howto/mikrotik/modern-style-WIP.md
... ...
@@ -141,7 +141,7 @@ Route filters
141 141
142 142
Filters are necessary to prevent other people from hijacking our routing table. A malicious peer could send routes that override your default route to public internet services like Google, government services, your online banking, etc.
143 143
144
-These rules are reasonably tight, you can tighten or relax them as desired. [Interconnected networks'](/internal/Interconnections) IPv4 ranges are included as well, if you don't want then you can ignore that rule.
144
+These rules are reasonably tight, you can tighten or relax them as desired. [Interconnected networks'](/Interconnections) IPv4 ranges are included as well, if you don't want then you can ignore that rule.
145 145
```
146 146
/routing filter rule
147 147
add chain=dn42-in comment="reject prefixes clashing with home network" disabled=no rule="if (dst in 192.168.0.0/16 && dst-len >= 16) { reject }"
internal/E-Mail-Providers.md
... ...
@@ -1,4 +1,4 @@
1
-If you have an E-Mail service and would like to test it's functionality, send an email to [zane_reick@dmail.dn42](mailto:zane_reik@dmail.dn42). You will get a response usually within a few hours.
1
+# E-mail Providers
2 2
3 3
**X Mail by Bingxin.**
4 4
* X Mail <https://mail.x.dn42>
... ...
@@ -23,3 +23,6 @@ If you have an E-Mail service and would like to test it's functionality, send an
23 23
* signup at <https://simplelogin.dn42/auth/register> with a clearnet e-mail address (dn42 mail addresses are for some reason not supported by simplelogin)
24 24
* also available via <https://sl.dn42.cc/> (except signup)
25 25
* for "lifetime premium" (more than 5 aliases + custom domains), if you want aliases for \<anything>@\<your_mntner>.dn42.cc or experience deliverability problems please send a mail to [support@dn42.cc](mailto:support@dn42.cc) or [lare@dn42.cc](mailto:lare@dn42.cc)
26
+
27
+# Echo test services
28
+ * If you have an E-Mail service and would like to test it's functionality, send an email to [zane_reick@dmail.dn42](mailto:zane_reik@dmail.dn42). You will get a response usually within a few hours.
internal/Internal-Services.md
... ...
@@ -1,6 +1,6 @@
1 1
# Internal services
2 2
3
-You are asked to show some creativity in terms of network usage and content ([ideas](/internal/Ideas)). ;)
3
+You are asked to show some creativity in terms of network usage and content ([ideas](/internal/Ideas)).
4 4
5 5
## Search engines & Discovery
6 6
internal/Repository-Mirrors.md
... ...
@@ -65,4 +65,5 @@ Ubuntu-image:
65 65
- 22.04.5
66 66
- [magnet:?xt=urn:btih:8df707795d20b9d8021241d56c6f8282929c8b8d](magnet:?xt=urn:btih:8df707795d20b9d8021241d56c6f8282929c8b8d&dn=ubuntu-22.04.5-live-server-amd64&tr=udp%3A%2F%2Ftracker.leziblog.dn42%3A11451&tr=https%3A%2F%2Ftracker.leziblog.dn42%2Fannounce&tr=http%3A%2F%2Ftracker.leziblog.dn42%2Fannounce)
67 67
- 24.04.3
68
- - [magnet:?xt=urn:btih:5fd2dd3688fdb31fe554b15ed65228f3db29a9f9](magnet:?xt=urn:btih:5fd2dd3688fdb31fe554b15ed65228f3db29a9f9&dn=ubuntu-24.04.3-live-server-amd64&tr=udp%3A%2F%2Ftracker.leziblog.dn42%3A11451&tr=https%3A%2F%2Ftracker.leziblog.dn42%2Fannounce&tr=http%3A%2F%2Ftracker.leziblog.dn42%2Fannounce)
... ...
\ No newline at end of file
0
+ - [magnet:?xt=urn:btih:5fd2dd3688fdb31fe554b15ed65228f3db29a9f9](magnet:?xt=urn:btih:5fd2dd3688fdb31fe554b15ed65228f3db29a9f9&dn=ubuntu-24.04.3-live-server-amd64&tr=udp%3A%2F%2Ftracker.leziblog.dn42%3A11451&tr=https%3A%2F%2Ftracker.leziblog.dn42%2Fannounce&tr=http%3A%2F%2Ftracker.leziblog.dn42%2Fannounce)
1
+
internal/Tor.md
... ...
