*.lisp: Add CAA records to discourage wrong CAs from issuing.

CAs are generally uselsss and can't be relied on to take any notice, but
it's better than nothing.

Add a record for our own CA for form's sake, even though I don't take
any notice.

diff --git a/binswood.lisp b/binswood.lisp
index 957273c4502522a03f8999a07e2d51c9fd130113..322929de3af482dd24f7b75f8a796bac58bc78db 100644 (file)
--- a/binswood.lisp
+++ b/binswood.lisp
@@ -21,6 +21,10 @@ (defzone binswood.org.uk
        (mythic-beasts-2.ns :ip mythic-ns2)
        (mythic-beasts-3.ns :ip mythic-ns3))
 
+  ;; Certification.
+  :caa ((:issue "letsencrypt.org")
+       (:issue "distorted.org.uk"))
+
   ;; Internal hosts.
   (binswrt :a binswrt.binswood)
   (mango :a mango.binswood)

diff --git a/distorted.lisp b/distorted.lisp
index d71124a191bdb57d8d6d5017d7c47190e7496ecc..e17768b486a13f4b170ce74b2b464a0662dfee54 100644 (file)
--- a/distorted.lisp
+++ b/distorted.lisp
@@ -77,6 +77,10 @@ (defzone distorted.org.uk
        #-view/inside (mythic-beasts-3.ns :ip mythic-ns3)
        #-view/inside (chiark.ns :ip chiark.greenend.org.uk))
 
+  ;; Certification.
+  :caa ((:issue "letsencrypt.org")
+       (:issue "distorted.org.uk"))
+
   ;; Mail servers.
   ((@ mail blackhole) :mx mail :srv ((:smtp mail)))
   ((bugs) :ttl 300 :mx lists :srv ((:smtp bugs)))

diff --git a/escorted.lisp b/escorted.lisp
index ab5c5b3ef8c576dfef75c9a99cb15f348d84c424..e2f542d962e8de9a611cf638d11c445a7f7b7ce5 100644 (file)
--- a/escorted.lisp
+++ b/escorted.lisp
@@ -20,6 +20,10 @@ (defzone escorted.org.uk
   ;; Web service.
   ((@ www) :svc stratocaster)
 
+  ;; Certification.
+  :caa ((:issue "letsencrypt.org")
+       (:issue "distorted.org.uk"))
+
   ;; Mail servers
   :mx ((mail :ip stratocaster))
   :srv ((:smtp mail))

diff --git a/odin.lisp b/odin.lisp
index 3ef3a87d1bff12b54e34d472a93b7787e18018ca..f17fc24b98702361cdb04d59b6bb35e791433f21 100644 (file)
--- a/odin.lisp
+++ b/odin.lisp
@@ -19,6 +19,10 @@ (defzone odin.gg
           :tlsa (:https (:service-certificate-constraint
                          :public-key :sha-256 #p"https-stratocaster")))
 
+  ;; Certification.
+  :caa ((:issue "letsencrypt.org")
+       (:issue "distorted.org.uk"))
+
   ;; Mail servers
   :mx ((mail :ip stratocaster))
   :srv ((:smtp mail))