: Tue, 22 Feb 2022 15:48:59 +0100 Subject: surtr: dns/tls: rfc2136 --- hosts/surtr/dns/Gupfile | 2 + hosts/surtr/dns/default.nix | 137 +++++++++++------------ hosts/surtr/dns/key.gup | 6 + hosts/surtr/dns/keys/141.li_acme.yaml | 26 +++++ hosts/surtr/dns/keys/dirty-haskell.org_acme.yaml | 26 +++++ hosts/surtr/dns/keys/kleen.li_acme.yaml | 26 +++++ hosts/surtr/dns/keys/knot_local.yaml | 26 +++++ hosts/surtr/dns/keys/local_key.yaml | 26 ----- hosts/surtr/dns/keys/nights.email_acme.yaml | 26 +++++ hosts/surtr/dns/keys/praseodym.org_acme.yaml | 26 +++++ hosts/surtr/dns/keys/xmpp.li_acme.yaml | 26 +++++ hosts/surtr/dns/keys/yggdrasil.li_acme.yaml | 26 +++++ hosts/surtr/dns/zones/email.nights.soa | 4 +- hosts/surtr/dns/zones/li.141.soa | 4 +- hosts/surtr/dns/zones/li.kleen.soa | 4 +- hosts/surtr/dns/zones/li.xmpp.soa | 4 +- hosts/surtr/dns/zones/li.yggdrasil.soa | 4 +- hosts/surtr/dns/zones/org.dirty-haskell.soa | 4 +- hosts/surtr/dns/zones/org.praseodym.soa | 4 +- hosts/surtr/tls/Gupfile | 2 + hosts/surtr/tls/default.nix | 51 +-------- hosts/surtr/tls/tsig_key.gup | 6 + hosts/surtr/tls/tsig_keys/141.li | 26 +++++ hosts/surtr/tls/tsig_keys/dirty-haskell.org | 26 +++++ hosts/surtr/tls/tsig_keys/kleen.li | 26 +++++ hosts/surtr/tls/tsig_keys/nights.email | 26 +++++ hosts/surtr/tls/tsig_keys/praseodym.org | 26 +++++ hosts/surtr/tls/tsig_keys/xmpp.li | 26 +++++ hosts/surtr/tls/tsig_keys/yggdrasil.li | 26 +++++ 29 files changed, 492 insertions(+), 156 deletions(-) create mode 100644 hosts/surtr/dns/Gupfile create mode 100644 hosts/surtr/dns/key.gup create mode 100644 hosts/surtr/dns/keys/141.li_acme.yaml create mode 100644 hosts/surtr/dns/keys/dirty-haskell.org_acme.yaml create mode 100644 hosts/surtr/dns/keys/kleen.li_acme.yaml create mode 100644 hosts/surtr/dns/keys/knot_local.yaml delete mode 100644 hosts/surtr/dns/keys/local_key.yaml create mode 100644 hosts/surtr/dns/keys/nights.email_acme.yaml create mode 100644 hosts/surtr/dns/keys/praseodym.org_acme.yaml create mode 100644 hosts/surtr/dns/keys/xmpp.li_acme.yaml create mode 100644 hosts/surtr/dns/keys/yggdrasil.li_acme.yaml create mode 100644 hosts/surtr/tls/Gupfile create mode 100644 hosts/surtr/tls/tsig_key.gup create mode 100644 hosts/surtr/tls/tsig_keys/141.li create mode 100644 hosts/surtr/tls/tsig_keys/dirty-haskell.org create mode 100644 hosts/surtr/tls/tsig_keys/kleen.li create mode 100644 hosts/surtr/tls/tsig_keys/nights.email create mode 100644 hosts/surtr/tls/tsig_keys/praseodym.org create mode 100644 hosts/surtr/tls/tsig_keys/xmpp.li create mode 100644 hosts/surtr/tls/tsig_keys/yggdrasil.li (limited to 'hosts/surtr') diff --git a/hosts/surtr/dns/Gupfile b/hosts/surtr/dns/Gupfile new file mode 100644 index 00000000..ac96f620 --- /dev/null +++ b/hosts/surtr/dns/Gupfile @@ -0,0 +1,2 @@ +key.gup: + keys/*.yaml \ No newline at end of file diff --git a/hosts/surtr/dns/default.nix b/hosts/surtr/dns/default.nix index 5d55c815..57146d67 100644 --- a/hosts/surtr/dns/default.nix +++ b/hosts/surtr/dns/default.nix @@ -3,15 +3,38 @@ with lib; let - acmeChallengeZonefile = domain: let - reverseDomain = concatStringsSep "." (reverseList (["_acme-challenge"] ++ splitString "." domain)); - in pkgs.writeText "${reverseDomain}.zone" '' + reverseDomain = domain: concatStringsSep "." (reverseList (splitString "." domain)); + + acmeChallengeZonefile = domain: pkgs.writeText "${reverseDomain "_acme-challenge.${domain}"}.soa" '' $ORIGIN _acme-challenge.${domain}. $TTL 3600 @ IN SOA ns.yggdrasil.li. root.yggdrasil.li. 2022022103 10800 3600 604800 30 IN NS ns.yggdrasil.li. ''; + + knotKeys = let + dir = ./keys; + toKeyInfo = name: v: + if v == "regular" || v == "symlink" + then { path = dir + "/${name}"; inherit name; } + else null; + in filter (v: v != null) (mapAttrsToList toKeyInfo (builtins.readDir dir)); + + indentString = indentation: str: concatMapStringsSep "\n" (str: " ${str}") (splitString "\n" (removeSuffix "\n" str)); + + mkZone = {domain, path ? (./zones + "/${reverseDomain domain}.soa"), acmeDomains ? [domain]}: indentString " " '' + - domain: ${domain} + template: inwx_zone + ${optionalString (acmeDomains != []) "acl: [local_acl, inwx_acl]"} + file: ${path} + ${concatMapStringsSep "\n" (acmeDomain: '' + - domain: _acme-challenge.${acmeDomain} + template: acme_zone + acl: [${assert (config.sops.secrets ? "${acmeDomain}_acme.yaml"); "${acmeDomain}_acme_acl"}] + file: ${acmeChallengeZonefile acmeDomain} + '') acmeDomains} + ''; in { config = { fileSystems."/var/lib/knot" = @@ -23,11 +46,7 @@ in { services.knot = { enable = true; - keyFiles = [ - config.sops.secrets."rheperire.org_acme_key.yaml".path - config.sops.secrets."webdav.141.li_acme_key.yaml".path - config.sops.secrets."knot_local_key.yaml".path - ]; + keyFiles = map ({name, ...}: config.sops.secrets.${name}.path) knotKeys; extraConfig = '' server: listen: 127.0.0.1@53 @@ -48,16 +67,23 @@ in { - id: inwx_acl address: 185.181.104.96 action: transfer - - id: rheperire.org_acme_acl - key: rheperire.org_acme_key - action: update - - id: webdav.141.li_acme_acl - key: webdav.141.li_acme_key - action: update - id: local_acl key: local_key action: update update-type: DS + ${let + toACMEACL = { name, ... }: + if hasSuffix "_acme.yaml" name + then + let + base = removeSuffix ".yaml" name; + in indentString " " '' + - id: ${base}_acl + key: ${base}_key + action: update + '' + else null; + in concatStringsSep "\n" (filter (v: v != null) (map toACMEACL knotKeys))} mod-rrl: - id: default @@ -124,68 +150,33 @@ in { dnssec-policy: ed25519_local-push zone: - - domain: yggdrasil.li - template: inwx_zone - file: ${./zones/li.yggdrasil.soa} - - - domain: nights.email - template: inwx_zone - file: ${./zones/email.nights.soa} - - - domain: 141.li - template: inwx_zone - acl: [local_acl, inwx_acl] - file: ${./zones/li.141.soa} - - domain: _acme-challenge.webdav.141.li - template: acme_zone - acl: [webdav.141.li_acme_acl] - file: ${acmeChallengeZonefile "webdav.141.li"} - - - domain: kleen.li - template: inwx_zone - file: ${./zones/li.kleen.soa} - - - domain: xmpp.li - template: inwx_zone - file: ${./zones/li.xmpp.soa} - - - domain: dirty-haskell.org - template: inwx_zone - file: ${./zones/org.dirty-haskell.soa} - - - domain: praseodym.org - template: inwx_zone - file: ${./zones/org.praseodym.soa} - - - domain: rheperire.org - template: inwx_zone - acl: [local_acl, inwx_acl] - file: ${./zones/org.rheperire.soa} - - domain: _acme-challenge.rheperire.org - template: acme_zone - acl: [rheperire.org_acme_acl] - file: ${acmeChallengeZonefile "rheperire.org"} + ${concatMapStringsSep "\n" mkZone [ + { domain = "yggdrasil.li"; + } + { domain = "nights.email"; + } + { domain = "141.li"; + acmeDomains = ["webdav.141.li" "141.li"]; + } + { domain = "kleen.li"; + } + { domain = "xmpp.li"; + } + { domain = "dirty-haskell.org"; + } + { domain = "praseodym.org"; + } + { domain = "rheperire.org"; + } + ]} ''; }; - sops.secrets = { - "rheperire.org_acme_key.yaml" = { - format = "binary"; - owner = "knot"; - sopsFile = ./keys/rheperire.org_acme.yaml; - }; - "webdav.141.li_acme_key.yaml" = { - format = "binary"; - owner = "knot"; - sopsFile = ./keys/webdav.141.li_acme.yaml; - }; - "knot_local_key.yaml" = { - format = "binary"; - owner = "knot"; - sopsFile = ./keys/local_key.yaml; - }; - }; - + sops.secrets = listToAttrs (map ({name, path}: nameValuePair name { + format = "binary"; + owner = "knot"; + sopsFile = path; + }) knotKeys); fileSystems."/var/lib/unbound" = { device = "surtr/local/var-lib-unbound"; diff --git a/hosts/surtr/dns/key.gup b/hosts/surtr/dns/key.gup new file mode 100644 index 00000000..32d4f7d6 --- /dev/null +++ b/hosts/surtr/dns/key.gup @@ -0,0 +1,6 @@ +#!/usr/bin/env zsh + +keyName=${${2:t}%.yaml}_key + +keymgr -t ${keyName} > $1 +sops -p '7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8,30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51' --input-type=binary --output-type=binary -e -i $1 \ No newline at end of file diff --git a/hosts/surtr/dns/keys/141.li_acme.yaml b/hosts/surtr/dns/keys/141.li_acme.yaml new file mode 100644 index 00000000..77fbc4b2 --- /dev/null +++ b/hosts/surtr/dns/keys/141.li_acme.yaml @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:2y3A/KCH2X8T/g9gVhNQuAHvorebyKnfAZc+kJE5hL06l7xieJsxpj7DBbWjh5y7Ae2fBNMFA1tU9Ig6S3qvjzxlCNQWSpq05GBTiU2AdUDWwn52gztEvNLEpFsdUDyUYZSPLy82dFckyegWuoBQbGe6vOPdXyM4aPCIuj3fp18A6cNSRp4YyERL/JoveLRQYFJUpV5Xr9JyNHj/4hDfikJJMG1OeKqCyeK5BTs6XbLN+70UO7R+orlh2F0=,iv:04N7t7lf0CG6Qbj3VqHmL9l+hl4PK6vahEHq8qJmjOs=,tag:x4H/oiDjvE/NzMKSeMO2NQ==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": null, + "lastmodified": "2022-02-22T14:12:08Z", + "mac": "ENC[AES256_GCM,data:At6rzhjC4EbtTjMaw44WKYNuT2XRniZpDAXGskxi9HW/xIQFghcWlgzXaddev5BUMkitz93gFCFD02YJOzOC12GXjDksoHGtvHKbxmodIgHTbhkXFYLe1JoFPrF14NsiIOmmoqcbrn03+iinNehkbJ2wXEkGyev4IMacQGqV7q0=,iv:7j26jeRvgBrnJRVHYay+3wug+IjOIpjFWLiccXD6Z8A=,tag:esnZH7MLQnqkxNVPdwmx8Q==,type:str]", + "pgp": [ + { + "created_at": "2022-02-22T14:12:08Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAvU6MNSb8ky78bJfnRRx14o4rA7Ezylbtc6cFUG+eGAow\nPvRGLI3qm36sDYXo6OHKS9A5DTxIQlQHQqj9U4CHGU/w4X8pCN2ulHkAh767DXV9\n0l4BHa/JTXNklF78vY3zUkySrIueA0QZXvmda2pcd3mO3M78J7812X9jCZ8LwrXz\nR3Wp77iQXW/0Tq83DMEkFwYmueFfZsCtRxQBL5f4NlyuLZizDb2s8YZzeRICz5w3\n=X6zh\n-----END PGP MESSAGE-----\n", + "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8" + }, + { + "created_at": "2022-02-22T14:12:08Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAIbKybblH4bBEhKyup4r+KzKdHLZhBmR79o5A2DdD1mAw\n4KVInlvs+LAFksp1oCqSLd3r1foM3/QOrDdB1ExwTXrxlTgk/qM9eTXT4gIdXwt3\n0l4B5rqrDzCwp3DE2dC+UuBFB9g9YtF77xpfOFfcGLB3fKsPYEvrK6MwGMJqUtoI\nq19d8Cf/mir0mlYHBN+Vez/8jFi0HmrLlphhf4m0l0/6XNLdRbuSpb5T20ecJM2L\n=nRup\n-----END PGP MESSAGE-----\n", + "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.7.1" + } +} \ No newline at end of file diff --git a/hosts/surtr/dns/keys/dirty-haskell.org_acme.yaml b/hosts/surtr/dns/keys/dirty-haskell.org_acme.yaml new file mode 100644 index 00000000..0037910f --- /dev/null +++ b/hosts/surtr/dns/keys/dirty-haskell.org_acme.yaml @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:Jxsg5dW3bhJKRHvigf9F5xkp+KdOd8OKibc1rKrqzwUPZcdebpzijFQMA5hRHwTJKdoqmk/aWosmqfBgmrUr9lrDQH2g1IzLoLYxLc8ssUuH9T4lLDMkSRa3PjL0jpW5ezDSb2omhE4EAJvRZF2nn1VC/IhKNCpY4oI/bLCt6unPiVYMi1ot+9JAl+9eRJS5UIYWp1DC/0oi8Uv6Ci3VwLmOFg1I/YcvXDkNdi0QpcGH3Ok241/O0HiOSboOfqCIwTy5v4P+Poko3dl9t3SkZK65,iv:HC+PzqqLgLWGijHYDC6MvIaB8T/sI1c6vTCf10DApFg=,tag:75fmY73TKw6bNz/xJp8q0A==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": null, + "lastmodified": "2022-02-22T14:20:35Z", + "mac": "ENC[AES256_GCM,data:pbKzZIor1lRxI20O4yi+h2Vk6yOL1MtTstx5A4Byul06uZiGMrNMFyBaVvGbb8evch9ptYm4TNiWZ3T8xHYTwy4HGV5HgOOqY2vJNwTSJ6Yi0F34UCQMIPnXHT/sqL+T1/etV5zY1eQhH6L7lXPtIh7TiYhV8o5y7tpSwhq2RUY=,iv:ZYhhncJv4AOkKDon/DIAYJUgDN4C/iVyukMDaqzu3k8=,tag:v2U/hTaRxk47UG+E6D4ExQ==,type:str]", + "pgp": [ + { + "created_at": "2022-02-22T14:20:35Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdA/I9pk6iikcFckUsUigf3MJSL1JN6HHUIG/PKeOoEMx4w\n6MoYrjveZeXJbQLJHEVwkanElOfmb7jNFfDQntu6VIEwxvb2vdFDY43JgX6SAuLf\n0l4BvsQcSIPm/3jZu14kLjZgK/S6wrQKbUmymLVQSADwYP2sq+u710bYnRk/QxGG\nRwo82yKyBAZ+EK4DWxB6VtAry8LBYlKY8uhJ17f1/95tc+GeuHEEqzcllz+le67l\n=AxIv\n-----END PGP MESSAGE-----\n", + "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8" + }, + { + "created_at": "2022-02-22T14:20:35Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdACQne60rRG40kMku2GFVQhsrpa3RLAgjJGt2oPKrkgQ0w\nVWHpGyfpg0urSkS7+qecfhqeKAkaQ6CF2F6w2fCgn6Xdw28vs4pro1lHWhwYD+XT\n0l4BtxoVpKHysoL4qO9dQLjwAjHAcYnMPaNONIQMvU8DNrJ9ZiHkzJZPNQOeYL97\nEJCWUkR7V0OP8syMIKy37ii3l2aJd58w1DUd90BwvBrv5JBbNxIPalhZKULWI96U\n=dovS\n-----END