nixos/dns: Allow internal zone transfers

Permit AXFR from shared internal networks and cross-site egress addresses while retaining loopback and the existing secondary.
2026-08-02 01:07:03 +01:00
parent 08605ab422
commit 8f9ca5e1c4
2 changed files with 11 additions and 1 deletions
@@ -170,6 +170,12 @@ in
          "0.0.0.0:5353" "[::]:5353"
        ];
        also-notify = [ "127.0.0.1" ];
+        allow-axfr-ips = [
+          "127.0.0.0/8" "::1/128"
+          allAssignments.estuary.internal.ipv4.address
+        ]
+        ++ lib.my.c.as211024.trusted.v4
+        ++ lib.my.c.as211024.trusted.v6;
        enable-lua-records = true;
        # loglevel = 7;
        # log-dns-queries = true;