ci/docs: Fall back to discovered servers for AXFR

The DNS reference generator transfers each zone from the nameservers
public NS discovery returns. The home IPv6 reverse zone
(0.d.4.0.0.c.7.9.e.0.a.2.ip6.arpa) is delegated only to Hurricane
Electric, which refuses AXFR, so generation aborted before committing
any zone. Our own authoritative servers (ns1/ns2.h.nul.ie) serve that
zone and permit transfers but aren't in its public delegation, as their
addresses are dynamic.

When a zone's delegated servers all refuse, retry against the union of
nameservers discovered for every other zone. That pool includes
ns1/ns2.h.nul.ie via the h.nul.ie NS records, resolved to their current
addresses at query time, so the reverse zone transfers from the same
reachable servers h.nul.ie already uses. Zones whose own servers work
are unaffected; the fallback only runs after their transfers fail.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

AGENTS.md

@@ -46,7 +46,10 @@ Common ones:
   Pass the flake-qualified node, e.g. `deploy .#git`. The deploy node name is **always** the system
   name (`deploy-rs.nix` keys nodes directly off `nixos.systems` / `home-manager.homes`); a system is
   only a deploy target when `config.my.deploy.enable` is true (defaults true; auto-disabled for dev
-  VMs and containers). Pass `--boot` to stage a config as the boot default **without** live-switching
+  VMs and containers). A container is **not** its own deploy node — it is generated as a
+  `container-<name>` profile on its **host** node. So `deploy .#<host>` deploys the host's `system`
+  profile and every one of its containers, whereas `deploy .#<host>.container-<name>` targets a
+  single container (e.g. `deploy .#shill.container-middleman`). Pass `--boot` to stage a config as the boot default **without** live-switching
   (`deploy --boot .#<host>`) — the box keeps running its current generation until it reboots. Use this
   when a live `switch` would break connectivity mid-change (e.g. a router's WAN VLAN rework), then
   reboot to cut over.

ci/update-docs-dns.py

@@ -144,9 +144,19 @@ def discover_nameservers(domains: list[str], port: int) -> dict[str, list[str]]:
     return discovered
 
 
-def transfer_domain(port: int, domain: str, servers: list[str]) -> list[Record]:
+def transfer_domain(
+    port: int, domain: str, servers: list[str], fallback: list[str] = ()
+) -> list[Record]:
+    # A zone may be delegated publicly to servers that refuse AXFR (e.g. HE serving
+    # reverse DNS) while our own authoritative servers, discovered for other zones,
+    # will transfer it. Try the delegated servers first, then fall back to those.
+    ordered = list(servers)
+    for server in fallback:
+        if server not in ordered:
+            ordered.append(server)
+
     errors = []
-    for server in servers:
+    for server in ordered:
         try:
             return transfer(server, port, domain)
         except RuntimeError as error:
@@ -325,8 +335,13 @@ def main() -> int:
 
     try:
         nameservers = discover_nameservers(args.domain, args.port)
+        fallback = []
+        for servers in nameservers.values():
+            for server in servers:
+                if server not in fallback:
+                    fallback.append(server)
         transferred = [
-            (domain, transfer_domain(args.port, domain, nameservers[domain]))
+            (domain, transfer_domain(args.port, domain, nameservers[domain], fallback))
             for domain in args.domain
         ]
     except RuntimeError as error:

docs/README.md

@@ -64,7 +64,7 @@ h.nul.ie
 ├── palace (physical VM host — AMD, 100G, SR-IOV)
 │   ├── river ── primary router VM (PPPoE / Digiweb WAN)
 │   ├── cellar ─ NVMe-oF / SPDK storage target VM
-│   └── sfh ──── container host VM ("services for home")
+│   └── sfh ──── container host VM ("shill from home")
 │       ├── hass ── Home Assistant + Frigate + MQTT (container)
 │       └── unifi ─ UniFi controller (container)
 ├── stream (physical secondary router — Virgin Media WAN)

docs/sites/home/sfh/README.md

@@ -1,6 +1,6 @@
 # sfh
 
-"Services for home" — the NixOS container host for the home site. A VM on `palace` that netboots
+"Shill from home" — the NixOS container host for the home site. A VM on `palace` that netboots
 from `river` and runs its root off NVMe-oF from `cellar`.
 
 - **Source:** [`nixos/boxes/home/palace/vms/sfh/`](../../../../nixos/boxes/home/palace/vms/sfh)

lib/default.nix

@@ -149,6 +149,10 @@ rec {
       (optional (a.ipv6.gateway != null) a.ipv6.gateway);
     networkConfig = {
       IPv6AcceptRA = a.ipv6.gateway == null || a.ipv6.iid != null;
+      # These are servers: temporary (privacy) addresses only rotate our stable source
+      # address out from under long-lived connected sockets (e.g. nginx's resolver, which
+      # wedges permanently when the address it bound to expires).
+      IPv6PrivacyExtensions = "no";
       # NOTE: LLDP emission / reception is ignored on bridge interfaces
       LLDP = true;
       EmitLLDP = "customer-bridge";

nixos/boxes/colony/vms/shill/containers/toot.nix

@@ -48,8 +48,9 @@ in
                   "s3-secret-key.txt"
                 ])
                 (_: with config.services.mastodon; {
-                  owner = user;
+                  # user doesn't exist any more, so this breaks on deploy
-                  inherit group;
+                  # owner = user;
+                  # inherit group;
                 })) // {
                   "toot/pds.env" = {
                     owner = "pds";