commit 54a8122c611f91cabaf73fb0bfe302339fb545d9
parent 66aa2b156c96e9bc2e9183d712f1f1ee6c67b40b
Author: Vineet Kumar <git@vineetk.net>
Date: Fri, 17 Apr 2026 12:33:58 -0400
demiurge, hastur: move main unbound to saklas
sometimes there's routing problems like cogent not having peering to
some of cira's tld nameservers. problems which don't exist with a
proper backbone, which saklas is on.
Diffstat:
2 files changed, 12 insertions(+), 54 deletions(-)
diff --git a/epistemia/systems/demiurge.scm b/epistemia/systems/demiurge.scm
@@ -152,7 +152,7 @@
`(("resolv.conf"
,(plain-file "epistemia_resolv.conf"
(string-append
- "nameserver 127.0.0.1\n"
+ "nameserver ::1\n"
"search epistemia\n")))))
(service openssh-service-type
(openssh-configuration
@@ -164,46 +164,16 @@
(unbound-configuration
(server
(unbound-server
- (interface '("127.0.0.1"
- "::1"
- "10.0.13.2"))
+ (interface '("::1"))
(hide-version #t)
- (hide-identity #t)))
+ (hide-identity #t)
+ (extra-options '((ip-freebind . "yes" )
+ (aggressive-nsec . "no")))))
(forward-zone
(list
(unbound-zone
(name ".")
- (forward-addr '("192.168.1.1")))))
- (extra-content "\
-server:
- access-control: 127.0.0.0/8 allow
- access-control: 10.0.13.0/24 allow
- access-control: ::1 allow
-
- ip-freebind: yes
- aggressive-nsec: no
- module-config: \"respip validator iterator\"
-
- local-data: \"demiurge.epistemia. 86400 IN A 10.0.13.2\"
- local-data: \"demiurge.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::2\"
- local-data: \"hastur.epistemia. 86400 IN A 10.0.13.3\"
- local-data: \"hastur.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::3\"
- local-data: \"iphonebob.epistemia. 86400 IN A 10.0.13.4\"
- local-data: \"iphonebob.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::4\"
- local-data: \"lab.epistemia. 86400 IN A 10.0.13.5\"
- local-data: \"lab.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::5\"
- local-data: \"saklas.epistemia. 86400 IN A 10.0.13.1\"
- local-data: \"saklas.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::1\"
- local-zone: \"demiurge.epistemia.\" redirect
- local-zone: \"hastur.epistemia.\" redirect
- local-zone: \"iphonebob.epistemia.\" redirect
- local-zone: \"lab.epistemia.\" redirect
- local-zone: \"saklas.epistemia.\" redirect
-
-rpz:
- name: \"hagezi.ultimate\"
- zonefile: \"hagezi.ultimate\"
- url: /data/src/clones/networking/hagezi_dns-blocklists/rpz/ultimate.txt")))
+ (forward-addr '("10.0.13.1")))))))
(service wireguard-service-type
(wireguard-configuration
(interface "wg0")
diff --git a/epistemia/systems/hastur.scm b/epistemia/systems/hastur.scm
@@ -124,31 +124,19 @@
(unbound-configuration
(server
(unbound-server
- (interface '("127.0.0.1"
- "::1"
- "10.0.13.2"))
+ (interface '("::1"))
(hide-version #t)
(hide-identity #t)
(extra-options '((ip-freebind . yes)
- (aggressive-nsec . no)
- (module-config . "respip validator iterator")))))
+ (aggressive-nsec . no)))))
(forward-zone
(list
(unbound-zone
(name ".")
- (forward-addr '("9.9.9.9")))
+ (forward-addr '("10.0.13.1")))
(unbound-zone
- (name "epistemia.")
- (forward-addr '("10.0.13.2")))))
- (extra-content "\
-server:
- access-control: 127.0.0.0/8 allow
- access-control: 10.0.13.0/24 allow
- access-control: ::1 allow
-
-rpz:
- name: hagezi.ultimate
- url: https://raw.githubusercontent.com/hagezi/dns-blocklists/refs/heads/main/rpz/ultimate.txt\n")))
+ (name "carcosa.13f0.net.")
+ (forward-addr '("9.9.9.9")))))))
(service dhcpcd-service-type
(dhcpcd-configuration
(option '("rapid_commit" "interface_mtu"))
@@ -157,7 +145,7 @@ rpz:
"domain_name_servers"
"domain_name"
"domain_search"))
- (static '("domain_name_servers=127.0.0.1"
+ (static '("domain_name_servers=::1"
"domain_search=epistemia"))
(no-hook '("hostname"))))
(service wpa-supplicant-service-type
