X-Git-Url: https://git.distorted.org.uk/~mdw/zones/blobdiff_plain/8aa87005e1508ebae669db1dfee764cd94e09033..6e726a18bfcc238ff9116b89e58b89dc7b073e39:/distorted.lisp diff --git a/distorted.lisp b/distorted.lisp index 4c2c8c1..aa93638 100644 --- a/distorted.lisp +++ b/distorted.lisp @@ -16,7 +16,7 @@ ;; IPv6 anycast addresses are globally routable, while IPv4 ones aren't. (if (zone-preferred-subnet-p (car any-provider)) (zone-set-address #'rec (cdr any-provider) :make-ptr-p t) - (dolist (addr (host-addrs (host-parse (cdr any-provider)))) + (do-host (addr (cdr any-provider)) (let ((family (ipaddr-family addr))) (if (member family *anycast-routable-families*) (zone-set-address #'rec addr @@ -28,9 +28,10 @@ (dolist (provider (list* any-provider default-provider other-providers)) (zone-set-address #'rec (cdr provider) :make-ptr-p (eq provider any-provider) - :name (concatenate 'string prefix "." - (string-downcase (car provider)) - "." (string-downcase zname)))))) + :name (domain-name-concat prefix + (zone-parse-host + (car provider) + zname)))))) ;;;-------------------------------------------------------------------------- ;;; Other definitions. @@ -47,15 +48,17 @@ ;; Nameservers. :ns #+view/inside ((radius.ns :ip radius) (precision.ns :ip precision) + (telecaster.ns :ip telecaster) (vampire.ns :ip vampire)) #-view/inside ((radius.ns :ip radius) (precision.ns :ip precision) + (telecaster.ns :ip telecaster) (mythic-beasts-1.ns :ip mythic-ns1) (mythic-beasts-2.ns :ip mythic-ns2) (chiark.ns :ip chiark.greenend.org.uk)) ;; Mail servers. - ((@ mail) + ((@ mail blackhole) :mx mail :srv ((:smtp mail))) ((lists bugs cryptomail) @@ -131,15 +134,25 @@ (evolution :alias evo) ;; Colocated services. - ((irc vox) (colo :svc jazz.colo :sshfp "jazz") - (jump :svc jazz.jump :sshfp "jazz")) + ((irc vox keys) (colo :svc jazz.colo :sshfp "jazz") + (jump :svc jazz.jump :sshfp "jazz")) ((git www mail) (colo :svc stratocaster.colo :sshfp "stratocaster") (jump :svc stratocaster.jump :sshfp "stratocaster")) + ((www @) :tlsa (:https (:service-certificate-constraint + :certificate :sha-256 #p"http-server-www#1"))) + (git :tlsa (:https (:trust-anchor-assertion + :certificate :sha-256 #p"distorted-ca"))) + (www-cache :tlsa (3127 (:trust-anchor-assertion + :certificate :sha-256 #p"distorted-ca"))) + (mail :tlsa ((:smtp :submission :imap) + (:trust-anchor-assertion + :certificate :sha-256 #p"distorted-ca"))) :svc #+view/inside stratocaster.colo #-view/inside stratocaster.jump (cabal :svc stratocaster.colo :sshfp "stratocaster") ((db ftp) (colo :svc telecaster.colo :sshfp "telecaster") (jump :svc telecaster.jump :sshfp "telecaster")) + (dyndns :svc telecaster.jump :sshfp "telecaster") ;; Local services. ((rawk pifi) (unsafe :svc artist.unsafe) @@ -158,7 +171,7 @@ (dmz :addr anon.dmz)) ;; Fancy connectivity. - (iodine (jump :addr jazz.jump)) + (iodine (jump :svc jazz.jump)) ;; Colocated hosts. (colo :net colo) @@ -179,10 +192,10 @@ (iodine :addr jazz.iodine :sshfp "jazz")) ;; Media server (on loan to Good Technology HSTG). - (jaguar (jump :addr jaguar.jump)) + (jaguar (jump :addr jaguar.jump :sshfp "jaguar")) ;; Nicko's server. - (richmond (jump :addr richmond.jump)) + (richmond (jump :svc richmond.jump)) ;; Wired ethernet. (unsafe :net unsafe) @@ -212,12 +225,15 @@ (firebird :cname