Add public main.unkin.net and edge.unkin.net zones to bind-external

apps/base/bind-external/edge-unkin-net/a/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - mta1.yaml
+  - mta2.yaml

apps/base/bind-external/edge-unkin-net/a/mta1.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: edge-mta1-a
+  namespace: bind-external
+spec:
+  zoneRef: edge-unkin-net
+  name: "mta1"
+  type: A
+  ttl: 3600
+  values:
+    - 66.226.148.207

apps/base/bind-external/edge-unkin-net/a/mta2.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: edge-mta2-a
+  namespace: bind-external
+spec:
+  zoneRef: edge-unkin-net
+  name: "mta2"
+  type: A
+  ttl: 3600
+  values:
+    - 66.226.149.50

apps/base/bind-external/edge-unkin-net/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - a

apps/base/bind-external/kustomization.yaml

@@ -8,4 +8,6 @@ resources:
   - tsigkey.yaml
   - zones.yaml
   - acme-unkin-net
+  - main-unkin-net
+  - edge-unkin-net
   - agent-dns-rolebinding.yaml

apps/base/bind-external/main-unkin-net/a/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - mail-in.yaml

apps/base/bind-external/main-unkin-net/a/mail-in.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: main-mail-in-a
+  namespace: bind-external
+spec:
+  zoneRef: main-unkin-net
+  name: "mail-in"
+  type: A
+  ttl: 3600
+  values:
+    - 103.216.191.185

apps/base/bind-external/main-unkin-net/cname/acme-challenge.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: main-acme-challenge-cname
+  namespace: bind-external
+spec:
+  zoneRef: main-unkin-net
+  name: "_acme-challenge"
+  type: CNAME
+  ttl: 3600
+  values:
+    - _acme-challenge.main.acme.unkin.net.

apps/base/bind-external/main-unkin-net/cname/au-syd1-pve-api.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: main-au-syd1-pve-api-cname
+  namespace: bind-external
+spec:
+  zoneRef: main-unkin-net
+  name: "au-syd1-pve-api"
+  type: CNAME
+  ttl: 3600
+  values:
+    - lb1.unkin.net.

apps/base/bind-external/main-unkin-net/cname/au-syd1-pve.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: main-au-syd1-pve-cname
+  namespace: bind-external
+spec:
+  zoneRef: main-unkin-net
+  name: "au-syd1-pve"
+  type: CNAME
+  ttl: 3600
+  values:
+    - lb1.unkin.net.

apps/base/bind-external/main-unkin-net/cname/grafana.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: main-grafana-cname
+  namespace: bind-external
+spec:
+  zoneRef: main-unkin-net
+  name: "grafana"
+  type: CNAME
+  ttl: 3600
+  values:
+    - lb1.unkin.net.

apps/base/bind-external/main-unkin-net/cname/kustomization.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - acme-challenge.yaml
+  - au-syd1-pve.yaml
+  - au-syd1-pve-api.yaml
+  - grafana.yaml
+  - lidarr.yaml
+  - nzbget.yaml
+  - prowlarr.yaml
+  - radarr.yaml
+  - readarr.yaml
+  - sonarr.yaml

apps/base/bind-external/main-unkin-net/cname/lidarr.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: main-lidarr-cname
+  namespace: bind-external
+spec:
+  zoneRef: main-unkin-net
+  name: "lidarr"
+  type: CNAME
+  ttl: 3600
+  values:
+    - lb1.unkin.net.

apps/base/bind-external/main-unkin-net/cname/nzbget.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: main-nzbget-cname
+  namespace: bind-external
+spec:
+  zoneRef: main-unkin-net
+  name: "nzbget"
+  type: CNAME
+  ttl: 3600
+  values:
+    - lb1.unkin.net.

apps/base/bind-external/main-unkin-net/cname/prowlarr.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: main-prowlarr-cname
+  namespace: bind-external
+spec:
+  zoneRef: main-unkin-net
+  name: "prowlarr"
+  type: CNAME
+  ttl: 3600
+  values:
+    - lb1.unkin.net.

apps/base/bind-external/main-unkin-net/cname/radarr.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: main-radarr-cname
+  namespace: bind-external
+spec:
+  zoneRef: main-unkin-net
+  name: "radarr"
+  type: CNAME
+  ttl: 3600
+  values:
+    - lb1.unkin.net.

apps/base/bind-external/main-unkin-net/cname/readarr.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: main-readarr-cname
+  namespace: bind-external
+spec:
+  zoneRef: main-unkin-net
+  name: "readarr"
+  type: CNAME
+  ttl: 3600
+  values:
+    - lb1.unkin.net.

apps/base/bind-external/main-unkin-net/cname/sonarr.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: main-sonarr-cname
+  namespace: bind-external
+spec:
+  zoneRef: main-unkin-net
+  name: "sonarr"
+  type: CNAME
+  ttl: 3600
+  values:
+    - lb1.unkin.net.

apps/base/bind-external/main-unkin-net/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - a
+  - mx
+  - txt
+  - cname

apps/base/bind-external/main-unkin-net/mx/apex.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: main-apex-mx
+  namespace: bind-external
+spec:
+  zoneRef: main-unkin-net
+  name: "@"
+  type: MX
+  ttl: 3600
+  values:
+    - "10 mta1.edge.unkin.net."
+    - "20 mta2.edge.unkin.net."

apps/base/bind-external/main-unkin-net/mx/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - apex.yaml

apps/base/bind-external/main-unkin-net/txt/apex.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: main-apex-txt
+  namespace: bind-external
+spec:
+  zoneRef: main-unkin-net
+  name: "@"
+  type: TXT
+  ttl: 3600
+  values:
+    - '"v=spf1 ip4:66.226.148.207 ip4:66.226.149.50 -all"'

apps/base/bind-external/main-unkin-net/txt/dmarc.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: main-dmarc-txt
+  namespace: bind-external
+spec:
+  zoneRef: main-unkin-net
+  name: "_dmarc"
+  type: TXT
+  ttl: 3600
+  values:
+    - '"v=DMARC1; p=none; rua=mailto:dmarc@unkin.net; adkim=r; aspf=r"'

apps/base/bind-external/main-unkin-net/txt/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - apex.yaml
+  - dmarc.yaml

apps/base/bind-external/zones.yaml

@@ -28,3 +28,39 @@ spec:
       type: A
       ttl: 3600
       values: ["103.216.191.185"]
+---
+# Public mail zones, delegated from Google Cloud DNS to acme-ns1.unkin.net like
+# acme.unkin.net. DNSRecords are applied with the zone's update key.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: main-unkin-net
+  namespace: bind-external
+spec:
+  clusterRef: bind-external
+  zoneName: main.unkin.net
+  type: primary
+  defaultTTL: 3600
+  dynamicUpdate: true
+  updateKeyRef: certmanager
+  allowTransfer:
+    - key certmanager
+  nameservers:
+    - acme-ns1.unkin.net.
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: edge-unkin-net
+  namespace: bind-external
+spec:
+  clusterRef: bind-external
+  zoneName: edge.unkin.net
+  type: primary
+  defaultTTL: 3600
+  dynamicUpdate: true
+  updateKeyRef: certmanager
+  allowTransfer:
+    - key certmanager
+  nameservers:
+    - acme-ns1.unkin.net.