X-Git-Url: https://git.distorted.org.uk/~mdw/zones/blobdiff_plain/55f161b6b9673e11222e07757de537cff5a0d04a..098020adcf7cf4460680280e9ca79c00d24e9dcd:/distorted.lisp diff --git a/distorted.lisp b/distorted.lisp index 985cfff..57a7225 100644 --- a/distorted.lisp +++ b/distorted.lisp @@ -16,7 +16,7 @@ ;; IPv6 anycast addresses are globally routable, while IPv4 ones aren't. (if (zone-preferred-subnet-p (car any-provider)) (zone-set-address #'rec (cdr any-provider) :make-ptr-p t) - (dolist (addr (host-addrs (host-parse (cdr any-provider)))) + (do-host (addr (cdr any-provider)) (let ((family (ipaddr-family addr))) (if (member family *anycast-routable-families*) (zone-set-address #'rec addr @@ -28,9 +28,10 @@ (dolist (provider (list* any-provider default-provider other-providers)) (zone-set-address #'rec (cdr provider) :make-ptr-p (eq provider any-provider) - :name (concatenate 'string prefix "." - (string-downcase (car provider)) - "." (string-downcase zname)))))) + :name (domain-name-concat prefix + (zone-parse-host + (car provider) + zname)))))) ;;;-------------------------------------------------------------------------- ;;; Other definitions. @@ -47,15 +48,17 @@ ;; Nameservers. :ns #+view/inside ((radius.ns :ip radius) (precision.ns :ip precision) + (telecaster.ns :ip telecaster) (vampire.ns :ip vampire)) #-view/inside ((radius.ns :ip radius) (precision.ns :ip precision) + (telecaster.ns :ip telecaster) (mythic-beasts-1.ns :ip mythic-ns1) (mythic-beasts-2.ns :ip mythic-ns2) (chiark.ns :ip chiark.greenend.org.uk)) ;; Mail servers. - ((@ mail) + ((@ mail blackhole) :mx mail :srv ((:smtp mail))) ((lists bugs cryptomail) @@ -135,11 +138,21 @@ (jump :svc jazz.jump :sshfp "jazz")) ((git www mail) (colo :svc stratocaster.colo :sshfp "stratocaster") (jump :svc stratocaster.jump :sshfp "stratocaster")) + ((www @) :tlsa (:https (:service-certificate-constraint + :certificate :sha-256 #p"http-server-www#1"))) + (git :tlsa (:https (:trust-anchor-assertion + :certificate :sha-256 #p"distorted-ca"))) + (www-cache :tlsa (3127 (:trust-anchor-assertion + :certificate :sha-256 #p"distorted-ca"))) + (mail :tlsa ((:smtp :submission :imap) + (:trust-anchor-assertion + :certificate :sha-256 #p"distorted-ca"))) :svc #+view/inside stratocaster.colo #-view/inside stratocaster.jump (cabal :svc stratocaster.colo :sshfp "stratocaster") ((db ftp) (colo :svc telecaster.colo :sshfp "telecaster") (jump :svc telecaster.jump :sshfp "telecaster")) + (dyndns :svc telecaster.jump :sshfp "telecaster") ;; Local services. ((rawk pifi) (unsafe :svc artist.unsafe) @@ -158,7 +171,7 @@ (dmz :addr anon.dmz)) ;; Fancy connectivity. - (iodine (jump :addr jazz.jump)) + (iodine (jump :svc jazz.jump)) ;; Colocated hosts. (colo :net colo) @@ -179,10 +192,10 @@ (iodine :addr jazz.iodine :sshfp "jazz")) ;; Media server (on loan to Good Technology HSTG). - (jaguar (jump :addr jaguar.jump)) + (jaguar (jump :addr jaguar.jump :sshfp "jaguar")) ;; Nicko's server. - (richmond (jump :addr richmond.jump)) + (richmond (jump :svc