<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">Am 02.07.2023 um 16:41 schrieb Matthew
Seaman:<br>
</div>
<blockquote type="cite"
cite="mid:171782fb-c1d9-5bee-0617-6356eefd8e72@infracaninophile.co.uk">Personally,
I maintain zone files with DNSSEC signing on FreeBSD using the
dns/p5-DNS-nsdiff port, which is a perl module written by Tony
Finch -- someone well known on this list.
<br>
<br>
You can keep your zone files in git or whatever code repository
suits you. nsdiff will compare what's live in your DNS zone
against whats in your updated zone file and generate a script for
nsupdate(1) to make the former match the latter.
<br>
<br>
You'll need to configure appropriate levels of access for
nsupdate(1). That can be from pretty much any machine given you
set up zone policies and distribute keys appropriately. Although
if you run nsdiff directly on your primary DNS machine, you should
be able to use the built-in /var/run/named/session.key with a
per-zone policy like:
<br>
<br>
```
<br>
update-policy {
<br>
grant local-ddns zonesub any;
<br>
};
<br>
```
<br>
<br>
See the '-l' flag to nsupdate(1)
</blockquote>
<p>thanks, that is very interesting information.<br>
What I understood from the documentation:<br>
<b>-s</b> <i>server</i>[#<i>port</i>]</p>
<p>I can maintain e.g. my zones from my local computer at home
inside a git repository and use nsdiff and nspatch to push the
changes to the server in the internet?</p>
<p>Does the server then has the source file (fechner.net) or does
the server only work with raw and the .jnl file?</p>
<p>It I add a new zone, do I only need to configure it as master,
define access to it and then upload the zone data via nspatch?</p>
<p>If that would all be possible, that technique can maybe also used
to change letsencrypt verification to dns using the nsupdate
command to get required information into the zone file.<br>
That would definitely open a lot of new possibilities to put more
automation the the full setup. ;)<br>
</p>
<pre class="moz-signature" cols="72">
Gruß
Matthias
--
"Programming today is a race between software engineers striving to
build bigger and better idiot-proof programs, and the universe trying to
produce bigger and better idiots. So far, the universe is winning." --
Rich Cook
</pre>
</body>
</html>