- ;;
- ;; Nameservers
- :ns #+subnet/fretwank ((metalzone.ns :ip metalzone)
- (vampire.ns :ip vampire))
- #-subnet/fretwank ((boyle.ns :ip boyle.nsict.org)
- (chiark.ns :ip chiark.greenend.org.uk)
- (guvnor.ns :ip guvnor.demon))
- ;;
- ;; Mail servers
- ((@ mail lists bugs cryptomail) :mx mail)
- ;;
- ;; Colocated services
- ;;((www ftp git) (inet :svc boyle.nsict.org) (fretwank :svc metalzone))
- ;;
- ;; Entry is via little port-forwarding box
- (guvnor (inet :a guvnor.demon) (fretwank :a guvnor))
- ;;
- ;; Wireless gateway
- (evolution (fretwank :a evolution) (wireless :a evolution.wireless))
- ;;
- ;; Local services
- (@ :svc www-frontend)
- ((www ftp wiki git bugs mail rawk)
- (inet :svc guvnor.demon)
- (fretwank :svc metalzone))
- ((db)
- (inet :svc guvnor.demon)
- (fretwank :svc vampire))
- ;;
- ;; Internal services
- ((news ntp) (fretwank :svc metalzone))
- ((www-cache wpad ntp1) (fretwank :svc vampire))
- ;;
- ;; Wired ethernet
- (metalzone (inet :a guvnor.demon) (fretwank :a metalzone))
- (vampire (fretwank :a vampire))
- (tubescreamer (fretwank :a tubescreamer))
- (obsidian (fretwank :a obsidian))
- (fuzzface (virtual :a fuzzface))
- (mz (virtual :a mz))
- ;;
- ;; Delegations
- #+subnet/fretwank (dhcp :ns (metalzone.ns vampire.ns))
- ;;
- ;; Networks
- (fretwank :net fretwank)
+
+ ;; Nameservers.
+ :ns ((radius.ns :ip radius)
+ (precision.ns :ip precision)
+ (telecaster.ns :ip telecaster)
+ (national.ns :ip national)
+ (eggle.ns :ip eggle)
+ #-view/inside (mythic-beasts-1.ns :ip mythic-ns1)
+ #-view/inside (mythic-beasts-2.ns :ip mythic-ns2)
+ #-view/inside (mythic-beasts-3.ns :ip mythic-ns3)
+ #-view/inside (chiark.ns :ip chiark.greenend.org.uk))
+
+ ;; Certification.
+ :caa ((:issue "letsencrypt.org")
+ (:issue "distorted.org.uk"))
+
+ ;; Mail servers.
+ ((@ mail blackhole) :mx mail :srv ((:smtp mail)))
+ (bugs :mx lists :srv ((:smtp bugs)))
+ (lists :mx lists :srv ((:smtp lists)))
+ (_dmarc :dmarc (:v "DMARC1"
+ :p "quarantine" :sp "quarantine"
+ :adkim "s" :aspf "s"))
+ ((_domainkey _domainkey.mail) :dname stratocaster.dkim)
+ ((stratocaster @ mail) :spf ((:version "spf1")
+ (:pass :ip stratocaster.dmz)
+ (:soft :all)))
+ ((_domainkey.bugs _domainkey.lists) :dname telecaster.dkim)
+ ((telecaster bugs lists) :spf ((:version "spf1")
+ (:pass :ip telecaster.dmz)
+ (:soft :all)))
+
+ ;; Anycast services.
+ (dns0 :anycast ((any dns0.any) (dmz radius.dmz)
+ (unsafe radius.unsafe)))
+ (dns1 :anycast ((any dns1.any) (dmz precision.dmz)
+ (unsafe precision.unsafe)))
+ (dns :cname dns0)
+
+ (ntp0 :anycast ((any ntp0.any) (dmz ibanez.dmz)
+ (unsafe ibanez.unsafe)))
+ (ntp1 :anycast ((any ntp1.any) (dmz fender.dmz)
+ (unsafe fender.unsafe)))
+ (ntp :cname ntp0)
+
+ (www-cache :anycast ((any www-cache.any) (dmz telecaster.dmz)
+ (unsafe telecaster.unsafe)))
+ (wpad :cname www-cache)
+
+ (_kerberos :txt "DISTORTED.ORG.UK")
+ (krb0 :anycast ((any krb0.any) (dmz radius.dmz)
+ (unsafe radius.unsafe)))
+ (krb1 :anycast ((any krb1.any) (dmz precision.dmz)
+ (unsafe precision.unsafe)))
+ (krb-master (unsafe :svc radius.unsafe)
+ (dmz :svc radius.dmz))
+ :srv (((:kerberos :protocol :udp)
+ krb0
+ (krb1 :prio 100))
+ ((:kerberos-master :protocol :udp :port 88) krb-master)
+ (:kerberos-adm krb-master)
+ ((:kpasswd :protocol :udp) krb-master))
+ (krb :cname krb0)
+
+ ;; Other services.
+ :srv ((:http www)
+ (:ftp ftp))
+
+ ;; Formerly colocated services.