richmond.jump)) ;; Wired ethernet. (unsafe :net unsafe) @@ -212,12 +225,14 @@ (firebird :cname firebird.dhcp) (marauder :cname marauder.dhcp) (invader :cname invader.dhcp) + (gretsch :cname gretsch.dhcp) ;; Virtual network. (vpn :net vpn) (crybaby (vpn :addr crybaby.vpn :sshfp "crybaby")) (terror (vpn :addr terror.vpn :sshfp "terror")) (orange (vpn :addr orange.vpn :sshfp "orange")) + (haze (vpn :addr haze.vpn :sshfp "haze")) (iodine :net iodine) ;; ITS. @@ -231,12 +246,15 @@ ;; Delegations. (dhcp :ns ((radius.ns.dhcp :ip radius) (precision.ns.dhcp :ip precision) + (telecaster.ns.dhcp :ip telecaster) (vampire.ns.dhcp :ip vampire))) (dyn :ns ((radius.ns.dyn :ip radius) (precision.ns.dyn :ip precision) + (telecaster.ns.dyn :ip telecaster) (vampire.ns.dyn :ip vampire))) (dnserr :ns ((radius.ns.dnserr :ip radius.dmz) (precision.ns.dnserr :ip precision.jump) + (telecaster.ns.dnserr :ip telecaster) (vampire.ns.dnserr :ip vampire.dmz))) (io :ns ((ns.io :ip jazz.jump)))) @@ -249,9 +267,13 @@ (invader :addr invader.safe) (marauder :addr marauder.safe)) +(defzone nicko.org + (richmond :addr richmond.jump)) + (defrevzone trusted :ns (radius.distorted.org.uk. precision.distorted.org.uk. + telecaster.distorted.org.uk. vampire.distorted.org.uk.) :reverse unsafe :reverse vpn @@ -260,30 +282,63 @@ :reverse any (dhcp :ns (radius.distorted.org.uk. precision.distorted.org.uk. + telecaster.distorted.org.uk. vampire.distorted.org.uk.)) :multi (((dhcp safe) :family :ipv4 :suffix "199.29.172.dhcp") :cname *)) -(defrevzone dmz +(defrevzone (dmz :family :ipv6) :ns (radius.distorted.org.uk. precision.distorted.org.uk. + telecaster.distorted.org.uk. vampire.distorted.org.uk.) :reverse dmz) -(defrevzone jump +(defrevzone (dmz :family :ipv4) + (144-159 :ns (radius.distorted.org.uk. + precision.distorted.org.uk. + telecaster.distorted.org.uk. + vampire.distorted.org.uk.)) + :multi ((dmz :suffix "144-159") :cname *)) + +(defzone 144-159.204.49.62.in-addr.arpa + :ns (radius.distorted.org.uk. + precision.distorted.org.uk. + telecaster.distorted.org.uk. + vampire.distorted.org.uk.) + :reverse ((((:ipv4 dmz))))) + +(defrevzone (jump :family :ipv6) :ns (radius.distorted.org.uk. precision.distorted.org.uk. + telecaster.distorted.org.uk. vampire.distorted.org.uk.) :reverse jump) +(defrevzone (jump :family :ipv4) + (64-79 :ns (radius.distorted.org.uk. + precision.distorted.org.uk. + telecaster.distorted.org.uk. + vampire.distorted.org.uk.)) + :multi ((jump :suffix "64-79") :cname *)) + +(defzone 64-79.198.13.212.in-addr.arpa + :ns (radius.distorted.org.uk. + precision.distorted.org.uk. + telecaster.distorted.org.uk. + vampire.distorted.org.uk.) + :reverse ((((:ipv4 jump))))) + (defrevzone distorted.org.uk-he :ns (radius.distorted.org.uk. precision.distorted.org.uk. + telecaster.distorted.org.uk. vampire.distorted.org.uk.) :reverse distorted.org.uk-he) (defrevzone distorted.org.uk-jump :ns (radius.distorted.org.uk. precision.distorted.org.uk. + telecaster.distorted.org.uk. vampire.distorted.org.uk.) :reverse distorted.org.uk-jump)