PGP MESSAGE-----\n", + "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.7.1" + } +} \ No newline at end of file diff --git a/hosts/surtr/dns/keys/kleen.li_acme.yaml b/hosts/surtr/dns/keys/kleen.li_acme.yaml new file mode 100644 index 00000000..18122f48 --- /dev/null +++ b/hosts/surtr/dns/keys/kleen.li_acme.yaml @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:ClN4TVWJoCYh6Rl/Vp+x+jPlIDkkz9SV7qzLBenjPDviIzkBqGmNwySsV5Dy/uxbrmNkc+C4sYkv+5H+3O7R1fWwTDlZuiWpd+lAJrco9f8CjyZku2RQi1UfP31z+/nAKo4wSy22++UfLmYR5NGWWB6pbfm/KL27vC75RNOvPZXhOBxxl5imObdY6i3cJ7A5e9PsbR7qZq+gFBtq7IisSHD1sDvpiOAcstKo8ITsZ5bXCYmrFiJ41LJNSINN+/mE,iv:a/T6pQGuDW3qBzr2y0GrPyeoMRlCI0VvKUZJQFGYTew=,tag:2rL3o/L+xYAsP/vWbWFsOw==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": null, + "lastmodified": "2022-02-22T14:43:57Z", + "mac": "ENC[AES256_GCM,data:KGOS17/BCjGbzBXOAJav9aAs1d0ymAISoAu14nGCVdxLrhySM+sRgoo7XO3kG5xCfIn7dJGMhC5vIyLoHLl7il0FuSjhFztr1AvSAvmb09CaQksj/KTSXk3N+Tp2++Lvn8xPtNGcYTu/pK+0WLC2jt52KcbsXTVRSMtZO59+ekg=,iv:l2tcVM8c1HkJ5W4rc8ZPffx5fzAKcn7IjgjU3zxSpdE=,tag:KRabrd9nNhqmN/2YtzzPig==,type:str]", + "pgp": [ + { + "created_at": "2022-02-22T14:43:57Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAyCmRdezTNHo04OWMJRfeOfkNwA8iN5ORlR4MSnxHvi8w\n5qxpEl+NtPyGunAOm58zc6Ai8+2yuXsCGoTVDar5jL1poNgYMecwCHkMopYBOreC\n0l4BcGGs4AkKTzqEU/tBe4YKqp/6QBZ3N0giPeGWedA248Vnz9Lq9eHynhCkCB1O\n8y0wUf6159s+00MEaMlAHODPKetBTve2xa8W+6OvQqIYSxaaTJ01cI9n1deYSa1e\n=ke67\n-----END PGP MESSAGE-----\n", + "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8" + }, + { + "created_at": "2022-02-22T14:43:57Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAPlaZrCGl5FDZ3v+RG62I/FfyPA+qTepdegSTFo6m+lgw\nyEacJxkCO28hMsFgHhLXRveP7tKrWt7WAi91rU8j1LFrTLGV6PogA+jLGbAJeBQI\n0l4B8UDf/vNK7d1cWeScOO7a4HPsJ9jQDxEk3JB1c5funVqbK3h8HUMmbtbBABXF\n9ga0Ra4UC9s3pLUz8ykMQ5C/GCCd446HDHLbi9daXVTTGMnlkXhSgyA7VvCWUjnL\n=mwTD\n-----END PGP MESSAGE-----\n", + "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.7.1" + } +} \ No newline at end of file diff --git a/hosts/surtr/dns/keys/knot_local.yaml b/hosts/surtr/dns/keys/knot_local.yaml new file mode 100644 index 00000000..a170ff72 --- /dev/null +++ b/hosts/surtr/dns/keys/knot_local.yaml @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:kSTzSFxJhKHPlAfdDT04v88yha8cIagAZZ3hJKqKrfB5tHi5Ek2Yzz/qndvjyBHb3B2PbbeVOUGuNXdZziJYpT0rdwK9vTGnxkaZS1cw0jKf9p/CLRAi3bDgCUti4oPjtQDh5Jj8gDokRs3u6SthaBcz2tZOqDyjKfWWzGlIMtRfSnx7KjgX2Anrhf2/B7vr2Van9XhMTTFiacLpYjZUXeo7v6ZOb49G2b+XxzxrYrY=,iv:b5DeWUu+BpvxhYrKBxpr6m+Ivz+1oLPY5sTZYq6GsJA=,tag:Tvb6w/8Qbro3I7MZ97HKlA==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": null, + "lastmodified": "2022-02-22T10:29:34Z", + "mac": "ENC[AES256_GCM,data:wBzMMSuaNfITvC42rOCWznMCATwjLrz66h+0QURoJONGw/GMVejkdQ+F9s0UFz7PyVKPAxWgSC4Km+ve9nX2c+f1lGyo4YpWDYKtVlZuUd7/Alf1ctl4epZLZihZVc0XLRNgH/Th7D4c+7WyHi8XT1l/AHmbixG4Jxwh8/b0TIY=,iv:vTs3qIMHLIt39RSze3YRkJUkuOUganvtIs90qsXekcc=,tag:EaVQq7DyPvM1CufOtrFDsw==,type:str]", + "pgp": [ + { + "created_at": "2022-02-22T10:29:34Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAqtTjcOaobAeRPtdIlgNBWcHMyJjWoeDdXI/s/Um0lX4w\nIe0pVT/t8t5vakDey0Mu6uTZOM64UKFyH2mTJCOWtbf96tI1ML+03bJGrKNTKEKU\n0l4BTRKRJwKrnjST0/NBc6YwBYfBeKoStoh60aBm072JlWS5/SprDysqMa9xpSxy\npz9HuF5g3/slPaeohUCh8457LtdQgLzZDBbpOWHwpU55Oix+518qAEZ5AspdnHHe\n=8Y8Z\n-----END PGP MESSAGE-----\n", + "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8" + }, + { + "created_at": "2022-02-22T10:29:34Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAk0ne1fjj2mV1P+4GDfDE/1SuyvWJ6sqKjkfYgdneNEIw\ns1qLAQzboXcMm073fV/XiegSP4AVL5sa6TOy+ajHGedOk2AkTBa9dYj0QJLJAxxW\n0l4BJdS01hYhj51x2CjAMan37oDZaoNr1Z9V6SPxfnLIs74kPZuAWT9U5YvoD8bj\nwEPGgvJOHPSQbmKpRXsd7MIHxRAe2PEsTGujd6CEv+ZAfjG95EpW5P6Aie73ZZE+\n=1kB3\n-----END PGP MESSAGE-----\n", + "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.7.1" + } +} \ No newline at end of file diff --git a/hosts/surtr/dns/keys/local_key.yaml b/hosts/surtr/dns/keys/local_key.yaml deleted file mode 100644 index a170ff72..00000000 --- a/hosts/surtr/dns/keys/local_key.yaml +++ /dev/null @@ -1,26 +0,0 @@ -{ - "data": "ENC[AES256_GCM,data:kSTzSFxJhKHPlAfdDT04v88yha8cIagAZZ3hJKqKrfB5tHi5Ek2Yzz/qndvjyBHb3B2PbbeVOUGuNXdZziJYpT0rdwK9vTGnxkaZS1cw0jKf9p/CLRAi3bDgCUti4oPjtQDh5Jj8gDokRs3u6SthaBcz2tZOqDyjKfWWzGlIMtRfSnx7KjgX2Anrhf2/B7vr2Van9XhMTTFiacLpYjZUXeo7v6ZOb49G2b+XxzxrYrY=,iv:b5DeWUu+BpvxhYrKBxpr6m+Ivz+1oLPY5sTZYq6GsJA=,tag:Tvb6w/8Qbro3I7MZ97HKlA==,type:str]", - "sops": { - "kms": null, - "gcp_kms": null, - "azure_kv": null, - "hc_vault": null, - "age": null, - "lastmodified": "2022-02-22T10:29:34Z", - "mac": "ENC[AES256_GCM,data:wBzMMSuaNfITvC42rOCWznMCATwjLrz66h+0QURoJONGw/GMVejkdQ+F9s0UFz7PyVKPAxWgSC4Km+ve9nX2c+f1lGyo4YpWDYKtVlZuUd7/Alf1ctl4epZLZihZVc0XLRNgH/Th7D4c+7WyHi8XT1l/AHmbixG4Jxwh8/b0TIY=,iv:vTs3qIMHLIt39RSze3YRkJUkuOUganvtIs90qsXekcc=,tag:EaVQq7DyPvM1CufOtrFDsw==,type:str]", - "pgp": [ - { - "created_at": "2022-02-22T10:29:34Z", - "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAqtTjcOaobAeRPtdIlgNBWcHMyJjWoeDdXI/s/Um0lX4w\nIe0pVT/t8t5vakDey0Mu6uTZOM64UKFyH2mTJCOWtbf96tI1ML+03bJGrKNTKEKU\n0l4BTRKRJwKrnjST0/NBc6YwBYfBeKoStoh60aBm072JlWS5/SprDysqMa9xpSxy\npz9HuF5g3/slPaeohUCh8457LtdQgLzZDBbpOWHwpU55Oix+518qAEZ5AspdnHHe\n=8Y8Z\n-----END PGP MESSAGE-----\n", - "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8" - }, - { - "created_at": "2022-02-22T10:29:34Z", - "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAk0ne1fjj2mV1P+4GDfDE/1SuyvWJ6sqKjkfYgdneNEIw\ns1qLAQzboXcMm073fV/XiegSP4AVL5sa6TOy+ajHGedOk2AkTBa9dYj0QJLJAxxW\n0l4BJdS01hYhj51x2CjAMan37oDZaoNr1Z9V6SPxfnLIs74kPZuAWT9U5YvoD8bj\nwEPGgvJOHPSQbmKpRXsd7MIHxRAe2PEsTGujd6CEv+ZAfjG95EpW5P6Aie73ZZE+\n=1kB3\n-----END