X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fnamed%2Fmanifests%2Fprimary.pp;h=5f3f6beed3c16243e65ffd78114f8e57f26aa872;hb=584f12fb4c5f6ce47a187868570f439f543b635d;hp=e16ddb6bb7b47ab64e96e1b7f565969e17c5a2a9;hpb=683ffc212c9c3a4d7e4a4ff98c94fb52a75a02ca;p=mirror%2Fdsa-puppet.git

diff --git a/modules/named/manifests/primary.pp b/modules/named/manifests/primary.pp
index e16ddb6bb..5f3f6beed 100644
--- a/modules/named/manifests/primary.pp
+++ b/modules/named/manifests/primary.pp
@@ -1,3 +1,63 @@
+# our primary nameserver
+#
+# it will not, by default, open the firewall for requests.
 class named::primary inherits named::authoritative {
-	include dnsextras::entries;
+  include dnsextras::entries
+
+  concat::fragment { 'dsa-named-conf-puppet-misc---local-shared-keys':
+    target  => '/etc/bind/named.conf.puppet-misc',
+    order   => '020',
+    content => @(EOF),
+      include "/etc/bind/named.conf.shared-keys";
+      | EOF
+  }
+  concat::fragment { 'dsa-named-conf-puppet-misc---named.conf.external-secondaries-ACLs':
+    target  => '/etc/bind/named.conf.puppet-misc',
+    order   => '025',
+    content => template('named/named.conf.external-secondaries-ACLs.erb'),
+  }
+
+  concat::fragment { 'dsa-named-conf-puppet-misc---openpgpkey-zone':
+    target  => '/etc/bind/named.conf.puppet-misc',
+    order   => '020',
+    content => @("EOF"/$)
+      // MAINTAIN-KEY: _openpgpkey.debian.org
+
+      zone "_openpgpkey.debian.org" {
+        type slave;
+        file "db._openpgpkey.debian.org";
+        allow-query { any; };
+        masters {
+          ${ join(getfromhash($deprecated::allnodeinfo, 'kaufmann.debian.org', 'ipHostNumber'), ";") } ;
+        };
+        allow-transfer {
+          127.0.0.1;
+          rcode0-ACL;
+          dnsnode-ACL;
+          dnsnodeapi-ACL;
+        };
+        also-notify {
+          rcode0-masters;
+          dnsnode-masters;
+          dnsnodeapi-masters;
+        };
+
+        key-directory "/srv/dns.debian.org/var/keys/_openpgpkey.debian.org";
+        sig-validity-interval 40 25;
+        auto-dnssec maintain;
+        inline-signing yes;
+      };
+      | EOF
+  }
+
+  concat::fragment { 'puppet-crontab--nsec3':
+    target  => '/etc/cron.d/puppet-crontab',
+    content => @(EOF)
+      13 19 4 * * root chronic /usr/sbin/rndc signing -nsec3param 1 0 16 $(head -c 20 /dev/urandom | sha512sum | cut -b 1-10) debian.net
+      29 12 7 * * root chronic /usr/sbin/rndc signing -nsec3param 1 0 16 $(head -c 20 /dev/urandom | sha512sum | cut -b 1-10) debian.org
+      32 12 7 * * root chronic /usr/sbin/rndc signing -nsec3param 1 0 16 $(head -c 20 /dev/urandom | sha512sum | cut -b 1-10) debconf.org
+      36 12 7 * * root chronic /usr/sbin/rndc signing -nsec3param 1 0 16 $(head -c 20 /dev/urandom | sha512sum | cut -b 1-10) _openpgpkey.debian.org
+
+      | EOF
+  }
 }