Berwn
807785cdab
- Knot authoritative DNS: ns1 primary, ns2 secondary serving cnx.network, buildfor.life and cnx.email over TSIG-secured zone transfer (modules/dns) - Knot listens publicly + over ZeroTier; firewall opens port 53 - Complete clan inventory: name/domain, admin SSH key, control as the zerotier controller, tor on all nixos machines - Enable age yubikey/fido2-hmac secret plugins
17 lines
330 B
Nix
17 lines
330 B
Nix
{ ... }:
|
|
let
|
|
domains = import ../../modules/dns/domains.nix;
|
|
in
|
|
{
|
|
imports = [
|
|
../../modules/dns/authoritative.nix
|
|
];
|
|
|
|
# ns2 = secondary (slave): pulls every zone from ns1 and accepts its NOTIFY.
|
|
services.knot.settings.zone = map (d: {
|
|
domain = d;
|
|
master = [ "ns1" ];
|
|
acl = [ "acl_ns1" ];
|
|
}) domains;
|
|
}
|