nixos/dns: Allow internal zone transfers

Permit AXFR from shared internal networks and cross-site egress addresses while retaining loopback and the existing secondary.
2026-08-02 01:07:03 +01:00
parent 08605ab422
commit 8f9ca5e1c4
2 changed files with 11 additions and 1 deletions
@@ -114,8 +114,12 @@ in
        ];
        also-notify = [ "127.0.0.1" ];
        allow-axfr-ips = [
+          "127.0.0.0/8" "::1/128"
          "216.218.133.2" "2001:470:600::2"
-        ];
+        ]
+        ++ lib.my.c.home.routersPubV4
+        ++ lib.my.c.as211024.trusted.v4
+        ++ lib.my.c.as211024.trusted.v6;
        enable-lua-records = true;
        #loglevel = 7;
        #log-dns-queries = true;