Berwn
dc51cfbdb5
ns1 (primary) now signs every zone with an ECDSA P-256/SHA-256 policy and manages the SOA serial itself: zonefile-load = difference-no-serial (with journal-content = all) plus serial-policy = dateserial let records be edited without bumping the serial by hand. ns2 needs no change; it transfers the already-signed zone. Also point the ns1/ns2 AAAA glue at the public Hetzner IPv6 addresses; they previously pointed at unroutable ZeroTier mesh ULAs.