blob: 2fef577abce274e06b162fe7ccf519756701b297 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
|
{...}:
{
config = {
fileSystems."/var/lib/knot" =
{ device = "surtr/safe/var-lib-knot";
fsType = "zfs";
};
systemd.services.knot.unitConfig.RequiresMountsFor = [ "/var/lib/knot" ];
services.knot = {
enable = true;
extraConfig = ''
server:
listen: 127.0.0.1@53
listen: ::1@53
listen: 202.61.241.61@53
listen: 2a03:4000:52:ada::@53
remote:
- id: inwx_notify
address: 185.181.104.96@53
acl:
- id: inwx_acl
address: 185.181.104.96
action: transfer
mod-rrl:
- id: default
rate-limit: 200
slip: 2
mod-cookies:
- id: default
secret-lifetime: 4h
badcookie-slip: 1
policy:
- id: rsa2048
algorithm: rsasha256
ksk-size: 4096
zsk-size: 2048
zsk-lifetime: 30d
- id: ed25519
algorithm: ed25519
nsec3: on
nsec3-iterations: 0
ksk-lifetime: 360d
signing-threads: 2
template:
- id: default
global-module: [mod-cookies/default, mod-rrl/default]
- id: inwx_zone
storage: /var/lib/knot
zonefile-sync: -1
zonefile-load: difference-no-serial
serial-policy: dateserial
journal-content: all
semantic-checks: on
dnssec-signing: on
dnssec-policy: ed25519
notify: [inwx_notify]
acl: [inwx_acl]
zone:
- domain: yggdrasil.li
template: inwx_zone
file: ${./zones/li.yggdrasil.soa}
- domain: nights.email
template: inwx_zone
file: ${./zones/email.nights.soa}
- domain: 141.li
template: inwx_zone
file: ${./zones/li.141.soa}
- domain: kleen.li
template: inwx_zone
file: ${./zones/li.kleen.soa}
- domain: xmpp.li
template: inwx_zone
file: ${./zones/li.xmpp.soa}
- domain: dirty-haskell.org
template: inwx_zone
file: ${./zones/org.dirty-haskell.soa}
- domain: praseodym.org
template: inwx_zone
file: ${./zones/org.praseodym.soa}
- domain: rheperire.org
template: inwx_zone
file: ${./zones/org.rheperire.soa}
'';
};
};
}
|