+ ((irc vox keys wiki) (unsafe :svc jazz.unsafe :sshfp "jazz")
+ (dmz :svc jazz.dmz :sshfp "jazz"))
+ ((irc vox keys wiki) :tlsa (:https (:service-certificate-constraint
+ :public-key :sha-256 #p"https-jazz")))
+ ((bugs lists db ftp) (unsafe :svc telecaster.unsafe :sshfp "telecaster")
+ (dmz :svc telecaster.dmz :sshfp "telecaster"))
+ ((bugs lists ftp) :tlsa (:https #3=(:service-certificate-constraint
+ :public-key :sha-256
+ #p"https-telecaster")))
+ (dyndns :svc telecaster.dmz :sshfp "telecaster")
+ ((git www mail) (unsafe :svc stratocaster.unsafe :sshfp "stratocaster")
+ (dmz :svc stratocaster.dmz :sshfp "stratocaster"))
+ ((www git mail @) :tlsa (:https #2=(:service-certificate-constraint
+ :public-key :sha-256
+ #p"https-stratocaster")))
+ (www-cache :tlsa (3127 #1=(:trust-anchor-assertion
+ :certificate :sha-256 #p"distorted-ca")))
+ (mail :tlsa ((:submission :imap :imaps) #1#))
+ (mail :tlsa (:smtp
+ #+view/inside #1#
+ #-view/inside (:domain-issued-certificate
+ :public-key :sha-256
+ #p"smtps-stratocaster")))
+ ((bugs lists) :tlsa (:smtp
+ #+view/inside #1#
+ #-view/inside (:domain-issued-certificate
+ :public-key :sha-256
+ #p"smtps-telecaster")))
+ :svc #+view/inside stratocaster.unsafe
+ #-view/inside stratocaster.dmz
+ (cabal :svc stratocaster.dmz :sshfp "stratocaster")
+
+ ;; Local services.
+ (rawk (unsafe :svc artist.unsafe) (dmz :svc artist.dmz))
+ (rawk :tlsa (:https (:service-certificate-constraint
+ :public-key :sha-256
+ #p"https-artist")))
+ (mirror (dmz :svc roadstar.dmz :sshfp "roadstar")
+ (unsafe :svc roadstar.unsafe :sshfp "roadstar"))
+
+ ;; Internal services.
+ ((news lpr) :svc roadstar.unsafe :sshfp "roadstar")
+
+ ;; Anonymity services.
+ (anon (dmz :svc anon.dmz)
+ (unsafe :svc jazz.unsafe))
+
+ ;; Fancy connectivity.
+ (iodine (dmz :svc jazz.dmz))
+ (hippotat (dmz :svc jazz.dmz))
+
+ ;; Formerly colocated hosts.
+ (fender :abbrev f (unsafe :abbrev fu) (dmz :abbrev fd))
+ (fender (unsafe :addr fender.unsafe :sshfp "fender")
+ (dmz :addr fender.dmz :sshfp "fender"))
+ (precision :abbrev p (unsafe :abbrev pu) (dmz :abbrev pd) (vpn :abbrev pv))
+ (precision (unsafe :addr precision.unsafe :sshfp "precision")
+ (dmz :addr precision.dmz :sshfp "precision")
+ (vpn :addr precision.vpn :sshfp "precision"))
+ (telecaster :alias tele :abbrev t
+ (unsafe :alias tele.unsafe :abbrev tu)
+ (dmz :alias tele.dmz :abbrev td))
+ (telecaster (unsafe :addr telecaster.unsafe :sshfp "telecaster")
+ (dmz :addr telecaster.dmz :sshfp "telecaster"))
+ (stratocaster :alias strat :abbrev s
+ (unsafe :alias strat.unsafe :abbrev su)
+ (dmz :alias strat.dmz :abbrev sd))
+ (stratocaster (unsafe :addr stratocaster.unsafe :sshfp "stratocaster")
+ (dmz :addr stratocaster.dmz :sshfp "stratocaster"))
+ (jazz :abbrev z (unsafe :abbrev zu) (dmz :abbrev zd) (vpn :abbrev :zv))
+ (jazz (unsafe :addr jazz.unsafe :sshfp "jazz")
+ (dmz :addr jazz.dmz :sshfp "jazz")
+ (vpn :addr jazz.vpn :sshfp "jazz")
+ (iodine :addr jazz.iodine :sshfp "jazz")
+ (hippo :addr jazz.hippo :sshfp "jazz"))
+
+ ;; Virtual hosts.
+ (national :abbrev n (linode :abbrev nl) (upn :abbrev ny))
+ (national (linode :addr national.linode) (upn :addr national.upn))
+ (eggle :abbrev e (jump :abbrev ej) (upn :abbrev ey))
+ (eggle (jump :addr eggle.jump) (upn :addr eggle.upn))
+ (mdwdev (upn :addr mdwdev.upn))
+
+ ;; Nicko's servers.
+ (richmond (dmz :svc richmond.dmz))
+ (marshall (dmz :svc marshall.dmz))
+
+ ;; Entry is via little router box.
+ (dmz :net dmz)
+ (guvnor (dmz :addr guvnor.dmz))
+ (nat (dmz :addr nat.dmz))
+
+ ;; Wireless access points.
~mdw / zones / blobdiff