cnx-network-clan

B4L/cnx-network-clan

Fork 0

Commit Graph

Author	SHA1	Message	Date
Berwn	63446173bc	monitor.cnx.network DNS test	2026-06-16 19:03:49 +07:00
Berwn	dc51cfbdb5	Enable DNSSEC and automatic SOA serials on the DNS zones ns1 (primary) now signs every zone with an ECDSA P-256/SHA-256 policy and manages the SOA serial itself: zonefile-load = difference-no-serial (with journal-content = all) plus serial-policy = dateserial let records be edited without bumping the serial by hand. ns2 needs no change; it transfers the already-signed zone. Also point the ns1/ns2 AAAA glue at the public Hetzner IPv6 addresses; they previously pointed at unroutable ZeroTier mesh ULAs.	2026-06-14 16:27:30 +07:00
Berwn	807785cdab	Add authoritative DNS on ns1/ns2 and finalize clan config - Knot authoritative DNS: ns1 primary, ns2 secondary serving cnx.network, buildfor.life and cnx.email over TSIG-secured zone transfer (modules/dns) - Knot listens publicly + over ZeroTier; firewall opens port 53 - Complete clan inventory: name/domain, admin SSH key, control as the zerotier controller, tor on all nixos machines - Enable age yubikey/fido2-hmac secret plugins	2026-06-14 13:24:23 +07:00

Author

SHA1

Message

Date

Berwn

63446173bc

monitor.cnx.network DNS test

2026-06-16 19:03:49 +07:00

Berwn

dc51cfbdb5

Enable DNSSEC and automatic SOA serials on the DNS zones

ns1 (primary) now signs every zone with an ECDSA P-256/SHA-256 policy and
manages the SOA serial itself: zonefile-load = difference-no-serial (with
journal-content = all) plus serial-policy = dateserial let records be edited
without bumping the serial by hand. ns2 needs no change; it transfers the
already-signed zone.

Also point the ns1/ns2 AAAA glue at the public Hetzner IPv6 addresses; they
previously pointed at unroutable ZeroTier mesh ULAs.

2026-06-14 16:27:30 +07:00

Berwn

807785cdab

Add authoritative DNS on ns1/ns2 and finalize clan config

- Knot authoritative DNS: ns1 primary, ns2 secondary serving cnx.network,
  buildfor.life and cnx.email over TSIG-secured zone transfer (modules/dns)
- Knot listens publicly + over ZeroTier; firewall opens port 53
- Complete clan inventory: name/domain, admin SSH key, control as the
  zerotier controller, tor on all nixos machines
- Enable age yubikey/fido2-hmac secret plugins

2026-06-14 13:24:23 +07:00

3 Commits