PGP MESSAGE-----\n", - "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51" - } - ], - "unencrypted_suffix": "_unencrypted", - "version": "3.7.1" - } -} \ No newline at end of file diff --git a/hosts/surtr/dns/keys/nights.email_acme.yaml b/hosts/surtr/dns/keys/nights.email_acme.yaml new file mode 100644 index 00000000..5bf19aa9 --- /dev/null +++ b/hosts/surtr/dns/keys/nights.email_acme.yaml @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:HAAFVb+g52gyAhYLsuqsVI4rPyl+jRTGm41Pf+AOykWK9cythHSTiUeCJGKQMvmSqjsCFqwswJWaFwz9qbSzGcrcI3CVLpjbi++x9sv5xhV+bSX9ROqpNSOtgHp08irgCST+rFXtwj7VX3SYZnV8NyEPzyk8ztPBZpn0VHIt7tS+t/oT7GHqhe0c4Ct8FXVzEkfBC28CQdJaJw4m1ZSE00Lm/sFj0On2y2BZfMhq4a3SnE1ktZNVHyBbCdVrMs83Zjq09DBSLDo=,iv:iRR3JPrl0sGij4WUNRaFna9ijKfeIPZusAiCYuS/faw=,tag:+txhhwlBbzncdUhRd0b2Ew==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": null, + "lastmodified": "2022-02-22T14:44:08Z", + "mac": "ENC[AES256_GCM,data:zsV4ZC/+H0d5EVRsGy7niGAXjhw9iEJ2IIT3ED8OaYd/TNDu/pCyCH5YvSnCGfi8/d4caaCUhUUKMCz8SG46lmvVPqHz516MfS2/lp21py8LhGuHReeAa6/xFrbBDmuECiY7RHv8tm8VnwQHOlZNFUpCIJufeZQUoAcYPXW+L7s=,iv:1wq8YlBhnzV6fofpA1QfX4mDcxJyzQUv+HphyjsvzcA=,tag:CEZIlqv0VfyKkFLxH3VK+A==,type:str]", + "pgp": [ + { + "created_at": "2022-02-22T14:44:08Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdA4RV9j0rSlCLozIMcNjo3GokziWshqVqu1WWuPDPpimMw\nZs/OH5ejj7cLMl/BddTZ8AAUrjAskRj3aqwYAt+BBc8dZYFVcuRuZzSGGSkMy6VN\n0l4BCBTyyU21D0uv6EEzqG4yiiOfs5JZmny3B7wMc0qh1vK4qClF4IUPmEvEpGuR\nTBOICnfuenUaDktMHixqgXFKx7SSF+8Qs0anlSP6OG8s2G82I2f2cN7lozdgGppG\n=WZxx\n-----END PGP MESSAGE-----\n", + "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8" + }, + { + "created_at": "2022-02-22T14:44:08Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAAgoEDDUeIWqxm64kZ3DLaki5V5MFF3c7Kl/TbbmoKSww\nlZyHJtSACTrwfGBMAN+1NSKkTLTlE/q2FN7CtjfTyAWC0JLU9r3u5FVpQAXbBlht\n0l4BN8jltnkwlgw/CkKoq9rDHxfavDjfNBuSp4+8gzHj5XAvrKZKRWu0/T9LCr2A\nEon5f4kkjm99fiZVbojhjMM9drUrpaiofzMGvZeYgESRSmhTeLa1Qu6u7wb9ARkl\n=fqR3\n-----END PGP MESSAGE-----\n", + "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.7.1" + } +} \ No newline at end of file diff --git a/hosts/surtr/dns/keys/praseodym.org_acme.yaml b/hosts/surtr/dns/keys/praseodym.org_acme.yaml new file mode 100644 index 00000000..ab0000c9 --- /dev/null +++ b/hosts/surtr/dns/keys/praseodym.org_acme.yaml @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:c2hvYDv13AuxudKvGtbSYngACzJroxw9P98N/a8p9wB3K98vPY60JTVMxZkPQTbJGGCbi+FfqnezVSHNiSYtrD7RMeoh+BbOXfrWCkPUQ8vKP0P0F6CO3K3orFSckeSgi/NrkO9OD+8m2y19QGkgxd+BNs8KjCSYWruyt3kCuDvDN26vQY9AWD6HcPr/trDEY5uepQwjJFL4mT9JGGB5/B7G0d6VA61soJxVTdxp8oCzRGcSjaVoPlr77A8GDOJfFYviVfniLqZc6Q==,iv:MqhPxouSV5nQWXptSlINyW+AB5pwUVnSFT6R0+VZO0c=,tag:4p0wypyqWRk+ussoi9OXPw==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": null, + "lastmodified": "2022-02-22T14:43:36Z", + "mac": "ENC[AES256_GCM,data:YqS+uQXyBP0BMdz9R/SxjidSo7pVUFW78M8cPX6z55+j1gGKfDhEwQMUNZaGly1bvoma+a63NjUi4O4iEYR46fC3PUsVaf8S3Uqk0KYWIedDr9XqAxPBnb6wWFrNo4wwgq2mhaIitziK1QC6pdAgS/iNlGNNbCCbYmjzMLzQc8Q=,iv:BraowcHMeSQfImK1sONbefGIn2VWVGzLBBFLDwYGf10=,tag:oXvnGalny9kvvQpKMx8OcA==,type:str]", + "pgp": [ + { + "created_at": "2022-02-22T14:43:36Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAWVg759WL5YeSVLnx4g7PlD0DKo1+zBiZUOgnf9RHnl4w\n5wLTfTaYvXhd8j8y359dbvDER4r9isbpBfVZP+MGP4d3FdLgJCKm5WV6K5ES0bFN\n0l4BUX/KQeh0t/Phy2GZkmFyKu+3nr5Jl+veKIWJLZEfUCILX8c+X3e/4bZr8++n\nR2u5ZrFBENtaGxIdUpkxemQhGtd7BGtXyy/aCjRKY3MbCj4pmnAyushPaMC1+igp\n=LMQ4\n-----END PGP MESSAGE-----\n", + "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8" + }, + { + "created_at": "2022-02-22T14:43:36Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAxpKmbaTfh5aDBOZWebVK/eA3T5sxS5fbW+cE/I54zF0w\ne0QDeamgTVrMQaDH1zCqoJcFNNkWnTErQVaOMSDBlwuFQ7KaoghONl8qCbY60MuI\n0l4Bt++Iu5e3bOLOkdl+RugclmGHpdpHAuJxbcnw88BKV/gYX1ntNEGgMHGcOl4R\nC8JjHYFdOtohPAUEbWf1ogkllwxxkCttWGFa01hL6W+ogJxGFhRcOm/zcjBE/3Vm\n=MKMA\n-----END PGP MESSAGE-----\n", + "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.7.1" + } +} \ No newline at end of file diff --git a/hosts/surtr/dns/keys/xmpp.li_acme.yaml b/hosts/surtr/dns/keys/xmpp.li_acme.yaml new file mode 100644 index 00000000..7d85bd25 --- /dev/null +++ b/hosts/surtr/dns/keys/xmpp.li_acme.yaml @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:kivOcI972j/fbloZCjH+nD9mBnk5s25NA+WDud3Hhfk3C70GhGKQaTHgnNIH11z9Pst4DX4liAvFjCzGP/sUGQuJmEfIHKckAOMrz8m5796fUIAZjrH36/NwB7Ytk2pYKy3lGZgO+CAxDvH/pzxD6WQPoVrgnyM3rjw7rgKLTMr94mp8ui9j4DdIwScwyWhOit8WrivDVwnNOz8GpxI45qogyeYMRESfeka3brzXVJ871nLjhbokcrKsja7Yiw==,iv:HkS/b5YjJ7iS4hYIOl5DACf9g2zoTO7cEIKdocKzWpo=,tag:HFLzoTJu+i6nmT9NNC6NAg==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": null, + "lastmodified": "2022-02-22T14:43:10Z", + "mac": "ENC[AES256_GCM,data:RQ9MBn/V8k41ax6KKlCmtCwlVMBsSzYtsG1zpwIutmuWRb39n2v/1oolW3hRkagSS7Q2Nu03d7L09KntAv77yjFKRYwMI3CFqU1JTsKYmW8c3ggTMS9RXFme+tAk85Wl33QzCnIYgI071tgmnlzct8yimh/oR2XyvMrMXm6IsbI=,iv:I6Dxhv0Up7LVUZ7j7SD3gCsiqsCYh3N0GtMuxnMcctg=,tag:I5OqFU1WPBM/m/6OPpUdow==,type:str]", + "pgp": [ + { + "created_at": "2022-02-22T14:43:10Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdANreqp4K9J56f70slxXnpJfHu5evjcVByLbHVYav0FlMw\n17qsPAAo4F0mj0zatV5EfnfYuNSsXR3j/9YocSHcMvBVzLsYdtV61fVtSrHiLt2a\n0lwBTfysYjor4J5h7G6ew7f1zicup3t9/ZPT2Q5fneRukpKExyM8o2ldjjRW7bq3\nt9kbihbTtB2t6k4iZUQRoYsfBKcM3hHeszv2W0xN9yOa/C5M8mOGNDJi48dEDQ==\n=3MEN\n-----END PGP MESSAGE-----\n", + "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8" + }, + { + "created_at": "2022-02-22T14:43:10Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdARVdKf6ppaqBQnaJ7WhwBPcdnbmjom9aNrXtymThq3TEw\nnjH6Emd1QLBaXGr1Eb7RNzrWkrU1P+n3ihLEvW0easkceRv8T3+xID1E/+6R06JK\n0lwBw53C9ExWPpy8CUGs6HeOK901cRRV6XWErHXF4QVSoqhNXjjJTzUmf+7zxKnR\npCZL0HOykPazHmkZHcKvkGSKoEiDmK/wStQwHoO+pLGbUvbsCX+GMlYV6ySljw==\n=RPEC\n-----END