firebird.dhcp) (marauder :cname marauder.dhcp) (invader :cname invader.dhcp) + (gretsch :cname gretsch.dhcp) ;; Virtual network. (vpn :net vpn) (crybaby (vpn :addr crybaby.vpn :sshfp "crybaby")) (terror (vpn :addr terror.vpn :sshfp "terror")) (orange (vpn :addr orange.vpn :sshfp "orange")) + (haze (vpn :addr haze.vpn :sshfp "haze")) + (groove (vpn :addr groove.vpn :sshfp "groove")) (iodine :net iodine) ;; ITS. @@ -231,21 +247,34 @@ ;; Delegations. (dhcp :ns ((radius.ns.dhcp :ip radius) (precision.ns.dhcp :ip precision) + (telecaster.ns.dhcp :ip telecaster) (vampire.ns.dhcp :ip vampire))) (dyn :ns ((radius.ns.dyn :ip radius) (precision.ns.dyn :ip precision) + (telecaster.ns.dyn :ip telecaster) (vampire.ns.dyn :ip vampire))) (dnserr :ns ((radius.ns.dnserr :ip radius.dmz) (precision.ns.dnserr :ip precision.jump) + (telecaster.ns.dnserr :ip telecaster) (vampire.ns.dnserr :ip vampire.dmz))) (io :ns ((ns.io :ip jazz.jump)))) ;;;-------------------------------------------------------------------------- ;;; Other subsidiary zones. +(defzone dhcp.distorted.org.uk + (gibson :addr gibson.unsafe) + (lespaul :addr lespaul.safe) + (invader :addr invader.safe) + (marauder :addr marauder.safe)) + +(defzone nicko.org + (richmond :addr richmond.jump)) + (defrevzone trusted :ns (radius.distorted.org.uk. precision.distorted.org.uk. + telecaster.distorted.org.uk. vampire.distorted.org.uk.) :reverse unsafe :reverse vpn @@ -254,21 +283,66 @@ :reverse any (dhcp :ns (radius.distorted.org.uk. precision.distorted.org.uk. + telecaster.distorted.org.uk. vampire.distorted.org.uk.)) :multi (((dhcp safe) :family :ipv4 :suffix "199.29.172.dhcp") :cname *)) -(defrevzone dmz +(defrevzone (dmz :family :ipv6) :ns (radius.distorted.org.uk. precision.distorted.org.uk. + telecaster.distorted.org.uk. vampire.distorted.org.uk.) :reverse dmz) -(defrevzone jump +(defrevzone (dmz :family :ipv4) + (144-159 :ns (radius.distorted.org.uk. + precision.distorted.org.uk. + telecaster.distorted.org.uk. + vampire.distorted.org.uk.)) + :multi ((dmz :suffix "144-159") :cname *)) + +(defzone 144-159.204.49.62.in-addr.arpa + :ns (radius.distorted.org.uk. + precision.distorted.org.uk. + telecaster.distorted.org.uk. + vampire.distorted.org.uk.) + :reverse ((((:ipv4 dmz))))) + +(defrevzone (jump :family :ipv6) :ns (radius.distorted.org.uk. precision.distorted.org.uk. + telecaster.distorted.org.uk. vampire.distorted.org.uk.) :reverse jump) +(defrevzone (jump :family :ipv4) + (64-79 :ns (radius.distorted.org.uk. + precision.distorted.org.uk. + telecaster.distorted.org.uk. + vampire.distorted.org.uk.)) + :multi ((jump :suffix "64-79") :cname *)) + +(defzone 64-79.198.13.212.in-addr.arpa + :ns (radius.distorted.org.uk. + precision.distorted.org.uk. + telecaster.distorted.org.uk. + vampire.distorted.org.uk.) + :reverse ((((:ipv4 jump))))) + +(defrevzone distorted.org.uk-he + :ns (radius.distorted.org.uk. + precision.distorted.org.uk. + telecaster.distorted.org.uk. + vampire.distorted.org.uk.) + :reverse distorted.org.uk-he) + +(defrevzone distorted.org.uk-jump + :ns (radius.distorted.org.uk. + precision.distorted.org.uk. + telecaster.distorted.org.uk. + vampire.distorted.org.uk.) + :reverse distorted.org.uk-jump) + (defzone io.distorted.org.uk :ns ((ns :ip jazz.jump)) (about :txt "Fake zone used for IP-over-DNS tunnelling."))