X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fnamed%2Fmanifests%2Fprimary.pp;h=5ea94db03b741a039d1d8570eec56671478fd6ad;hb=d8771588931a22ede77529bb5ac4ca9340123516;hp=3e579ea5db2eefeaa3c085138a438e766803ace0;hpb=fe40a51bd33f4617c6f69c42efa81dd0a8c253c6;p=mirror%2Fdsa-puppet.git

diff --git a/modules/named/manifests/primary.pp b/modules/named/manifests/primary.pp
index 3e579ea5d..5ea94db03 100644
--- a/modules/named/manifests/primary.pp
+++ b/modules/named/manifests/primary.pp
@@ -24,6 +24,8 @@ class named::primary inherits named::authoritative {
 		target => '/etc/bind/named.conf.puppet-misc',
 		order  => '020',
 		content  => @("EOF"/$)
+			// MAINTAIN-KEY: _openpgpkey.debian.org
+
 			zone "_openpgpkey.debian.org" {
 				type slave;
 				file "db._openpgpkey.debian.org";
@@ -38,8 +40,28 @@ class named::primary inherits named::authoritative {
 					dnsnodeapi-ACL;
 				};
 				also-notify {
+					rcode0-masters;
+					dnsnode-masters;
+					dnsnodeapi-masters;
 				};
+
+				key-directory "/srv/dns.debian.org/var/keys/_openpgpkey.debian.org";
+				sig-validity-interval 40 25;
+				auto-dnssec maintain;
+				inline-signing yes;
 			};
 			| EOF
 	}
+
+	concat::fragment { 'dsa-puppet-stuff--nsec3':
+		target => '/etc/cron.d/dsa-puppet-stuff',
+		content  => @(EOF)
+			13 19 4 * * root chronic /usr/sbin/rndc signing -nsec3param 1 0 16 $(head -c 20 /dev/urandom | sha512sum | cut -b 1-10) debian.net
+			29 12 7 * * root chronic /usr/sbin/rndc signing -nsec3param 1 0 16 $(head -c 20 /dev/urandom | sha512sum | cut -b 1-10) debian.org
+			32 12 7 * * root chronic /usr/sbin/rndc signing -nsec3param 1 0 16 $(head -c 20 /dev/urandom | sha512sum | cut -b 1-10) debconf.org
+			36 12 7 * * root chronic /usr/sbin/rndc signing -nsec3param 1 0 16 $(head -c 20 /dev/urandom | sha512sum | cut -b 1-10) _openpgpkey.debian.org
+
+			| EOF
+	}
+
 }