Berwn a3482face5 Allow ACME DNS-01 dynamic updates on ns1 ...

Add a dedicated acme_ddns TSIG key (scoped to ns1 only) and an acl_acme rule
that limits it to TXT updates at or under _acme-challenge.<zone>. An external
ACME client can now write challenge records via RFC 2136; Knot signs them and
transfers to ns2, which never holds the key.

2026-06-14 17:12:17 +07:00

..

control

Move Hetzner firewall rules into a separate data file

2026-06-14 15:49:00 +07:00

ns1

Allow ACME DNS-01 dynamic updates on ns1

2026-06-14 17:12:17 +07:00

ns2

Set per-machine timezones and enable NTP

2026-06-14 15:02:34 +07:00