another alternative to our dnssec management, from @weasel

howto/dns.md

@@ -607,3 +607,54 @@ There's been some critiques of DNSSEC over the years, here's a talk I
 found about it recently:
 
  * [Geoff Huston - DNSSEC: Yes or No](https://ripe86.ripe.net/archives/video/1018/) at [RIPE 86](https://ripe86.ripe.net/) (May 2023), [slides](https://ripe86.ripe.net/presentations/51-2023-05-23-dnssec.pdf)
+
+### automatic DNSSEC management with bind
+
+Right now, the Nagios check (!) is responsible for key rotation and
+all that stuff. We could move this in bind directly. Here's how weasel
+is currently experimenting with it:
+
+```
+ inline-signing yes;
+
+ };
++  dnssec-policy "dnssec-policy-mustelid.at" {
++    keys {
++      // ksk key-directory lifetime P2Y algorithm rsasha256 2048;
++      // zsk key-directory lifetime P4M algorithm rsasha256 2048;
++      ksk key-directory lifetime P4M algorithm rsasha256 2048;
++      zsk key-directory lifetime P50D algorithm rsasha256 1536;
++    };
++
++    dnskey-ttl P1D;
++    max-zone-ttl P1W;
++    nsec3param;
++
++    publish-safety P15D;
++    purge-keys P90D;
++    retire-safety P15D;
++
++    zone-propagation-delay PT8H;
++
++    signatures-refresh P25D;
++    signatures-validity P40D;
++    signatures-validity-dnskey P40D;
++  };
++
+ zone "mustelid.at" {
+         type master;
+         file "/srv/dns.noreply.org/var/generated/mustelid.at";
+@@ -506,12 +542,12 @@
+  2a04:dd00:21:3::2   ; // ns2.sthu.org/plato.sthu.org
+
+         };
+-        key-directory "/srv/dns.noreply.org/var/keys/mustelid.at";
+-sig-validity-interval 40 25;
+-auto-dnssec maintain;
+-inline-signing yes;
++          key-directory "/srv/dns.noreply.org/var/keys/mustelid.at";
++  dnssec-policy "dnssec-policy-mustelid.at";
++  inline-signing yes;
+  
+ };
+ ```