From 197991a6cac76231ad648ab8c102d920233bbdb6 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Thu, 16 Jul 2026 23:13:31 +1000 Subject: [PATCH] bind-internal: allow admin workstation to query the resolver (#259) ## Why Follow-up to #258 (which added workstation+router to the *authoritative* ACL). The **resolver** (bind-resolvers, 198.18.200.7) has its own `acl-main.unkin.net` gating its `openforwarder` view; the workstation is not in it, so recursive queries return REFUSED. This lets the workstation use the resolver as its normal nameserver. ## Changes - Add `10.10.12.200/32` (workstation, wireguard) to resolver `acl-main.unkin.net` - Add `198.18.21.160/32` (router) explicitly for documentation; already covered by existing `198.18.21.160/27` and `198.18.21.0/24` (no functional change for the router) Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/259 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- apps/base/bind-internal/resolvers/acls.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/apps/base/bind-internal/resolvers/acls.yaml b/apps/base/bind-internal/resolvers/acls.yaml index 66b8ad5..c2f8eaa 100644 --- a/apps/base/bind-internal/resolvers/acls.yaml +++ b/apps/base/bind-internal/resolvers/acls.yaml @@ -13,6 +13,9 @@ spec: - 198.18.21.160/27 - 198.18.2.192/27 - 198.18.21.192/27 + # Admin/management access + - 10.10.12.200/32 # benvin workstation (wireguard) + - 198.18.21.160/32 # benvin router (also within 198.18.21.160/27 above) - 198.18.13.0/24 - 198.18.14.0/24 - 198.18.15.0/24