+
+ ;; Nameservers.
+ :ns ((radius.ns :ip radius)
+ (precision.ns :ip precision)
+ (telecaster.ns :ip telecaster)
+ (national.ns :ip national)
+ #+view/inside (vampire.ns :ip vampire)
+ #-view/inside (mythic-beasts-1.ns :ip mythic-ns1)
+ #-view/inside (mythic-beasts-2.ns :ip mythic-ns2)
+ #-view/inside (mythic-beasts-3.ns :ip mythic-ns3)
+ #-view/inside (chiark.ns :ip chiark.greenend.org.uk))
+
+ ;; Certification.
+ :caa ((:issue "letsencrypt.org")
+ (:issue "distorted.org.uk"))
+
+ ;; Mail servers.
+ ((@ mail blackhole) :mx mail :srv ((:smtp mail)))
+ ((bugs) :ttl 300 :mx lists :srv ((:smtp bugs)))
+ ((lists) :ttl 300 :mx lists :srv ((:smtp lists)))
+
+ (stratocaster.20140403._domainkey
+ :dkim ("stratocaster-20140403"
+ :v "DKIM1" :k "rsa" :h "sha256" :s "email"))
+
+ ;; Anycast services.
+ (dns0 :anycast ((any dns0.any) (jump precision.jump)
+ (nany dns0.nany)
+ (colo precision.colo)
+ (dmz radius.dmz)
+ (unsafe radius.unsafe)))
+ (dns1 :anycast ((any dns1.any) (jump telecaster.jump)
+ (nany dns1.nany)
+ (dmz vampire.dmz)
+ (unsafe vampire.unsafe)
+ (colo telecaster.colo)))
+ (dns :cname dns0)
+
+ (ntp0 :anycast ((any ntp0.any) (jump fender.jump)
+ (nany ntp0.nany)
+ (dmz ibanez.dmz)
+ (unsafe ibanez.unsafe)
+ (colo fender.colo)))
+ (ntp1 :anycast ((any ntp1.any) (dmz vampire.dmz)
+ (nany ntp1.nany)
+ (unsafe vampire.unsafe)))
+ (ntp :cname ntp0)
+
+ (www-cache :anycast ((any www-cache.any) (jump telecaster.jump)
+ (nany www-cache.nany)
+ (dmz roadstar.dmz)
+ (unsafe roadstar.unsafe)
+ (colo telecaster.colo)))
+ (wpad :cname www-cache)
+
+ (_kerberos :txt "DISTORTED.ORG.UK")
+ (krb0 :anycast ((any krb0.any) (jump precision.jump)
+ (nany krb0.nany)
+ (dmz radius.dmz)
+ (unsafe radius.unsafe)
+ (colo precision.colo)))
+ (krb1 :anycast ((any krb1.any) (dmz vampire.dmz)
+ (nany krb1.nany)
+ (unsafe vampire.unsafe)))
+ (krb-master (unsafe :svc radius.unsafe)
+ (dmz :svc radius.dmz))
+ :srv (((:kerberos :protocol :udp)
+ krb0
+ (krb1 :prio 100))
+ ((:kerberos-master :protocol :udp :port 88) krb-master)
+ (:kerberos-adm krb-master)
+ ((:kpasswd :protocol :udp) krb-master))
+ (krb :cname krb0)
+
+ ;; Other services.
+ :srv ((:http www)
+ (:ftp ftp))
+
+ ;; Colocated services.
+ ((irc vox keys wiki) (colo :svc jazz.colo :sshfp "jazz")
+ (jump :svc jazz.jump :sshfp "jazz"))
+ ((irc vox keys wiki) :tlsa (:https (:service-certificate-constraint
+ :public-key :sha-256 #p"https-jazz")))
+ ((bugs lists db ftp) (colo :svc telecaster.colo :sshfp "telecaster")
+ (jump :svc telecaster.jump :sshfp "telecaster"))
+ ((bugs lists ftp) :tlsa (:https #3=(:service-certificate-constraint
+ :public-key :sha-256
+ #p"https-telecaster")))
+ (dyndns :svc telecaster.jump :sshfp "telecaster")
+ ((git www mail) (colo :svc stratocaster.colo :sshfp "stratocaster")
+ (jump :svc stratocaster.jump :sshfp "stratocaster"))
+ ((www git mail @) :tlsa (:https #2=(:service-certificate-constraint
+ :public-key :sha-256
+ #p"https-stratocaster")))
+ (www-cache :tlsa (3127 #1=(:trust-anchor-assertion
+ :certificate :sha-256 #p"distorted-ca")))
+ (mail :tlsa ((:submission :imap :imaps) #1#))
+ (mail :tlsa (:smtp
+ #+view/inside #1#
+ #-view/inside (:domain-issued-certificate
+ :public-key :sha-256
+ #p"smtps-stratocaster")))
+ ((bugs lists) :tlsa (:smtp
+ #+view/inside #1#
+ #-view/inside (:domain-issued-certificate
+ :public-key :sha-256
+ #p"smtps-telecaster")))
+ :svc #+view/inside stratocaster.colo
+ #-view/inside stratocaster.jump
+ (cabal :svc stratocaster.colo :sshfp "stratocaster")
+
+ ;; Local services.