@@ -1,17 +1,17 @@
1
+# Tor network
2
+
1 3
[Tor](https://torproject.org/) is free software and an open network that helps you defend against traffic analysis, a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security.
2 4
3
-# Tor Bridges
5
+## Bridges
4 6
5 7
Tor bridges allow for the Tor client to connect to a specific IP address and validate the fingerprint to permit safe connections into the Tor network for networks that do not directly access the public Internet, for example hosts that only have dn42 connections. The following bridges are currently available for use:
6 8
7
-| Name | Bandwidth | Contact | Protocol | Fingerprint | Info |
8
-|-----------------------|-----------|------------------|----------|------------------------------------------|------------------------------------|
9
-| photon.flat.dn42:8443 | 500kB/s | irl@flat.dn42 | obfs4 | 83B02FB88253A7FD313B7912B12B05AF2A42D3B9 | Limited to 100GB transfer per week |
10
-| gouda.flat.dn42:8443 | 500kB/s | irl@flat.dn42 | obfs4 | DF8CA08A9BED62B319D1E52610510959374444A2 | |
11
-| tor.napshome.dn42:8443 | 3000KB/s+ | bjackson@napshome.net | obfs4 | 71C924A772F69451FE97FE5A9025DEDDEF3DB664 | |
12
-| tor.napshome.dn42:9001 | 3000KB/s+ | bjackson@napshome.net | plain | 71C924A772F69451FE97FE5A9025DEDDEF3DB664 | |
9
+| Name | Bandwidth | Contact | Protocol | Fingerprint | Info |
10
+|------------------------|-----------|-----------------------|----------|------------------------------------------|------|
11
+| tor.napshome.dn42:8443 | 3000KB/s+ | bjackson@napshome.net | obfs4 | 71C924A772F69451FE97FE5A9025DEDDEF3DB664 | |
12
+| tor.napshome.dn42:9001 | 3000KB/s+ | bjackson@napshome.net | plain | 71C924A772F69451FE97FE5A9025DEDDEF3DB664 | |
13 13
14
-# Anycast Tor
14
+## Anycast
15 15
16 16
There is an anycast address, 172.22.0.94 and fd42:d42:d42:9001::1 aka tor.dn42, that provides the following services:
17 17
... ...
@@ -25,7 +25,7 @@ It should be noted that the host providing the SOCKS services is able to see *al
25 25
26 26
There is also unfortunately no means by which to tell Tor to use a specific IP address as the entry point for a plain relay and while in theory you could connect to the ORPort and have a safe connection to Tor, there is no configuration option available for this.
27 27
28
-# Tor SOCKS Proxies
28
+## SOCKS Proxies
29 29
30 30
_Note that the same warnings above also apply to the following proxies._
31 31
... ...
@@ -33,12 +33,7 @@ _Note that the same warnings above also apply to the following proxies._
33 33
|---------------------------------------|-------------|-------------|
34 34
| socks5://tor.napshome.dn42:9050 | 100+ Mbit/s | Napsterbater|
35 35
36
-| Offline | | |
37
-|---------------------------------------|-------------|-------------|
38
-| socks5://172.20.11.33:9050 | 100 Mbit/s | twink0r |
39
-
40
-
41
-# DNS Proxy - Tor Hidden Services
36
+## DNS Proxy - Tor Hidden Services
42 37
43 38
_Note that the same warnings above also apply to the following proxies._
44 39
services/Clearnet-Domains.md
... ...
@@ -2,11 +2,11 @@
2 2
3 3
To provide services over the public internet some community members have contributed clearnet domain names to be used for DN42.
4 4
5
-|Domain|
6
-|:--|
7
-|dn42.dev|
8
-|dn42.cc|
9
-|dn42.jp|
5
+| Domain |
6
+|:---------|
7
+| dn42.dev |
8
+| dn42.cc |
9
+| dn42.jp |
10 10
11 11
12 12
DNS records for these domains are managed by a gitea repository:
... ...
@@ -24,3 +24,4 @@ Domains and services should meet the following criteria:
24 24
- Services and DNS should be resilient and highly available, where possible
25 25
- The owner must ensure their contact details are current and respond promptly to any failures
26 26
- If a domain or service is unavailable for a length of time, it may be removed
27
+
services/Distributed-Wiki-New.md
... ...
