B4L/cnx-network-clan
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Switch ns1 zone serial-policy to unixtime

Browse Source 
dateserial (YYYYMMDDnn) only has a 2-digit same-day counter held in Knot's
journal; a journal reset restarted the counter and let ns1 mint a serial ns2
had already seen with older content, so ns2 never retransferred. unixtime is
strictly monotonic per reload, eliminating the shared-serial collision.
This commit is contained in:
Berwn
2026-06-16 18:59:45 +07:00
parent e795960dcf
commit aa604bda9a
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
machines/ns1/configuration.nix
+5 -3
View File
@@ -65,15 +65,17 @@ in
# ns1 = primary (master): loads each zone from its file and serves it to ns2. # ns1 = primary (master): loads each zone from its file and serves it to ns2.
# zonefile-load = difference-no-serial lets us edit records without touching the # zonefile-load = difference-no-serial lets us edit records without touching the
# SOA serial; Knot diffs the file, assigns a date-based serial, signs the zone, # SOA serial; Knot diffs the file, assigns a unixtime serial, signs the zone,
# then notifies ns2 and lets it pull the signed zone via AXFR/IXFR. # then notifies ns2 and lets it pull the signed zone via AXFR/IXFR. unixtime is
# strictly monotonic per reload, so two zone versions can never share a serial
# (the failure mode dateserial's 2-digit daily counter allowed after a journal reset).
services.knot.settings.zone = map (d: { services.knot.settings.zone = map (d: {
domain = d; domain = d;
file = ../../modules/dns/zones + "/${d}.zone"; file = ../../modules/dns/zones + "/${d}.zone";
"zonefile-load" = "difference-no-serial"; "zonefile-load" = "difference-no-serial";
"zonefile-sync" = "-1"; "zonefile-sync" = "-1";
"journal-content" = "all"; # required by difference-no-serial; holds the live signed zone "journal-content" = "all"; # required by difference-no-serial; holds the live signed zone
"serial-policy" = "dateserial"; "serial-policy" = "unixtime";
"dnssec-signing" = true; "dnssec-signing" = true;
"dnssec-policy" = "cnx"; "dnssec-policy" = "cnx";
notify = [ "ns2" ]; notify = [ "ns2" ];