PGP MESSAGE-----\n", + "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.7.1" + } +} \ No newline at end of file diff --git a/hosts/surtr/dns/keys/yggdrasil.li_acme.yaml b/hosts/surtr/dns/keys/yggdrasil.li_acme.yaml new file mode 100644 index 00000000..0eb8f2f4 --- /dev/null +++ b/hosts/surtr/dns/keys/yggdrasil.li_acme.yaml @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:QhWlBM7VZOagGaQICX31aaC69E00xUcVMvusxLLSz4mNy2B0l1Ngp7XGONI5+viq+nq/P9KytxoFybGwxjnxEcu++efsc+BjbKuylzq93rspQOoI/WjRxE/DoZCWQzK/UKWd1x1L3a/1+9IfKswkBEesgWx0Ug/bLlbr7GfQ3cpI6EwRGMba4VzfdmWPYAqAsfJmmOIY/WTShUEVbAmYQuUMhmZ9geWfjHonX42w7G8ICtlPcMc68ApK0nuhgKpzKisfHC/ddg8=,iv:rOePsUqnm0SSxHm4lc4Ikq9tbOnIgunIw3tqeFsEFTs=,tag:ESzqhFRmTUBvZQBzISQ2Qg==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": null, + "lastmodified": "2022-02-22T14:43:23Z", + "mac": "ENC[AES256_GCM,data:g2DNekY/VbytxwTxxIgXH+RldXCab3wtx5cOYriKxC6MDr3/E1A/rZm6nWqRI6lvD/dsmLsYmfvwEpfkTMvSi3/kFJZSr2y0wUBHMsZSs2cqtmZ7i+9YHMLrb//KTbkZHFw/NiH2pra29oFN1vdVrHwMvf0uVazBXyHABSb+DJE=,iv:jc+4u9sgWfBpF4lJtv2T6vxN5xhG/z7Vf3eADI37rKo=,tag:hhaDRwsOgCUoTDHdr8y9DQ==,type:str]", + "pgp": [ + { + "created_at": "2022-02-22T14:43:23Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAzEmCD9ROaiWV0ludmvPP0qGXznkk2J6bQQr0rWCZv2Yw\nF9JbGeiFyqnlPJKDs6rQyIzqmK/1IDjLNJ7KArQaJX5Htua64Iyb1M+Rxc8ugG52\n0l4BPxSJ76HAI0iHLM0UdGRfeyyYuwnShaqM5X4qEQu7Mh7L83s8Ym8a4tJpv+Zq\nGh1Uz7G+MyevcAT4J+bZY5VDyk6rwuMpS4mrzIMl30gkoiorQMyoSmji4ymLJ8NS\n=tRMa\n-----END PGP MESSAGE-----\n", + "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8" + }, + { + "created_at": "2022-02-22T14:43:23Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAmy1AUOAkS9tkTu+GbDAS7SD+cT83CnRYd1O1ZG+eYwcw\nou88Nz3AGUcSa99om+yVY22nvztrIDOmqMih27ArB1Ruqhh4l4cm4mMrt35Jgezv\n0l4BiKZMHk6cwYGDopEfGU9m1l7lWZJofYIJZ8W0WSUtbHBXzZjwh5N7rh6EF2Te\njRJ72f6+/IaVeyhQjZocwQvFr0mfezontWlJb8hTOGBiWt16UPZ2UUgWMNIhepcy\n=AlJs\n-----END PGP MESSAGE-----\n", + "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.7.1" + } +} \ No newline at end of file diff --git a/hosts/surtr/dns/zones/email.nights.soa b/hosts/surtr/dns/zones/email.nights.soa index 0beba77a..84ea61cc 100644 --- a/hosts/surtr/dns/zones/email.nights.soa +++ b/hosts/surtr/dns/zones/email.nights.soa @@ -1,7 +1,7 @@ $ORIGIN nights.email. $TTL 3600 @ IN SOA ns.yggdrasil.li. root.yggdrasil.li. ( - 2022022102 ; serial + 2022022200 ; serial 10800 ; refresh 3600 ; retry 604800 ; expire @@ -25,6 +25,8 @@ $TTL 3600 * IN MX 0 ymir.yggdrasil.li. * IN TXT "v=spf1 redirect=yggdrasil.li" +_acme-challenge IN NS ns.yggdrasil.li. + ymir._domainkey IN TXT ( "v=DKIM1;k=rsa;p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq3cCKlk+VPhyAanLZTM0BCzUT/+fmxHioZcFk0uJk1akBYj7BRofR7eVNcLKpm3rwYMQgE+9vJH9p8SV6tws9EcWc8SMCqqGZlREYM7PmLDiTSK/vjCzkygfgFCb0EBNsY2A/fpP4rTeoxrbcBSvMkq97iY5rwyw4wXZVZXLiDaCj23s8POoxTk1ClqUJZJQ5x2" "qzrC0RfN5kLZ9A7Gq2jB09vNxpXHYqABA0bJv88JiZM7hfkp9IafJZ+yCVMaBcJs4DAxnTjNAuFD9gm+qSFVY8+yeXqL6Qjo5PbruhyZRBW8RgRYT8t5n07XRglMGKKGMwOGLanrltcyXqB+GsDZBD36RAAwjFadnxdpDyRv4SgRP7ff2tKRrORYpmpN+mKdqw5j3J/nP6bXV1oAkyh9XQkPEIDi81WT87EZziTElDzVp6A2qFOxqucAovoRk24" diff --git a/hosts/surtr/dns/zones/li.141.soa b/hosts/surtr/dns/zones/li.141.soa index fbff1cad..9419a4ad 100644 --- a/hosts/surtr/dns/zones/li.141.soa +++ b/hosts/surtr/dns/zones/li.141.soa @@ -1,7 +1,7 @@ $ORIGIN 141.li. $TTL 3600 @ IN SOA ns.yggdrasil.li. root.yggdrasil.li. ( - 2022022200 ; serial + 2022022201 ; serial 10800 ; refresh 3600 ; retry 604800 ; expire @@ -25,6 +25,8 @@ $TTL 3600 * IN MX 0 ymir.yggdrasil.li. * IN TXT "v=spf1 redirect=yggdrasil.li" +_acme-challenge IN NS ns.yggdrasil.li. + surtr IN A 202.61.241.61 surtr IN AAAA 2a03:4000:52:ada:: surtr IN MX 0 ymir.yggdrasil.li diff --git a/hosts/surtr/dns/zones/li.kleen.soa b/hosts/surtr/dns/zones/li.kleen.soa index eb998795..2e6326a4 100644 --- a/hosts/surtr/dns/zones/li.kleen.soa +++ b/hosts/surtr/dns/zones/li.kleen.soa @@ -1,7 +1,7 @@ $ORIGIN kleen.li. $TTL 3600 @ IN SOA ns.yggdrasil.li. root.yggdrasil.li. ( - 2022022102 ; serial + 2022022200 ; serial 10800 ; refresh 3600 ; retry 604800 ; expire @@ -25,6 +25,8 @@ $TTL 3600 * IN MX 0 ymir.yggdrasil.li. * IN TXT "v=spf1 redirect=yggdrasil.li" +_acme-challenge IN NS ns.yggdrasil.li. + ymir._domainkey IN TXT ( "v=DKIM1;k=rsa;p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq3cCKlk+VPhyAanLZTM0BCzUT/+fmxHioZcFk0uJk1akBYj7BRofR7eVNcLKpm3rwYMQgE+9vJH9p8SV6tws9EcWc8SMCqqGZlREYM7PmLDiTSK/vjCzkygfgFCb0EBNsY2A/fpP4rTeoxrbcBSvMkq97iY5rwyw4wXZVZXLiDaCj23s8POoxTk1ClqUJZJQ5x2" "qzrC0RfN5kLZ9A7Gq2jB09vNxpXHYqABA0bJv88JiZM7hfkp9IafJZ+yCVMaBcJs4DAxnTjNAuFD9gm+qSFVY8+yeXqL6Qjo5PbruhyZRBW8RgRYT8t5n07XRglMGKKGMwOGLanrltcyXqB+GsDZBD36RAAwjFadnxdpDyRv4SgRP7ff2tKRrORYpmpN+mKdqw5j3J/nP6bXV1oAkyh9XQkPEIDi81WT87EZziTElDzVp6A2qFOxqucAovoRk24" diff --git a/hosts/surtr/dns/zones/li.xmpp.soa b/hosts/surtr/dns/zones/li.xmpp.soa index 08c38bc4..7a10c957 100644 --- a/hosts/surtr/dns/zones/li.xmpp.soa +++ b/hosts/surtr/dns/zones/li.xmpp.soa @@ -1,7 +1,7 @@ $ORIGIN xmpp.li. $TTL 3600 @ IN SOA ns.yggdrasil.li. root.yggdrasil.li. ( - 2022022102 ; serial + 2022022200 ; serial 10800 ; refresh 3600 ; retry 604800 ; expire @@ -25,6 +25,8 @@ $TTL 3600 * IN MX 0 ymir.yggdrasil.li. * IN TXT "v=spf1 redirect=yggdrasil.li" +_acme-challenge IN NS ns.yggdrasil.li. + ymir._domainkey IN TXT ( "v=DKIM1;k=rsa;p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq3cCKlk+VPhyAanLZTM0BCzUT/+fmxHioZcFk0uJk1akBYj7BRofR7eVNcLKpm3rwYMQgE+9vJH9p8SV6tws9EcWc8SMCqqGZlREYM7PmLDiTSK/vjCzkygfgFCb0EBNsY2A/fpP4rTeoxrbcBSvMkq97iY5rwyw4wXZVZXLiDaCj23s8POoxTk1ClqUJZJQ5x2" "qzrC0RfN5kLZ9A7Gq2jB09vNxpXHYqABA0bJv88JiZM7hfkp9IafJZ+yCVMaBcJs4DAxnTjNAuFD9gm+qSFVY8+yeXqL6Qjo5PbruhyZRBW8RgRYT8t5n07XRglMGKKGMwOGLanrltcyXqB+GsDZBD36RAAwjFadnxdpDyRv4SgRP7ff2tKRrORYpmpN+mKdqw5j3J/nP6bXV1oAkyh9XQkPEIDi81WT87EZziTElDzVp6A2qFOxqucAovoRk24" diff --git a/hosts/surtr/dns/zones/li.yggdrasil.soa b/hosts/surtr/dns/zones/li.yggdrasil.soa index 0cd26ec1..8fbfd98f 100644 --- a/hosts/surtr/dns/zones/li.yggdrasil.soa +++ b/hosts/surtr/dns/zones/li.yggdrasil.soa @@ -1,7 +1,7 @@ $ORIGIN yggdrasil.li. $TTL 3600 @ IN SOA ns.yggdrasil.li. root.yggdrasil.li. ( - 2022022102 ; serial + 2022022200 ; serial 10800 ; refresh 3600 ; retry 604800 ; expire @@ -28,6 +28,8 @@ ns IN AAAA 2a03:4000:52:ada:: * IN MX 0 ymir.yggdrasil.li. * IN TXT "v=spf1 redirect=yggdrasil.li" +_acme-challenge IN NS ns.yggdrasil.li. + ymir IN A 188.68.51.254 ymir IN AAAA 2a03:4000:6:d004:: ymir IN MX 0 ymir.yggdrasil.li. diff --git a/hosts/surtr/dns/zones/org.dirty-haskell.soa b/hosts/surtr/dns/zones/org.dirty-haskell.soa index ea7e0010..558d9817 100644 --- a/hosts/surtr/dns/zones/org.dirty-haskell.soa +++ b/hosts/surtr/dns/zones/org.dirty-haskell.soa @@ -1,7 +1,7 @@ $ORIGIN dirty-haskell.org. $TTL 3600 @ IN SOA ns.yggdrasil.li. root.yggdrasil.li. ( - 2022022102 ; serial + 2022022200 ; serial 10800 ; refresh 3600 ; retry 604800 ; expire @@ -25,6 +25,8 @@ $TTL 3600 * IN MX 0 ymir.yggdrasil.li. * IN TXT "v=spf1 redirect=yggdrasil.li" +_acme-challenge IN NS ns.yggdrasil.li. + ymir._domainkey IN TXT ( "v=DKIM1;k=rsa;p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq3cCKlk+VPhyAanLZTM0BCzUT/+fmxHioZcFk0uJk1akBYj7BRofR7eVNcLKpm3rwYMQgE+9vJH9p8SV6tws9EcWc8SMCqqGZlREYM7PmLDiTSK/vjCzkygfgFCb0EBNsY2A/fpP4rTeoxrbcBSvMkq97iY5rwyw4wXZVZXLiDaCj23s8POoxTk1ClqUJZJQ5x2" "qzrC0RfN5kLZ9A7Gq2jB09vNxpXHYqABA0bJv88JiZM7hfkp9IafJZ+yCVMaBcJs4DAxnTjNAuFD9gm+qSFVY8+yeXqL6Qjo5PbruhyZRBW8RgRYT8t5n07XRglMGKKGMwOGLanrltcyXqB+GsDZBD36RAAwjFadnxdpDyRv4SgRP7ff2tKRrORYpmpN+mKdqw5j3J/nP6bXV1oAkyh9XQkPEIDi81WT87EZziTElDzVp6A2qFOxqucAovoRk24" diff --git a/hosts/surtr/dns/zones/org.praseodym.soa b/hosts/surtr/dns/zones/org.praseodym.soa index 72f380bb..08f5d16d 100644 --- a/hosts/surtr/dns/zones/org.praseodym.soa +++ b/hosts/surtr/dns/zones/org.praseodym.soa @@ -1,7 +1,7 @@ $ORIGIN praseodym.org. $TTL 3600 @ IN SOA ns.yggdrasil.li. root.yggdrasil.li. ( - 2022022102 ; serial + 2022022200 ; serial 10800 ; refresh 3600 ; retry 604800 ; expire @@ -25,6 +25,8 @@ $TTL 3600 * IN MX 0 ymir.yggdrasil.li. * IN TXT "v=spf1 redirect=yggdrasil.li" +_acme-challenge IN NS ns.yggdrasil.li. + surtr IN A 202.61.241.61 surtr IN AAAA 2a03:4000:52:ada:: surtr IN MX 0 ymir.yggdrasil.li diff --git a/hosts/surtr/tls/Gupfile b/hosts/surtr/tls/Gupfile new file mode 100644 index 00000000..13ba8cf6 --- /dev/null +++ b/hosts/surtr/tls/Gupfile @@ -0,0 +1,2 @@ +tsig_key.gup: + tsig_keys/* \ No newline at end of file diff --git a/hosts/surtr/tls/default.nix b/hosts/surtr/tls/default.nix index 01c9050e..b28d33e9 100644 --- a/hosts/surtr/tls/default.nix +++ b/hosts/surtr/tls/default.nix @@ -8,51 +8,6 @@ let tsigSecretName = domain: "${domain}_tsig-secret"; cfg = config.security.acme; - knotCfg = config.services.knot; - - knotDNSCredentials = domain: let - zone = if cfg.domains.${domain}.zone == null then domain else cfg.domains.${domain}.zone; - in pkgs.writeText "lego-credentials" '' - EXEC_PATH=${knotDNSExec zone}/bin/update-dns.sh - EXEC_PROPAGATION_TIMEOUT=300 - EXEC_POLLING_INTERVAL=5 - ''; - knotDNSExec = zone: pkgs.writeScriptBin "update-dns.sh" '' - #!${pkgs.zsh}/bin/zsh -xe - - mode=$1 - fqdn=$2 - challenge=$3 - - owner=''${fqdn%".${zone}."} - - commited= - function abort() { - [[ -n "''${commited}" ]] || ${knotCfg.cliWrappers}/bin/knotc zone-abort "${zone}" - } - - ${knotCfg.cliWrappers}/bin/knotc zone-begin "${zone}" - trap abort EXIT - - case "''${mode}" in - present) - if ${knotCfg.cliWrappers}/bin/knotc zone-get ${zone} "''${owner}" TXT; then - ${knotCfg.cliWrappers}/bin/knotc zone-unset ${zone} "''${owner}" TXT '""' - fi - ${knotCfg.cliWrappers}/bin/knotc zone-set ${zone} "''${owner}" 30 TXT "''${challenge}" - ;; - cleanup) - ${knotCfg.cliWrappers}/bin/knotc zone-unset ${zone} "''${owner}" TXT "''${challenge}" - ${knotCfg.cliWrappers}/bin/knotc zone-set ${zone} "''${owner}" 30 TXT '""' - ;; - *) - exit 2 - ;; - esac - - ${knotCfg.cliWrappers}/bin/knotc zone-commit "${zone}" - commited=yes - ''; domainOptions = { options = { @@ -111,10 +66,6 @@ in { extraDomainNames = optional cfg.domains.${domain}.wildcard "*.${domain}"; dnsResolver = "127.0.0.1:5353"; }; - mkKnotc = shared // { - dnsProvider = "exec"; - credentialsFile = knotDNSCredentials domain; - }; mkRFC2136 = let tsigInfo = readYaml tsigPath; in shared // { @@ -129,7 +80,7 @@ in { RFC2136_POLLING_INTERVAL=2 ''; }; - in (if isTsig then mkRFC2136 else mkKnotc) // cfg.domains.${domain}.certCfg; + in assert isTsig; mkRFC2136 // cfg.domains.${domain}.certCfg; in genAttrs (attrNames cfg.domains) domainAttrset; }; diff --git a/hosts/surtr/tls/tsig_key.gup b/hosts/surtr/tls/tsig_key.gup new file mode 100644 index 00000000..3d81b603 --- /dev/null +++ b/hosts/surtr/tls/tsig_key.gup @@ -0,0 +1,6 @@ +#!