@@ -1,167 +0,0 @@
1
-## Introduction
2
-
3
-[dn42-wiki-go](https://github.com/iedon/dn42-wiki-go) is a lightweight, Git-backed wiki engine designed for DN42. It is based on [wiki-ng](https://git.dn42.dev/wiki/wiki-ng), aims to replace the old Gollum-based DN42 distributed wiki.
4
-
5
-It can serve pages live through its built-in Go HTTP server or generate a fully static HTML export for external hosting. All content is stored in a Git repository, making it easy to replicate across nodes or run in disconnected environments.
6
-
7
-## Live Version
8
-- [https://wiki.dn42/](https://wiki.dn42/) (DN42 Access)
9
-- [https://dn42.jp/](https://dn42.jp/) (Clearnet)
10
-
11
-![Screenshot of iEdon DN42 Wiki Go](/services/images/iedon-dn42-wiki-go.png)
12
-
13
-## Operating Modes
14
-
15
-You can run `dn42-wiki-go` in three different ways:
16
-
17
-1. **Run static build once then exit (`--build` or `live=false`)**
18
- The App renders all Markdown files into HTML under outputDir and exits.
19
- Best for setups where your own cron job handles Git sync and file publishing.
20
-
21
-2. **Live mode without reverse proxy (`live=true`)**
22
- The built-in HTTP server directly serves pages, assets, and APIs.
23
- Suitable for simple deployments.
24
-
25
-3. **Live mode behind a reverse proxy**
26
- The reverse proxy (nginx, Caddy, HAProxy, etc.) serves the generated files, and only API endpoints are forwarded to the App.
27
- See `config.example.json` for example configs and `nginx-vhost.conf` for a reverse-proxy reference.
28
-
29
- **Recommended for production and anycast nodes**.
30
-
31
-## Features
32
-
33
-- Live mode with automatic Markdown rendering and scheduled Git pull/push.
34
-- Static mode for fully pre-built HTML exports.
35
-- Optional in-browser editor with commit metadata (author, message prefix, remote IP).
36
-- Webhook endpoints for remote pull/push triggers and optional polling integration(see `dn42notifyd`).
37
-- Themeable templates and bundled UI assets.
38
-- Designed for distributed, multi-node and anycast environments.
39
-
40
-## Quick Start
41
-
42
-Pre-built binaries are available in the [GitHub releases](https://github.com/iedon/dn42-wiki-go/releases).
43
-
44
-Please do not forget to clone the repository to copy `config.example.json`(to `config.json`) and the `template` folder. They should be put together in the same production directory.
45
-
46
-### Manual Build
47
-
48
-1. Install Go 1.24+ and ensure the git executable is available in PATH.
49
-2. Copy the example config:
50
- cp config.example.json config.json
51
- Then edit the settings you need.
52
-3. Build for your platform (example: Linux amd64):
53
- ```bash
54
- export GOOS=linux
55
- export GOARCH=amd64
56
- ./build.sh
57
- ```
58
-
59
-Determine which user is used to run `dn42-wiki-go`, then create `~/.gitconfig` for this user, which will be used by `git`.
60
-
61
-For example:
62
-
63
-```ini
64
-[user]
65
- email = noreply@dn42.jp
66
- name = IEDON.DN42 Wiki Mirror(116)
67
-```
68
-
69
-To create the isolated, low-privileged user `dn42-wiki-go`, you may run:
70
-```bash
71
-# This user cannot log in or get a shell.
72
-# This user has /opt/dn42-wiki-go as working directory.
73
-# No default home folder created automatically.
74
-sudo useradd -r -s /usr/sbin/nologin -d /opt/dn42-wiki-go -M dn42-wiki-go
75
-```
76
-
77
-Both systemd socket enabler and UNIX domain socket are supported, check example configuration files: `dn42-wiki-go.socket` and `dn42-wiki-go.service`.
78
-
79
-If you would like to use with Docker: `Dockerfile` and `docker-compose.yml` are also provided, bind proper directories and map `config.json` for the App to use, then you are all set.
80
-
81
-## Webhook Endpoints
82
-
83
-When `webhook.enabled` = true, the server exposes:
84
-
85
-- GET | POST /api/webhook/pull
86
- Runs git pull and rebuilds the cached HTML.
87
-
88
-- GET | POST /api/webhook/push
89
- Pushes local commits to the remote.
90
-
91
-If `webhook.secret` is set, requests must include an Authorization header that matches the secret.
