Berwn
dc51cfbdb5
ns1 (primary) now signs every zone with an ECDSA P-256/SHA-256 policy and manages the SOA serial itself: zonefile-load = difference-no-serial (with journal-content = all) plus serial-policy = dateserial let records be edited without bumping the serial by hand. ns2 needs no change; it transfers the already-signed zone. Also point the ns1/ns2 AAAA glue at the public Hetzner IPv6 addresses; they previously pointed at unroutable ZeroTier mesh ULAs.
27 lines
845 B
Dns
27 lines
845 B
Dns
$ORIGIN cnx.network.
|
|
$TTL 3600
|
|
|
|
@ IN SOA ns1.cnx.network. hostmaster.cnx.network. (
|
|
2026061402 ; serial (ignored: Knot auto-assigns a dateserial on signing)
|
|
3600 ; refresh
|
|
900 ; retry
|
|
604800 ; expire
|
|
300 ) ; negative-cache TTL
|
|
|
|
; ---- Nameservers (used by every zone we serve) ----
|
|
@ IN NS ns1.cnx.network.
|
|
@ IN NS ns2.cnx.network.
|
|
|
|
; ---- Glue for the nameservers ----
|
|
ns1 IN A 46.224.170.206
|
|
ns1 IN AAAA 2a01:4f8:c014:b5c5::1
|
|
ns2 IN A 157.180.70.82
|
|
ns2 IN AAAA 2a01:4f9:c014:6d87::1
|
|
|
|
; ---- control (ZeroTier controller) ----
|
|
control IN AAAA fd06:1bad:ece2:92ad:ba99:9306:1bad:ece2
|
|
|
|
; ---- Web / apex (fill in once you have a web host) ----
|
|
;@ IN A <web-ipv4>
|
|
;www IN CNAME cnx.network.
|