/usr/bin/env zsh + +keyFile=../dns/keys/${2:t}_acme.yaml +gup -u $keyFile +sops -d --input-type=binary --output-type=binary ${keyFile} | yq -r '.key[0].secret' > $1 +sops -p '7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8,30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51' --input-type=binary -e -i $1 \ No newline at end of file diff --git a/hosts/surtr/tls/tsig_keys/141.li b/hosts/surtr/tls/tsig_keys/141.li new file mode 100644 index 00000000..f94b492f --- /dev/null +++ b/hosts/surtr/tls/tsig_keys/141.li @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:wjjG+kaLFnWG8vTKCMHRsTB2ksZEQV/lZON7OTGs4RGF2UGyzr7uFiaPEu69,iv:x29NlTSg48NuDZmNwQx7WFhKPanOLEziDF59GpAbYIU=,tag:U0jQimah+7dfJ8+rElb75w==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": null, + "lastmodified": "2022-02-22T14:15:30Z", + "mac": "ENC[AES256_GCM,data:NVzJqLoMPP1I322E002PPHB4hp6K2FpZTz1+E+eggsVnXtcU3da0zzRZTe+1JRRRLgTp1nFafxkDZbOF53byUgcuA+YVD0lIcX/Zk4JtkihS/AKBgCFSDXox+WFPulT+Jy8piRQuLFIj9m//FrPqbbZje4tT9MqtU8GFtQ/RZSA=,iv:ZXv5MXjUH939pbFZTHLICovdKgDxN3HkJWjzEBu0mIM=,tag:0h6XiH4oIeFEH3dFivHe2g==,type:str]", + "pgp": [ + { + "created_at": "2022-02-22T14:15:29Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdA3LvoKvgJIXhXYc5cnoUHE4k9EnJzrSokuwHX6vsXMF4w\nl/Am3E8SYCRLW6GH84v5nRogvRi4/njDTUMltRil4AreR8AKs6O22K/dotFDFpm8\n0l4BjzIFo5lin5t/fJQnam+Q9N0sRu6CKe74id93IEWn4fh8jnGm2z45VQf08edv\n5TT3atYJPXK3BoOGZqWLbYk1zZMxlj/yNDC/gsoNzkv7tFfQyd8Rk0pbGOELrvlq\n=QUbV\n-----END PGP MESSAGE-----\n", + "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8" + }, + { + "created_at": "2022-02-22T14:15:29Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdApyLjA3a/6MiK3911+Dp7+GldIgztIqDfePqSVGQ9Tngw\n8ojc86qm6daCc2aceZGmmvt28kPX4XNmd5KOnFhF6B33o1tSI2duoVeYMOMY5sc0\n0l4BXL2CeNPvdX5To1I4OAUV6t3HEhgnW41/b6B3LqaGg34KBI4i7xNb8+djVSxu\nMEtYkD9QoSkDdNOpDAlH5GnPmrIVPHY9ml70agC1ctwET+P6L9qt0lzwCs2K1oT2\n=/Ukj\n-----END PGP MESSAGE-----\n", + "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.7.1" + } +} \ No newline at end of file diff --git a/hosts/surtr/tls/tsig_keys/dirty-haskell.org b/hosts/surtr/tls/tsig_keys/dirty-haskell.org new file mode 100644 index 00000000..b9effeda --- /dev/null +++ b/hosts/surtr/tls/tsig_keys/dirty-haskell.org @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:c4XzB/MbBfDcgR+6/FRNxDsRxtfdOR8oaKj7eLByJfnDyDrnN/p5DHrwNOe+,iv:TmCVdXMFJtRb1eT0M8Tga23rxoyUldjPATPX04n7I18=,tag:AhqhULrs/FVtfPUeWv5SdQ==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": null, + "lastmodified": "2022-02-22T14:20:36Z", + "mac": "ENC[AES256_GCM,data:AZxoNR2oE7c5LXEg8o3cBYTflBMeGadPWr1cJ5GEyBJUJUloN9V9iTjnN/62Pj1zkTQvOhL4vkoOd0q812mOV1QgCi/RbLTPIn55dDWJ8d8jYQLlqrMV3LR+xtsGDDBDOPWJ8pNIug9D7f3BwVQpbvj3W2WOnJvm3oAZNHa0RJ8=,iv:YVFNSC74bZQgGpVLxWFCkC1oouSYwJjQ+k3beSeXUJc=,tag:oi7bSs83GsDl4qpsJ8zqCw==,type:str]", + "pgp": [ + { + "created_at": "2022-02-22T14:20:35Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAhNF59zErbJlEDeJjF5kFLUVeAF81ageD34K/7NjVf3Ew\nFAn32mbWKZmoY4ekfOyZesKWTvpaYH8vnLj0r0vTc4nnqIejrVbz5T7nxl9mKgxX\n0l4BS9jVKuC7mGvTlKvpABPEP7uQS083JRVdTQ9nLFF3kOgf3rHWTX7I+QNMT+7E\nWqdm0q8OV09wk0I94lpRVjQjeosZmLGV58E8Q1D5x9xKjwS1Z9IT2SHONaZDAc5a\n=jdQT\n-----END PGP MESSAGE-----\n", + "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8" + }, + { + "created_at": "2022-02-22T14:20:35Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAMpNL9Ff2tSQLZYJlJCc3zUeTIiJYBwPXngz89tnrtxMw\n7cBQezv8MW/nKS5+8VPsr5NA2EfbPRlPAGDs3i7c82iNyaq8wjlZ7E5kJt9Cp1UA\n0l4BUddH560+QD8JZ7Tas943jI0GvBSrP3gm/dpILXS6APmIo8cY1Ex8Qkyvp0vn\nfumu+TRaUIjgSo5ZbqbJx+/duUjTg+j+p0Zu1xvBDQizbP894y5LFfsEsWQB2tkC\n=QZbr\n-----END PGP MESSAGE-----\n", + "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.7.1" + } +} \ No newline at end of file diff --git a/hosts/surtr/tls/tsig_keys/kleen.li b/hosts/surtr/tls/tsig_keys/kleen.li new file mode 100644 index 00000000..3f31b1ec --- /dev/null +++ b/hosts/surtr/tls/tsig_keys/kleen.li @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:Jjw1uufbrTcNTY9QLDbC98BXyDsUpO7jlS56qHmrIC4gBT0DF29v4thHgDe/,iv:AJeaK7SA2dlVMZKT7VGYXpjYOvIlWsSPghylvwq5hfE=,tag:af6RdYpyPSioqiTpnuLYNQ==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": null, + "lastmodified": "2022-02-22T14:43:58Z", + "mac": "ENC[AES256_GCM,data:Ws+LHpDFB9tKzfV5zVg5POTbzwb5KNFigPCQON85yIupazVMKesW5mpBZTzbknL0IwPfVnCQNX92bnJ6RBqJ+vIdOdax/eZzuIMvXyUGw1gjafkE3F9gv0CWu3n34SoLOynEIHXOrM/nTVWOLs6+DP1fH8MmscjhvaX52yIxe8E=,iv:OhYYyc0tcI2BrL8i2ZWADso9AcHzhb/wNrqVEnTXUJY=,tag:+GoBXxlveNe2puCbFz2foQ==,type:str]", + "pgp": [ + { + "created_at": "2022-02-22T14:43:58Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAHUWRBd0g/lAt4SNSRTyY084xlAmLVFiWY38oItiWEzUw\ngFigoJRqCtFsfRgmPC/VyasEAsUCSmmA15rGH+C1DA0HRyXLNUVGEcsnL1J7yNxS\n0lwBVaPi+AgmKtV48v6YzArTeY36TA9CInZl588Wy/YFitnTX6wqIuoZeJlDgEhN\nVF4XQVjb1mQhHFHbgD7SJSW6fHi8KWb+B3Tr6qt+p+CzwCycH/IaDbWbhIRSZg==\n=06jP\n-----END PGP MESSAGE-----\n", + "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8" + }, + { + "created_at": "2022-02-22T14:43:58Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAZbcJU1YXpht/sVq+NgOi23+BCjuiT/DH2Q4o9oQwEBkw\nLlQGzqtLfKPAjZWCECgsgz7ssAQVY90S9MDM3fUYWX56TXZabFkgz18Bn0cq1Ywa\n0lwBeS1RQX6gyjLNrO3B52eL9t/FW01RtWWS51nGN0WafVgoIaohV00lDCFZPAD/\noajw9vLd7Njjk11Pqv6H7pUanQOk69+tX5pKpzwGlRE0eZre6OSPZp9WTgfLTQ==\n=Af2i\n-----END PGP MESSAGE-----\n", + "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.7.1" + } +} \ No newline at end of file diff --git a/hosts/surtr/tls/tsig_keys/nights.email b/hosts/surtr/tls/tsig_keys/nights.email new file mode 100644 index 00000000..5e387091 --- /dev/null +++ b/hosts/surtr/tls/tsig_keys/nights.email @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:WrhKcorA/PdPrt6tr1eDuVA/Wdr/DaRtc5ETixVKZtxDZzKQakF5ltVB49Dj,iv:f/1Ko1m064gAVPEbt2SnHt7zee/PQvMZb+/qneVc0ls=,tag:qimiralQNxwOZ/uAs1T7/g==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": null, + "lastmodified": "2022-02-22T14:44:08Z", + "mac": "ENC[AES256_GCM,data:+/9QfW6yc0AXNKu73Mkp7hK98lWWyNn3WLJ2wdi6mh7dAR/pYxcuIa8a9b8Kv41WrExwExVbWbI886v2hC63GMI+rZeiOXAZEEFNCpYQwyog0bzWedZ9gE5ZmymaErrPsVJYauys+8NYomhtj+3ufB5FZNwfmEOO76dzcr10qZY=,iv:ecyJqhBYHHNj97JvOCFgFg4jxaBySUdj3ZgZKY6ulLw=,tag:a62hRw50887xQarS6O/GgA==,type:str]", + "pgp": [ + { + "created_at": "2022-02-22T14:44:08Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAwkyJitOwmF+FeN4F3Z72t5wf8vTizR+TjlBPU/OwRUYw\nYVBQCma/uqjRj4UZeWXo6lq3weKI+gRp17z3Fvzc0YCWdtGq7lKyVtmwPltrvEXc\n0l4B4h6XT2+EcPuqtvkpNwIUoNphYZV8xGUD4v6lAQqUOYFsJvZfZbYe7tukcAQg\nwvbuWE2Hht0cxPpY65cVURA92wEcs7aP6Bp9Mqb/lQn7Ju1sv1a4bAvYvNVFnqu2\n=OkoI\n-----END