unkin-agent
148dac8ca2
The zone was seeded with an apex `NS ns1.acme.unkin.net` glued to the primary pod IP. Both were later corrected by hand, so the live RRset and the ns1 address exist only in the zone journal -- a reseed republishes the pod IP and breaks DNS-01 for every `*.unkin.net` cert. Declaring them makes git the source of truth. - declare the two published apex NS names - declare the in-zone ns1 address, which a seed would otherwise glue to the pod IP Matches what the zone serves today, so applying it changes no records. Requires bind-operator v0.3.0. Reviewed-on: #495 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
31 lines
930 B
YAML
31 lines
930 B
YAML
---
|
|
# Self-delegated ACME challenge zone. Google Cloud DNS holds a one-time
|
|
# _acme-challenge.unkin.net CNAME -> _acme-challenge.acme.unkin.net and an
|
|
# acme.unkin.net NS delegation pointing here; cert-manager writes the challenge
|
|
# TXT records via RFC2136 authenticated with the certmanager key.
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: acme-unkin-net
|
|
namespace: bind-external
|
|
spec:
|
|
clusterRef: bind-external
|
|
zoneName: acme.unkin.net
|
|
type: primary
|
|
defaultTTL: 60
|
|
dynamicUpdate: true
|
|
updateKeyRef: certmanager
|
|
allowTransfer:
|
|
- key certmanager
|
|
# Published apex NS. acme-ns1 is what the parent delegates to and glues; ns1 is
|
|
# in-zone, so its address is declared below or a reseed would glue it to the
|
|
# primary pod IP.
|
|
nameservers:
|
|
- acme-ns1.unkin.net.
|
|
- ns1.acme.unkin.net.
|
|
records:
|
|
- name: ns1
|
|
type: A
|
|
ttl: 3600
|
|
values: ["103.216.191.185"]
|