Enable DNSSEC and automatic SOA serials on the DNS zones

ns1 (primary) now signs every zone with an ECDSA P-256/SHA-256 policy and
manages the SOA serial itself: zonefile-load = difference-no-serial (with
journal-content = all) plus serial-policy = dateserial let records be edited
without bumping the serial by hand. ns2 needs no change; it transfers the
already-signed zone.

Also point the ns1/ns2 AAAA glue at the public Hetzner IPv6 addresses; they
previously pointed at unroutable ZeroTier mesh ULAs.

machines/ns1/configuration.nix

@@ -10,13 +10,29 @@ in
   time.timeZone = "Etc/GMT-1"; # UTC+1 (fixed offset, no DST)
   services.timesyncd.enable = true;
 
-  # ns1 = primary (master): holds each master zone file, notifies ns2 and
-  # allows it to pull the zone via AXFR/IXFR.
+  # Automatic DNSSEC signing policy (primary only). ECDSA P-256/SHA-256 with
+  # Knot's default key management: the ZSK auto-rolls and the KSK is kept stable,
+  # so the DS at the registrar only changes on a manual KSK rollover.
+  services.knot.settings.policy = [
+    {
+      id = "cnx";
+      algorithm = "ecdsap256sha256";
+    }
+  ];
+
+  # ns1 = primary (master): loads each zone from its file and serves it to ns2.
+  # zonefile-load = difference-no-serial lets us edit records without touching the
+  # SOA serial; Knot diffs the file, assigns a date-based serial, signs the zone,
+  # then notifies ns2 and lets it pull the signed zone via AXFR/IXFR.
   services.knot.settings.zone = map (d: {
     domain = d;
     file = ../../modules/dns/zones + "/${d}.zone";
-    "zonefile-load" = "whole";
+    "zonefile-load" = "difference-no-serial";
     "zonefile-sync" = "-1";
+    "journal-content" = "all"; # required by difference-no-serial; holds the live signed zone
+    "serial-policy" = "dateserial";
+    "dnssec-signing" = true;
+    "dnssec-policy" = "cnx";
     notify = [ "ns2" ];
     acl = [ "acl_ns2" ];
   }) domains;