unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Add bind-external namespace for externally-reachable zones #329

Merged
benvin merged 1 commits from benvin/bind-external into main 2026-08-02 17:53:35 +10:00
Conversation 0 Commits 1 Files Changed 8
+114
unkinben commented 2026-08-02 17:27:42 +10:00
Owner
Copy Link
Copy Source

We self-delegate _acme-challenge.unkin.net into an acme.unkin.net zone we serve ourselves, so cert-manager can solve Let's Encrypt DNS-01 over RFC2136/TSIG. That needs a publicly-reachable authoritative BIND, separate from the internal estate.

  • Add app bind-external (base + au-syd1 overlay); register it in the platform ApplicationSet and AppProject destinations (bind-operator already watches all namespaces).
  • Add BindCluster bind-external: authoritative-only, recursion off, no forwarding, transfers denied except the keyed catalog/zone AXFR; 2 replicas; primaryService is a dmz-pinned PureLB LoadBalancer at 198.18.199.53.
  • Add BindZone acme.unkin.net (primary, dynamicUpdate) and BindTSIGKey certmanager (hmac-sha256), whose Secret certmanager-tsig reflects into the cert-manager namespace for the rfc2136 solver.

Pairs with argocd-apps #327 (the ClusterIssuers) and a one-time Google Cloud DNS delegation + NAT of the public IP :53 to 198.18.199.53.

We self-delegate `_acme-challenge.unkin.net` into an `acme.unkin.net` zone we serve ourselves, so cert-manager can solve Let's Encrypt DNS-01 over RFC2136/TSIG. That needs a publicly-reachable authoritative BIND, separate from the internal estate. - Add app `bind-external` (base + au-syd1 overlay); register it in the platform ApplicationSet and AppProject destinations (bind-operator already watches all namespaces). - Add BindCluster `bind-external`: authoritative-only, recursion off, no forwarding, transfers denied except the keyed catalog/zone AXFR; 2 replicas; primaryService is a dmz-pinned PureLB LoadBalancer at `198.18.199.53`. - Add BindZone `acme.unkin.net` (primary, dynamicUpdate) and BindTSIGKey `certmanager` (hmac-sha256), whose Secret `certmanager-tsig` reflects into the `cert-manager` namespace for the rfc2136 solver. Pairs with argocd-apps #327 (the ClusterIssuers) and a one-time Google Cloud DNS delegation + NAT of the public IP :53 to `198.18.199.53`.
unkinben added 1 commit 2026-08-02 17:27:42 +10:00
Add bind-external namespace for externally-reachable zones
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
d6969ca390 
We self-delegate _acme-challenge.unkin.net into an acme.unkin.net zone we serve,
so cert-manager can solve Let's Encrypt DNS-01 over RFC2136/TSIG. That needs a
publicly-reachable authoritative BIND, separate from the internal estate.

- Add app bind-external (base + au-syd1 overlay) and register it in the platform
  ApplicationSet and AppProject destinations.
- Add BindCluster bind-external: authoritative-only, recursion off, no
  forwarding, transfers denied except the keyed catalog/zone AXFR; 2 replicas;
  primaryService is a dmz-pinned PureLB LoadBalancer (198.18.199.53).
- Add BindZone acme.unkin.net (primary, dynamicUpdate) and BindTSIGKey
  certmanager (hmac-sha256), whose Secret reflects into the cert-manager
  namespace for the rfc2136 solver.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
benvin merged commit 131b4e1695 into main 2026-08-02 17:53:35 +10:00
benvin deleted branch benvin/bind-external 2026-08-02 17:53:35 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#329
Delete Branch "benvin/bind-external"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?