mdw@git.distorted.org.uk Git - zones/blob - distorted.lisp

   1 ;;; Zone file for distorted.org.uk
   2
   3 (load "hosts.lisp" :verbose nil)
   4
   5 ;;;--------------------------------------------------------------------------
   6 ;;; Anycast services.
   7
   8 (defvar *anycast-routable-families* (list :ipv6))
   9
  10 (defzoneparse :anycast (name data rec :prefix prefix :zname zname)
  11   (destructuring-bind (any-provider default-provider &rest other-providers)
  12       data
  13
  14     ;; First, the default address.  If the anycast network is preferred then
  15     ;; this is easy; otherwise we have something complicated to do because
  16     ;; IPv6 anycast addresses are globally routable, while IPv4 ones aren't.
  17     (if (zone-preferred-subnet-p (car any-provider))
  18         (zone-set-address #'rec (cdr any-provider) :make-ptr-p t)
  19         (do-host (addr (cdr any-provider))
  20           (let ((family (ipaddr-family addr)))
  21             (if (member family *anycast-routable-families*)
  22                 (zone-set-address #'rec addr
  23                                   :family family :make-ptr-p t)
  24                 (zone-set-address #'rec (cdr default-provider)
  25                                   :family family :make-ptr-p nil)))))
  26
  27     ;; Now for all of the others.
  28     (dolist (provider (list* any-provider default-provider other-providers))
  29       (zone-set-address #'rec (cdr provider)
  30                         :make-ptr-p (eq provider any-provider)
  31                         :name (concatenate 'string prefix "."
  32                                            (string-downcase (car provider))
  33                                            "." (string-downcase zname))))))
  34
  35 ;;;--------------------------------------------------------------------------
  36 ;;; Other definitions.
  37
  38 (setf *default-zone-admin* "hostmaster@distorted.org.uk")
  39
  40 (setf *default-zone-source* 'radius.distorted.org.uk.)
  41
  42 ;;;--------------------------------------------------------------------------
  43 ;;; Main zone definition.
  44
  45 (defzone distorted.org.uk
  46
  47   ;; Nameservers.
  48   :ns #+view/inside ((radius.ns :ip radius)
  49                      (precision.ns :ip precision)
  50                      (vampire.ns :ip vampire))
  51       #-view/inside ((radius.ns :ip radius)
  52                      (precision.ns :ip precision)
  53                      (mythic-beasts-1.ns :ip mythic-ns1)
  54                      (mythic-beasts-2.ns :ip mythic-ns2)
  55                      (chiark.ns :ip chiark.greenend.org.uk))
  56
  57   ;; Mail servers.
  58   ((@ mail)
  59    :mx mail
  60    :srv ((:smtp mail)))
  61   ((lists bugs cryptomail)
  62    :ttl 300
  63    :mx mail
  64    :srv ((:smtp old-mail)))
  65
  66   (stratocaster.20140403._domainkey
  67    :dkim ("stratocaster-20140403"
  68           :v "DKIM1" :k "rsa" :h "sha256" :s "email"))
  69
  70   ;; Anycast services.
  71   (dns0 :anycast ((any dns0.any)
  72                   (jump precision.jump)
  73                   (colo precision.colo)
  74                   (dmz radius.dmz)
  75                   (unsafe radius.unsafe)))
  76   (dns1 :anycast ((any dns1.any)
  77                   (jump telecaster.jump)
  78                   (dmz vampire.dmz)
  79                   (unsafe vampire.unsafe)
  80                   (colo telecaster.colo)))
  81   (dns :cname dns0)
  82
  83   (ntp0 :anycast ((any ntp0.any)
  84                   (jump fender.jump)
  85                   (dmz ibanez.dmz)
  86                   (unsafe ibanez.unsafe)
  87                   (colo  fender.colo)))
  88   (ntp1 :anycast ((any ntp1.any)
  89                   (dmz vampire.dmz)
  90                   (unsafe vampire.unsafe)))
  91   (ntp :cname ntp0)
  92
  93   (www-cache :anycast ((any www-cache.any)
  94                        (jump (:ipv4 telecaster.jump))
  95                        (dmz (:ipv4 roadstar.dmz))
  96                        (unsafe (:ipv4 roadstar.unsafe))
  97                        (colo (:ipv4 telecaster.colo))))
  98   (wpad :cname www-cache)
  99
 100   (_kerberos :txt "DISTORTED.ORG.UK")
 101   (krb0 :anycast ((any krb0.any)
 102                   (jump precision.jump)
 103                   (dmz radius.dmz)
 104                   (unsafe radius.unsafe)
 105                   (colo precision.colo)))
 106   (krb1 :anycast ((any krb1.any)
 107                   (dmz vampire.dmz)
 108                   (unsafe vampire.unsafe)))
 109   (krb-master (unsafe :svc radius.unsafe)
 110               (dmz :svc radius.dmz))
 111   :srv (((:kerberos :protocol :udp)
 112          krb0
 113          (krb1 :prio 100))
 114         ((:kerberos-master :protocol :udp :port 88) krb-master)
 115         (:kerberos-adm krb-master)
 116         ((:kpasswd :protocol :udp) krb-master))
 117   (krb :cname krb0)
 118
 119   ;; Other services.
