caspervk/nixos
1
0
Fork 0
Code Actions Activity

knot: update dnssec documentation

Browse source
This commit is contained in:
Casper V. Kristensen 2024-11-11 23:17:43 +01:00
parent 916c08ac61
commit 02629a9ba2
1 changed files with 13 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
hosts/alpha/knot-dns.nix
View file

@ -53,12 +53,22 @@
# Enable ACME ACL on all zones # Enable ACME ACL on all zones
acl = ["acme"]; acl = ["acme"];
# Enable automatic DNSSEC signing on all zones. The KSK must be # Enable automatic DNSSEC signing on all zones. The KSK must be
# configured in the parent zone. Use the following command to get the # configured in the parent zone through the registrar. Either the
# required record(s): # DNSKEY or DS, depending on registrar:
#
# > sudo keymgr caspervk.net dnskey
# [<zone> <record-type> <key-type> <protocol> <algorithm-type> <public-key>]
#
# OR
#
# > sudo keymgr caspervk.net ds # > sudo keymgr caspervk.net ds
# [<zone> <record-type> <key-tag> <algorithm-type> <digest-type> <digest>] # [<zone> <record-type> <key-tag> <algorithm-type> <digest-type> <digest>]
#
# https://knot.readthedocs.io/en/master/configuration.html#automatic-dnssec-signing # https://knot.readthedocs.io/en/master/configuration.html#automatic-dnssec-signing
# DNSSEC can be validated using https://dnsviz.net. #
# DNSSEC can be validated using:
# - https://dnssec-debugger.verisignlabs.com
# - https://dnsviz.net
dnssec-signing = "on"; dnssec-signing = "on";
dnssec-policy = "default"; dnssec-policy = "default";
# Knot overwrites the zonefiles with auto-generated DNSSEC records by # Knot overwrites the zonefiles with auto-generated DNSSEC records by