From a44063419261a53b2744c5670feae8b394a285eb Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 27 Sep 2026 00:01:12 +1000 Subject: [PATCH] declare the acme.unkin.net nameservers The live apex NS and ns1 glue were corrected by hand and exist only in the zone journal; a reseed would republish the primary pod IP. --- apps/base/bind-external/zones.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/apps/base/bind-external/zones.yaml b/apps/base/bind-external/zones.yaml index 05ece86..d252a60 100644 --- a/apps/base/bind-external/zones.yaml +++ b/apps/base/bind-external/zones.yaml @@ -17,3 +17,14 @@ spec: updateKeyRef: certmanager allowTransfer: - key certmanager + # Published apex NS. acme-ns1 is what the parent delegates to and glues; ns1 is + # in-zone, so its address is declared below or a reseed would glue it to the + # primary pod IP. + nameservers: + - acme-ns1.unkin.net. + - ns1.acme.unkin.net. + records: + - name: ns1 + type: A + ttl: 3600 + values: ["103.216.191.185"]