---
# Self-delegated ACME challenge zone. Google Cloud DNS holds a one-time
# _acme-challenge.unkin.net CNAME -> _acme-challenge.acme.unkin.net and an
# acme.unkin.net NS delegation pointing here; cert-manager writes the challenge
# TXT records via RFC2136 authenticated with the certmanager key.
apiVersion: bind.unkin.net/v1alpha1
kind: BindZone
metadata:
  name: acme-unkin-net
  namespace: bind-external
spec:
  clusterRef: bind-external
  zoneName: acme.unkin.net
  type: primary
  defaultTTL: 60
  dynamicUpdate: true
  updateKeyRef: certmanager
  allowTransfer:
    - key certmanager
  # Published apex NS. acme-ns1 is what the parent delegates to and glues; ns1 is
  # in-zone, so its address is declared below or a reseed would glue it to the
  # primary pod IP.
  nameservers:
    - acme-ns1.unkin.net.
    - ns1.acme.unkin.net.
  records:
    - name: ns1
      type: A
      ttl: 3600
      values: ["103.216.191.185"]