do nsec3 via puppet

[mirror/dsa-puppet.git] / modules / named / manifests / primary.pp

diff --git a/modules/named/manifests/primary.pp b/modules/named/manifests/primary.pp
index 3e579ea..800c536 100644 (file)
--- a/modules/named/manifests/primary.pp
+++ b/modules/named/manifests/primary.pp
@@ -24,6 +24,8 @@ class named::primary inherits named::authoritative {
                target => '/etc/bind/named.conf.puppet-misc',
                order  => '020',
                content  => @("EOF"/$)
+                       // MAINTAIN-KEY: _openpgpkey.debian.org
+
                        zone "_openpgpkey.debian.org" {
                                type slave;
                                file "db._openpgpkey.debian.org";
@@ -39,7 +41,24 @@ class named::primary inherits named::authoritative {
                                };
                                also-notify {
                                };
+
+                               key-directory "/srv/dns.debian.org/var/keys/_openpgpkey.debian.org";
+                               sig-validity-interval 40 25;
+                               auto-dnssec maintain;
+                               inline-signing yes;
                        };
                        | EOF
        }
+
+       concat::fragment { 'dsa-puppet-stuff--nsec3':
+               target => '/etc/cron.d/dsa-puppet-stuff',
+               content  => @(EOF)
+                       13 19 4 * * root chronic /usr/sbin/rndc signing -nsec3param 1 0 16 $(head -c 20 /dev/urandom | sha512sum | cut -b 1-10) debian.net
+                       29 12 7 * * root chronic /usr/sbin/rndc signing -nsec3param 1 0 16 $(head -c 20 /dev/urandom | sha512sum | cut -b 1-10) debian.org
+                       32 12 7 * * root chronic /usr/sbin/rndc signing -nsec3param 1 0 16 $(head -c 20 /dev/urandom | sha512sum | cut -b 1-10) debconf.org
+                       36 12 7 * * root chronic /usr/sbin/rndc signing -nsec3param 1 0 16 $(head -c 20 /dev/urandom | sha512sum | cut -b 1-10) _openpgpkey.debian.org
+
+                       | EOF
+       }
+
 }