 120   :srv ((:http www)
 121         (:ftp ftp))
 122
 123   ;; Entry is via little router box.
 124   (dmz :net dmz)
 125   (guvnor (dmz :addr guvnor.dmz))
 126   (nat (dmz :addr nat.dmz))
 127
 128   ;; Wireless gateway.
 129   (wireless :net wireless)
 130   (evolution (safe :addr evolution.safe))
 131   (evolution :alias evo)
 132
 133   ;; Colocated services.
 134   ((irc vox) (colo :svc jazz.colo :sshfp "jazz")
 135              (jump :svc jazz.jump :sshfp "jazz"))
 136   ((git www mail) (colo :svc stratocaster.colo :sshfp "stratocaster")
 137                   (jump :svc stratocaster.jump :sshfp "stratocaster"))
 138   :svc #+view/inside stratocaster.colo
 139        #-view/inside stratocaster.jump
 140   (cabal :svc stratocaster.colo :sshfp "stratocaster")
 141   ((db ftp dyndns) (colo :svc telecaster.colo :sshfp "telecaster")
 142                    (jump :svc telecaster.jump :sshfp "telecaster"))
 143
 144   ;; Local services.
 145   ((rawk pifi) (unsafe :svc artist.unsafe)
 146                (dmz :svc artist.dmz))
 147   (mirror (dmz :svc roadstar.dmz :sshfp "roadstar")
 148           (unsafe :svc roadstar.unsafe :sshfp "roadstar"))
 149   ((wiki bugs old-mail i2p) :svc vampire :sshfp "vampire")
 150
 151   ;; Internal services.
 152   #+view/inside ((news lpr) :svc vampire.unsafe :sshfp "vampire")
 153
 154   ;; Anonymity services.
 155   (anon (colo :svc jazz.colo)
 156         (unsafe :svc vampire.unsafe)
 157         (jump :addr anon.jump)
 158         (dmz :addr anon.dmz))
 159
 160   ;; Fancy connectivity.
 161   (iodine (jump :addr jazz.jump))
 162
 163   ;; Colocated hosts.
 164   (colo :net colo)
 165   (jump :net jump)
 166   (gate (jump :addr gate.jump :sshfp "precision"))
 167   (fender (colo :addr fender.colo :sshfp "fender")
 168           (jump :addr fender.jump :sshfp "fender"))
 169   (precision (colo :addr precision.colo :sshfp "precision")
 170              (jump :addr precision.jump :sshfp "precision"))
 171   (telecaster (colo :addr telecaster.colo :sshfp "telecaster")
 172               (jump :addr telecaster.jump :sshfp "telecaster"))
 173   (telecaster :alias tele)
 174   (stratocaster (colo :addr stratocaster.colo :sshfp "stratocaster")
 175                 (jump :addr stratocaster.jump :sshfp "stratocaster"))
 176   (stratocaster :alias strat)
 177   (jazz (colo :addr jazz.colo :sshfp "jazz")
 178         (jump :addr jazz.jump :sshfp "jazz")
 179         (iodine :addr jazz.iodine :sshfp "jazz"))
 180
 181   ;; Media server (on loan to Good Technology HSTG).
 182   (jaguar (jump :addr jaguar.jump))
 183
 184   ;; Nicko's server.
 185   (richmond (jump :addr richmond.jump))
 186
 187   ;; Wired ethernet.
