X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;ds=sidebyside;f=modules%2Fdebian-org%2Fmisc%2Fhoster.yaml;h=2e46936d9cc2953e252cc9d1ff618c5c06b927b5;hb=6953554a8be471aee27e59e3c9465362c1f8ce49;hp=d0230310180cdaef7e4ec8567a370ddab1b693f4;hpb=c476bb2c103108a96b5dbeb5e34d48725ba168b0;p=mirror%2Fdsa-puppet.git

diff --git a/modules/debian-org/misc/hoster.yaml b/modules/debian-org/misc/hoster.yaml
index d02303101..2e46936d9 100644
--- a/modules/debian-org/misc/hoster.yaml
+++ b/modules/debian-org/misc/hoster.yaml
@@ -37,10 +37,13 @@ brainfood:
     - 70.103.162.0/24
   searchpaths: [debprivate-brainfood.debian.org]
   nameservers: [70.103.162.29, 70.103.162.4]
+  # master accepts queries from murphy
+  allow_dns_query: [70.103.162.31/32]
 brown:
   netrange:
     - 128.148.0.0/16
-  nameservers: [128.148.34.103, 128.148.34.3]
+  # all hosts have their own recursor
+  nameservers: []
 carnet:
   netrange:
     - 193.198.0.0/16
@@ -73,8 +76,10 @@ freenet:
 ftcollins:
   netrange:
     - 192.25.206.0/24
-  searchpaths: [debprivate-debprivate-ftcollins.debian.org]
+  searchpaths: [debprivate-ftcollins.debian.org]
   nameservers: [192.25.206.33, 192.25.206.57]
+  # only applicable for hosts that are recursive anyway:
+  allow_dns_query: [192.25.206.0/24]
 grnet:
   netrange:
     - 194.177.211.192/27
@@ -102,9 +107,12 @@ osuosl:
 sanger:
   netrange:
     - 193.62.202.24/29
-  nameservers: [193.62.203.96, 193.62.203.97]
+  # broken with dnssec
+  # nameservers: [193.62.203.96, 193.62.203.97]
+  #resolvoptions: [single-request]
+  nameservers: [193.62.202.28, 193.62.202.29]
   searchpaths: [debprivate-sanger.debian.org]
-  resolvoptions: [single-request]
+  allow_dns_query: [193.62.202.24/29]
 rapidswitch:
   netrange:
     - 193.201.200.0/23
@@ -134,6 +142,7 @@ ubcece:
     - 206.12.19.0/24
   searchpaths: [debprivate-ubc.debian.org]
   nameservers: [206.12.19.5, 137.82.1.1, 142.103.1.1]
+  allow_dns_query: [137.82.84.64/27, 206.12.19.0/24]
 ugent:
   netrange:
     - 157.193.0.0/16
@@ -146,7 +155,9 @@ utwente:
   netrange:
     - 130.89.0.0/16
     - 2001:0610:1908::/48
-  nameservers: [130.89.2.2, 130.89.2.3]
+  # broken with dnssec
+  #nameservers: [130.89.2.2, 130.89.2.3]
+  nameservers: []
 xs4all:
   netrange:
     - 194.109.137.216/29