PGP MESSAGE-----\n", + "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8" + }, + { + "created_at": "2022-02-22T14:44:08Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAFIJLO7eo3lhEVg13E2zI8DMn3ljuQv9JggBD2mHk4Xcw\nDjk54ugbH3AacQN4zsoGJsAjZEUpfCBhGl/fpVZYEVzgMLzA2SRqRol94YPyNpM3\n0l4Bived0rDJwIYAEhpCplpX/JKAN48BaauPC14QuWDxgBpZTWSKqa+BoYpTbBoc\nN0amWuqWp7WGLrRizpfah1w/+Og6QycgccXzG/dz5aRVC71ddxycvjbR2k6sH3tr\n=m8ZH\n-----END PGP MESSAGE-----\n", + "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.7.1" + } +} \ No newline at end of file diff --git a/hosts/surtr/tls/tsig_keys/praseodym.org b/hosts/surtr/tls/tsig_keys/praseodym.org new file mode 100644 index 00000000..c4afce5d --- /dev/null +++ b/hosts/surtr/tls/tsig_keys/praseodym.org @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:LLr/euxUJL1qSnjx2HlUG/X5dIg15WXb3VryAnVtHCLHUxnfrUF2PNlAoneL,iv:7OeUpmgXb7PfyDwfgNvaqhnPn9UKqYd4ug8as01gIDU=,tag:CYKMKyol09ahPr6SKGB9kA==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": null, + "lastmodified": "2022-02-22T14:43:37Z", + "mac": "ENC[AES256_GCM,data:dMgOwAv7CWEsP568dNX/1mGOcVIXc/eU92gJUSkZaQBWoJExa7Y1K0Ocyin9YsdQsFGcBFgjyo1DtdVUrf8j5/V69CG8xXiWwf82O247lifK+V2/Etgys7W71GZXxX+C5+fnN8SgsVQeOKX47ljiDeajKMXOptQEx7Awooe1vYM=,iv:GP57gibgf20yrZTgGzGxewOEWnu+1E7uJUYYJO85n9Q=,tag:Zhl9FmLYUyydiNzbXjLN4g==,type:str]", + "pgp": [ + { + "created_at": "2022-02-22T14:43:37Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAEwneu5Lzspri3SHXIFgp8G+nTOpl3DGEoQTCaxeJvkgw\n/q3IUfiNFbpH32V7V07oOk3CD3SIlVVLNcxD/3DuOLHLeCehnWJ6OAtzaakvR2zW\n0l4BEBu/NBzhrtxbOt2vJnUyIoPwJIQuzQ92nUppd3gdaMoHyA+Wk/CAByTZ6+Gu\nq4jPWyeVwGeItpQ3PfpnCKJJQGhs/2E9TQrrovr2vhurnaxiEW80U/NdCQ3eMXiw\n=vKZP\n-----END PGP MESSAGE-----\n", + "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8" + }, + { + "created_at": "2022-02-22T14:43:37Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdA1KY9DWpdJsUWLsvl4jJWel1tsdiNJ4z1VJw1W1Uiti0w\nLBhjFCiX4trrvYZf/s27t3CEE3j1xHpk+nhG+5rvh4PKOy9+4Z4dQ7ePr3khWK8d\n0l4BrSZXnmP1+i49AjR4F94EvezVS5MMNlqbHOfChBaybXO95oXl8CamSu2X0kSC\naJJe/ovfYblK2QCD1+kAb/e4LOedAHkL/YSOFtKa0WVhKNJoRIocAAYfCAXuQSRP\n=GWol\n-----END PGP MESSAGE-----\n", + "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.7.1" + } +} \ No newline at end of file diff --git a/hosts/surtr/tls/tsig_keys/xmpp.li b/hosts/surtr/tls/tsig_keys/xmpp.li new file mode 100644 index 00000000..35acd462 --- /dev/null +++ b/hosts/surtr/tls/tsig_keys/xmpp.li @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:Bice54S+zPCtUASZD0wnqFeBDekIKAfaZmNc4BJ8yFzzP1AeenJqOow69lf/,iv:dsBceXehjvhfTSd+KXE2QOvpTwNTY7gr9ef0hNFdDms=,tag:6iMISbLkELFP5OBbRgcdqA==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": null, + "lastmodified": "2022-02-22T14:43:10Z", + "mac": "ENC[AES256_GCM,data:IACasoGWgaouc0QnJAztTJkRnD60D0r0pXdxhXnDqpsz3qeS4Nnc5wgjMjSC6iTLNTDsGHw5s8egoIYKNhMVv1Gi7jYPgaIMGkjtg5iGIGmd12dqQTT4LPTfvrA0zqvu6BjzjO1BEBaJ26u8SBWw6yIg76b0BPpmM6afmyKo4X0=,iv:el8SzvnpQzURe1POMWNI3d2vYbAHqgfWzkzFi6GTQx8=,tag:HWABf4iOAZZLiJiMivGQ7Q==,type:str]", + "pgp": [ + { + "created_at": "2022-02-22T14:43:10Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAqBgOG0dMrKdKrPfL605eIH0q4zc/qLSepP3Mbi4wUCAw\nwVXV+LDTZKtCiT3RioyM3Vlf6blY1i5A8VgCKPHKFSy7TEMmhsHKKQGExahE35tm\n0l4BSmNYGiyW6mdiOlVS4uHlztG0SkzxAKoWs7lgwXufP97M0c9GaGLwVUCaOrWj\n416XfTI1wL8HmLBHaa8s2GyVPo+VWRKUpPu9gXAjTpqmRxeFjt7j749nIK8X27y8\n=2zXf\n-----END PGP MESSAGE-----\n", + "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8" + }, + { + "created_at": "2022-02-22T14:43:10Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdA4FILrqlN0ta93yHezBedT+3UuCQqonGlarHvrwi77DUw\nIi4IxaLcYRwqISIhsjz0k7MzJ/BlP1/Qg/NMaB9CoSQIoVc8P7TK/gdP81ORE+r2\n0l4BT9n00HJPJ4IHJKcKmG+Ta5xOPHsVqRNgLSp7Ss71I0HLEa6YqhE/4z3kwvcE\nD7fWKVLkMuA6PMzjEa+ZGY/baqHL0VFW+Vy3/Fn+E0nStUT17Ya0ANB5kuyRp/v6\n=cwHX\n-----END PGP MESSAGE-----\n", + "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.7.1" + } +} \ No newline at end of file diff --git a/hosts/surtr/tls/tsig_keys/yggdrasil.li b/hosts/surtr/tls/tsig_keys/yggdrasil.li new file mode 100644 index 00000000..7c75602c --- /dev/null +++ b/hosts/surtr/tls/tsig_keys/yggdrasil.li @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:nfXCp4v2HFGHzceTQJY7knQ3ci8sPUGdiYL5Cy9epu3LK1QULNFb+eA+vFHG,iv:xBdtLNYMgGQfLsdjj63uwc9NWe8UvVnVmyuMAM0S1bQ=,tag:9xSy1U4+crLKvWr7eKti4w==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": null, + "lastmodified": "2022-02-22T14:43:24Z", + "mac": "ENC[AES256_GCM,data:DzSO3ir1Q2KWzwcmrW9ksw9GFRJXOVkb2tuhgDQxzV+sHC8O6VLMvYUZCNrYSKlZR0i2xiGuQD+3cO09YRYMF9MoR3ODl1BAGi5C0z0UKYPxf8BE/8x1qj2ak4Qdp7BHtaAQHo+IU+dX8AK64DJ5b2pJ/ThZzRSlfaeYp3X8cgA=,iv:FeuDzZzI8R2sZxWry5Jr1eoUWQlLkSqiNLutrvBviKI=,tag:VQJoQSodDkHIkrDXsnPG7Q==,type:str]", + "pgp": [ + { + "created_at": "2022-02-22T14:43:23Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAP/YAe2yfGvQ3TcChWjoRsi1bSezMKA2VDWPgRZuA1xQw\nEXhjL2Iu/ORRaktmd6ortqSxckYo2WOosqLXLLWXSnSpBK0mpSFO4/DJbMeKapCA\n0lwB0Tq0hP1Knh7jrTm/9mj2zcqonJY4P8mDwobBI4p1Ll29HxG4KCExrsxFFV6S\nQj1/r9Sz3SLsA9+z8hS8SQO3+877ITmAF518LTjs5clelO4I3KYCQqezXTVOSA==\n=2jir\n-----END PGP MESSAGE-----\n", + "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8" + }, + { + "created_at": "2022-02-22T14:43:23Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdArOyejysX1GDvK5g928BoioPtvEz1VzindL8Ng3Ta/Bcw\nUCB1/NKkCM8Ex2jALoGrBeZ5GdL2eRAOmQysaYPpeYRSG84/6e3DUixsbavL63tO\n0lwB+fVTe4tsLKFQ/j+GRJrBkHWNLVSjq50t68OhqTMQ31e8FejeTdAmsFG33MjH\ntumC/AGjz9qAGR7G690wu6WZaJRFD+aPMAJdFN2Fu3A+Imdra3hlTExs8ZAVaA==\n=7NiP\n-----END PGP MESSAGE-----\n", + "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.7.1" + } +} \ No newline at end of file -- cgit v1.2.3