 188   (unsafe :net unsafe)
 189   (safe :net safe)
 190   (untrusted :net untrusted)
 191   (vampire (unsafe :addr vampire.unsafe :sshfp "vampire")
 192            (dmz :addr vampire.dmz :sshfp "vampire")
 193            (safe :addr vampire.safe :sshfp "vampire")
 194            (untrusted :addr vampire.untrusted :sshfp "vampire"))
 195   (ibanez (unsafe :addr ibanez.unsafe :sshfp "ibanez")
 196           (dmz :addr ibanez.dmz :sshfp "ibanez"))
 197   (radius (unsafe :addr radius.unsafe :sshfp "radius")
 198           (dmz :addr radius.dmz :sshfp "radius")
 199           (safe :addr radius.safe :sshfp "radius")
 200           (untrusted :addr radius.untrusted :sshfp "radius"))
 201   (roadstar (unsafe :addr roadstar.unsafe :sshfp "roadstar")
 202             (dmz :addr roadstar.dmz :sshfp "roadstar"))
 203   (jem (unsafe :addr jem.unsafe :sshfp "jem")
 204        (dmz :addr jem.dmz :sshfp "jem"))
 205   (artist (unsafe :addr artist.unsafe :sshfp "artist")
 206           (dmz :addr artist.dmz :sshfp "artist")
 207           (untrusted :addr artist.untrusted :sshfp "artist"))
 208
 209   ;; DHCP hosts.
 210   (gibson :cname gibson.dhcp)
 211   (lespaul :cname lespaul.dhcp)
 212   (firebird :cname firebird.dhcp)
 213   (marauder :cname marauder.dhcp)
 214   (invader :cname invader.dhcp)
 215
 216   ;; Virtual network.
 217   (vpn :net vpn)
 218   (crybaby (vpn :addr crybaby.vpn :sshfp "crybaby"))
 219   (terror (vpn :addr terror.vpn :sshfp "terror"))
 220   (orange (vpn :addr orange.vpn :sshfp "orange"))
 221   (iodine :net iodine)
 222
 223   ;; ITS.
 224   (its :net its)
 225   (gw (its :addr gw.its))
 226   (mz (its :addr mz.its))
 227
 228   ;; Strange things.
 229   (blackhole (jump :addr blackhole.jump))
 230
 231   ;; Delegations.
 232   (dhcp :ns ((radius.ns.dhcp :ip radius)
 233              (precision.ns.dhcp :ip precision)
 234              (vampire.ns.dhcp :ip vampire)))
 235   (dyn :ns ((radius.ns.dyn :ip radius)
 236             (precision.ns.dyn :ip precision)
 237             (vampire.ns.dyn :ip vampire)))
 238   (dnserr :ns ((radius.ns.dnserr :ip radius.dmz)
 239                (precision.ns.dnserr :ip precision.jump)
 240                (vampire.ns.dnserr :ip vampire.dmz)))
 241   (io :ns ((ns.io :ip jazz.jump))))
 242
 243 ;;;--------------------------------------------------------------------------
 244 ;;; Other subsidiary zones.
 245
 246 (defzone dhcp.distorted.org.uk
 247   (gibson :addr gibson.unsafe)
 248   (lespaul :addr lespaul.safe)
 249   (invader :addr invader.safe)
 250   (marauder :addr marauder.safe))
 251
 252 (defrevzone trusted
 253   :ns (radius.distorted.org.uk.
 254        precision.distorted.org.uk.
 255        vampire.distorted.org.uk.)
 256   :reverse unsafe
 257   :reverse vpn
 258   :reverse colo
 259   :reverse its
 260   :reverse any
 261   (dhcp :ns (radius.distorted.org.uk.
 262              precision.distorted.org.uk.
 263              vampire.distorted.org.uk.))
 264   :multi (((dhcp safe) :family :ipv4 :suffix "199.29.172.dhcp") :cname *))
 265
 266 (defrevzone dmz
 267   :ns (radius.distorted.org.uk.
 268        precision.distorted.org.uk.
 269        vampire.distorted.org.uk.)
 270   :reverse dmz)
 271
 272 (defrevzone jump
 273   :ns (radius.distorted.org.uk.
 274        precision.distorted.org.uk.
 275        vampire.distorted.org.uk.)
 276   :reverse jump)
 277
 278 (defrevzone distorted.org.uk-he
 279   :ns (radius.distorted.org.uk.
 280        precision.distorted.org.uk.
 281        vampire.distorted.org.uk.)
 282   :reverse distorted.org.uk-he)
 283
 284 (defrevzone distorted.org.uk-jump
 285   :ns (radius.distorted.org.uk.
 286        precision.distorted.org.uk.
 287        vampire.distorted.org.uk.)
 288   :reverse distorted.org.uk-jump)
 289
 290 (defzone io.distorted.org.uk
 291   :ns ((ns :ip jazz.jump))
 292   (about :txt "Fake zone used for IP-over-DNS tunnelling."))
 293
 294 ;;;----- That's all, folks --------------------------------------------------