From 8f9ca5e1c47ed590ab1c6b2d2930996356975d28 Mon Sep 17 00:00:00 2001 From: Jack O'Sullivan Date: Sun, 2 Aug 2026 01:07:03 +0100 Subject: [PATCH] nixos/dns: Allow internal zone transfers Permit AXFR from shared internal networks and cross-site egress addresses while retaining loopback and the existing secondary. --- nixos/boxes/colony/vms/estuary/dns.nix | 6 +++++- nixos/boxes/home/routing-common/dns.nix | 6 ++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/nixos/boxes/colony/vms/estuary/dns.nix b/nixos/boxes/colony/vms/estuary/dns.nix index 3c9614d..189bfc2 100644 --- a/nixos/boxes/colony/vms/estuary/dns.nix +++ b/nixos/boxes/colony/vms/estuary/dns.nix @@ -114,8 +114,12 @@ in ]; also-notify = [ "127.0.0.1" ]; allow-axfr-ips = [ + "127.0.0.0/8" "::1/128" "216.218.133.2" "2001:470:600::2" - ]; + ] + ++ lib.my.c.home.routersPubV4 + ++ lib.my.c.as211024.trusted.v4 + ++ lib.my.c.as211024.trusted.v6; enable-lua-records = true; #loglevel = 7; #log-dns-queries = true; diff --git a/nixos/boxes/home/routing-common/dns.nix b/nixos/boxes/home/routing-common/dns.nix index f08b03f..bc1a8cf 100644 --- a/nixos/boxes/home/routing-common/dns.nix +++ b/nixos/boxes/home/routing-common/dns.nix @@ -170,6 +170,12 @@ in "0.0.0.0:5353" "[::]:5353" ]; also-notify = [ "127.0.0.1" ]; + allow-axfr-ips = [ + "127.0.0.0/8" "::1/128" + allAssignments.estuary.internal.ipv4.address + ] + ++ lib.my.c.as211024.trusted.v4 + ++ lib.my.c.as211024.trusted.v6; enable-lua-records = true; # loglevel = 7; # log-dns-queries = true;