@@ -1,8 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 cvV2sw k345zazI4/8dA1Vkke0xERSdsU7EsGTNcvHSE9TbDWc
-KlOyISrMdU8XayjiZfniL3H3MlQLOjnsDP3LJfgOIH8
--> piv-p256 VBDKjg AqyLuqq0lUxasLjw3gLqILL85rkQr3i0OknsowYyyTnz
-3n69UioxMUucbtyNdxGHg5F2EQjovzLWLKljNjo/Rm8
---- 08CDPTwZRoD6lFsyeUaiDzDKdedmd1Jqiq91Zr46LR4
-�|��H�^~��,͑�0�S#؃P09)4�f�%g+�;�]�57v����d1M��V�>X,��T�ݦ�>b89m
-��C�e�TvF��Vm�;�e+���҃R�
��+-> ssh-ed25519 cvV2sw uMAGCIbnLNTE3yBLAC5aVPPVdgneTzrjbiWm+nSAFWQ
+cwwXM5vg21kZt3FlDeDi6wZSgShvk74AvUCVIn1wfRs
+-> ssh-ed25519 knHzXw TtpbaK0bOtErW1+8BNby1pulKGEbeiv9rlJriu9Yb10
+QLy4IIcK0nBLoWiF6KrBB7R6NMpRP3h/r5taKhrq6LU
+-> piv-p256 VBDKjg A9JcjvBdYvFKC6cV6Z5JM2A5mBVQcFuJTxIolaFABLUn
+S3SUlttHTN6cfKyiJDhKdehV9n9z6vQmF7+nY2UBLik
+--- CU2/xw7PnEcKQAT/arx8xDs4TXton5BbBGOrGmCUynw
+�B��^�v:1�k���N�n�e�������"%��`��;ͪ�<��ҤM�DXx�P��g1��E�J�)]v��)Y�@>PD�~s�؜�ܑ���2]贾�aQ�?5�3

@@ -27,7 +27,7 @@ ];
     pocket-id = [ linde ];
     binarycache = [ linde ];
     paperless = [ linde ];
-    powerdns = [ linde ];
+    powerdns = [ smrk ];
     cifs-paperless = [ linde ];
     cifs-transmission = [ linde ];
     cifs-jellyfin = [ linde ];

@@ -28,7 +28,6 @@ ./linde-hardware.nix
 
     ../roles/server.nix
     ../roles/reverse-proxy.nix
-    ../roles/auth-dns.nix
     ../roles/binary-cache.nix
     ../roles/calendar-anonymiser.nix
     ../roles/file-server.nix
@@ -159,8 +158,4 @@ # this value at the release version of the first install of this system.
   # Before changing this value read the documentation for this option
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
   system.stateVersion = "23.05"; # Did you read the comment?
-
-  services.powerdns.extraConfig = ''
-    local-address=${net-ip4} ${net-ip6}
-  '';
 }

@@ -9,6 +9,8 @@ in
 {
   imports = [
     ../roles/server.nix
+
+    ../roles/auth-dns.nix
     ../roles/ci.nix
     ../roles/reverse-proxy.nix
     ../roles/forgejo-runner.nix

@@ -1,28 +1,17 @@
 {
   config,
   pkgs,
-  lib,
   ...
 }:
 let
-  inherit (lib.lists) flatten;
-  inherit (lib.strings) concatStringsSep;
-  he = {
-    notify = "216.218.130.2";
-    axfr = [
-      "216.218.133.2"
-      "2001:470:600::2"
-    ];
-  };
-  iplist = ips: concatStringsSep "," (flatten ips);
-
   domain = config.networking.domain;
 in
 {
-  age.secrets.powerdns.file = ../../secrets/powerdns.age;
   imports = [
     ../settings/programs/sqlite.nix
   ];
+
+  age.secrets.powerdns.file = ../../secrets/powerdns.age;
 
   networking.firewall = {
     allowedTCPPorts = [ 53 ];
@@ -33,20 +22,17 @@ services.powerdns = {
     enable = true;
     secretFile = config.age.secrets.powerdns.path;
     extraConfig = ''
+      local-address=::
       launch=gsqlite3
       dnsupdate=yes
       allow-dnsupdate-from=0.0.0.0/0,::/0
-      only-notify=
-      also-notify=${iplist [ he.notify ]}
-      allow-axfr-ips=${iplist [ he.axfr ]}
       expand-alias=yes
-      outgoing-axfr-expand-alias=yes
-      resolver=1.1.1.1
+      outgoing-axfr-expand-alias=yes # needed with DNSSEC
+      resolver=127.0.0.53
       log-dns-details=no
       log-dns-queries=no
       loglevel=5
       primary=yes
-      send-signed-notify=no
 
       default-api-rectify=yes
       default-soa-edit=inception-increment