+ (rawk (unsafe :svc artist.unsafe) (dmz :svc artist.dmz))
+ (rawk :tlsa (:https (:service-certificate-constraint
+ :public-key :sha-256
+ #p"https-artist")))
+ (mirror (dmz :svc roadstar.dmz :sshfp "roadstar")
+ (unsafe :svc roadstar.unsafe :sshfp "roadstar"))
+
+ ;; Internal services.
+ ((news lpr) :svc roadstar.unsafe :sshfp "roadstar")
+
+ ;; Anonymity services.
+ (anon (colo :svc jazz.colo)
+ (unsafe :svc vampire.unsafe)
+ (jump :addr anon.jump)
+ (dmz :addr anon.dmz))
+
+ ;; Fancy connectivity.
+ (iodine (jump :svc jazz.jump))
+ (hippotat (jump :svc jazz.jump))
+
+ ;; Colocated hosts.
+ (colo :net colo)
+ (jump :net jump)
+ (gate (jump :addr gate.jump :sshfp "precision"))
+ (fender :abbrev f (colo :abbrev fc) (jump :abbrev fj))
+ (fender (colo :addr fender.colo :sshfp "fender")
+ (jump :addr fender.jump :sshfp "fender"))
+ (precision :abbrev p
+ (colo :abbrev pc) (jump :abbrev pj)
+ (vpn :abbrev pv) (nvpn :abbrev pnv))
+ (precision (colo :addr precision.colo :sshfp "precision")
+ (jump :addr precision.jump :sshfp "precision")
+ (vpn :addr precision.vpn :sshfp "precision")
+ (nvpn :addr precision.nvpn :sshfp "precision"))
+ (telecaster :alias tele :abbrev t
+ (colo :alias tele.colo :abbrev tc)
+ (jump :alias tele.jump :abbrev tj))
+ (telecaster (colo :addr telecaster.colo :sshfp "telecaster")
+ (jump :addr telecaster.jump :sshfp "telecaster"))
+ (stratocaster :alias strat :abbrev s
+ (colo :alias strat.colo :abbrev sc)
+ (jump :alias strat.jump :abbrev sj))
+ (stratocaster (colo :addr stratocaster.colo :sshfp "stratocaster")
+ (jump :addr stratocaster.jump :sshfp "stratocaster"))
+ (jazz :abbrev z
+ (colo :abbrev zc) (jump :abbrev zj)
+ (vpn :abbrev :zv) (nvpn :abbrev :znv))
+ (jazz (colo :addr jazz.colo :sshfp "jazz")
+ (jump :addr jazz.jump :sshfp "jazz")
+ (vpn :addr jazz.vpn :sshfp "jazz")
+ (nvpn :addr jazz.nvpn :sshfp "jazz")
+ (iodine :addr jazz.iodine :sshfp "jazz")
+ (hippo :addr jazz.hippo :sshfp "jazz"))
+
+ ;; Formerly colocated hosts.
+ (nfender :abbrev nf (unsafe :abbrev fu) (dmz :abbrev fd))
+ (nfender (unsafe :addr fender.unsafe :sshfp "fender")
+ (dmz :addr fender.dmz :sshfp "fender"))
+ (nprecision :abbrev np (unsafe :abbrev pu) (dmz :abbrev pd))
+ (nprecision (unsafe :addr precision.unsafe :sshfp "precision")
+ (dmz :addr precision.dmz :sshfp "precision"))
+ (ntelecaster :alias ntele :abbrev nt
+ (unsafe :alias tele.unsafe :abbrev tu)
+ (dmz :alias tele.dmz :abbrev td))
+ (ntelecaster (unsafe :addr telecaster.unsafe :sshfp "telecaster")
+ (dmz :addr telecaster.dmz :sshfp "telecaster"))
+ (nstratocaster :alias nstrat :abbrev ns
+ (unsafe :alias strat.unsafe :abbrev su)
+ (dmz :alias strat.dmz :abbrev sd))
+ (nstratocaster (unsafe :addr stratocaster.unsafe :sshfp "stratocaster")
+ (dmz :addr stratocaster.dmz :sshfp "stratocaster"))
+ (njazz :abbrev nz (unsafe :abbrev zu) (dmz :abbrev zd))
+ (njazz (unsafe :addr jazz.unsafe :sshfp "jazz")
+ (dmz :addr jazz.dmz :sshfp "jazz"))
+
+ ;; Virtual hosts.
+ (national :abbrev n (linode :abbrev nl) (upn :abbrev ny) (nupn :abbrev nny))
+ (national (linode :addr national.linode)
+ (upn :addr national.upn)
+ (nupn :addr national.nupn))
+ (mdwdev (upn :addr mdwdev.upn)
+ (nupn :addr mdwdev.nupn))
+
+ ;; Nicko's servers.
+ (richmond (jump :svc richmond.jump))
+ (marshall (jump :svc marshall.jump))
+
+ ;; Entry is via little router box.
+ (dmz :net dmz)
+ (guvnor (dmz :addr guvnor.dmz))
+ (nat (dmz :addr nat.dmz))
+
+ ;; Wireless access points.