From 6854042fe4cdda01260194bfd55f2dcad2fbcb2a Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sun, 27 Sep 2026 17:41:39 +1000
Subject: [PATCH] Drop the redundant acme.unkin.net apex NS DNSRecord

---
 .../acme-unkin-net/kustomization.yaml            | 10 +++++-----
 .../bind-external/acme-unkin-net/ns/apex.yaml    | 16 ----------------
 .../acme-unkin-net/ns/kustomization.yaml         |  6 ------
 3 files changed, 5 insertions(+), 27 deletions(-)
 delete mode 100644 apps/base/bind-external/acme-unkin-net/ns/apex.yaml
 delete mode 100644 apps/base/bind-external/acme-unkin-net/ns/kustomization.yaml

diff --git a/apps/base/bind-external/acme-unkin-net/kustomization.yaml b/apps/base/bind-external/acme-unkin-net/kustomization.yaml
index 1ee0cfc..d40c141 100644
--- a/apps/base/bind-external/acme-unkin-net/kustomization.yaml
+++ b/apps/base/bind-external/acme-unkin-net/kustomization.yaml
@@ -1,11 +1,11 @@
 ---
-# Authoritative delegation records for acme.unkin.net. Without these the zone
-# only holds the operator's seed apex (NS ns1.acme.unkin.net glued to the
-# primary pod IP), which is unroutable off-cluster and goes stale on
-# reschedule. DNSRecords must live in the same namespace as their BindZone.
+# In-zone address for the nameserver names acme.unkin.net publishes. Without it
+# a reseed glues ns1.acme.unkin.net to the primary pod IP, which is unroutable
+# off-cluster and goes stale on reschedule. The apex NS RRset itself comes from
+# BindZone.spec.nameservers. DNSRecords must live in the same namespace as their
+# BindZone.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - ns
   - a
diff --git a/apps/base/bind-external/acme-unkin-net/ns/apex.yaml b/apps/base/bind-external/acme-unkin-net/ns/apex.yaml
deleted file mode 100644
index 245ab17..0000000
--- a/apps/base/bind-external/acme-unkin-net/ns/apex.yaml
+++ /dev/null
@@ -1,16 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: acme-apex-ns
-  namespace: bind-external
-spec:
-  zoneRef: acme-unkin-net
-  # "@" is the zone apex.
-  name: "@"
-  type: NS
-  ttl: 3600
-  values:
-    # Matches the parent delegation in Google Cloud DNS. Out of zone, so the
-    # child needs no glue of its own.
-    - acme-ns1.unkin.net.
diff --git a/apps/base/bind-external/acme-unkin-net/ns/kustomization.yaml b/apps/base/bind-external/acme-unkin-net/ns/kustomization.yaml
deleted file mode 100644
index 7a02b57..0000000
--- a/apps/base/bind-external/acme-unkin-net/ns/kustomization.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - apex.yaml