92
-If `webhook.secret` is empty, a random secret will be generated on startup to secure the endpoint (used for polling).
93
-
94
-### Polling Integration
95
-
96
-When `webhook.polling.enabled` = true, the server registers with a remote notify service and triggers `/api/webhook/pull` whenever a refresh completes.
97
-
98
-This is compatible with `dn42notifyd` and similar tools.
99
-
100
-## Configuration Reference
101
-
102
-All settings are provided through a JSON file. Below is a concise reference of all options.
103
-
104
-### Runtime
105
-
106
-- `live` *(bool, default `false`)*:
107
- true -> run HTTP server and render on demand.
108
- false -> render once to outputDir and exit.
109
-
110
-- `editable` *(bool, default `false`)*:
111
- Enables in-browser editing and write operations.
112
-
113
-- `listen` *(string, default `":8080"`)*:
114
- TCP address (host:port) or UNIX socket (unix:/path).
115
-
116
- Advanced: See example systemd files `dn42-wiki-go.socket` and `dn42-wiki-go.service` in the repository.
117
-
118
-- `baseUrl` *(string, optional)*:
119
- URL prefix when hosting under a subdirectory.
120
-
121
-- `siteName` *(string, default `"DN42 Wiki Go"`)*:
122
- Display name of the wiki.
123
-
124
-### Git
125
-- `git.binPath` *(string, default `git`)*: Path to the Git executable.
126
-- `git.remote` *(string, default empty)*: Remote URL. Leave empty for standalone/local repositories.
127
-- `git.localDirectory` *(string, default `./repo`)*: Directory where the wiki repository is cloned or initialised.
128
-- `git.pullIntervalSec` *(int, default `3600`)*: Seconds between background `git pull` operations in live mode. Disabled if no remote is set.
129
-- `git.author` *(string, default `"Anonymous <anonymous@localhost>"`)*: Author string used for commits generated by the application.
130
-- `git.commitMessagePrefix` *(string, default empty)*: Optional prefix prepended verbatim to commit messages supplied by users.
131
-- `git.commitMessageAppendRemoteAddr` *(string, default empty)*: Optional suffix appended when a request carries a remote address. If the value contains `%s` it is treated as a `fmt` format string; otherwise it is concatenated.
132
-
133
-### Webhook
134
-- `webhook.enabled` *(bool, default `false`)*: Expose webhook endpoints on the main HTTP server.
135
-- `webhook.secret` *(string, default empty)*: Shared secret expected in the `Authorization` header. If empty, a random secret is generated on startup.
136
-- `webhook.polling.enabled` *(bool, default `false`)*: Keep a registration active with the remote notification service and trigger periodic pulls.
137
-- `webhook.polling.endpoint` *(string, default empty)*: URL of the notification service (eg. Usage with [dn42notifyd](https://git.dn42.dev/dn42/dn42notifyd): `https://git.dn42/dn42notify/poll`).
138
-- `webhook.polling.callbackUrl` *(string, default empty)*: Public URL for `/api/webhook/pull`. Required when `webhook.polling.enabled` is `true`.
139
-- `webhook.polling.pollingIntervalSec` *(int, default `3600`)*: Seconds between refresh attempts. Must be positive when polling is enabled.
140
-- `webhook.polling.skipRemoteCert` *(bool, default `false`)*: Insecure: Skip TLS verification.
141
-
142
-### Paths and templating
143
-- `outputDir` *(string, default `./dist`)*: Destination directory for static builds or asset exports.
144
-- `templateDir` *(string, default `./template`)*: Location of layout templates and static assets bundled into the server/UI.
145
-- `homeDoc` *(string, default `Home.md`)*: Repository document to treat as the home page. Normalised to a `.md` path relative to the repo root.
146
-- `privatePagesPrefix` *(array of strings, default empty)*: Request to routes started with these prefixes will be blocked.
147
-
148
-### Layout and footer
149
-- `ignoreHeader` *(bool, default `false`)*: Skip loading `_Header.md` when `true`. Leave `false` to include the fragment when present.
150
-- `ignoreFooter` *(bool, default `false`)*: Skip `_Footer.md` when `true`; otherwise render it if available.
151
-- `serverFooter` *(string, default empty)*: Markdown snippet rendered into the global footer at runtime.
152
-
153
-### TLS
154
-- `enableTLS` *(bool, default `false`)*: Serve HTTPS using the provided certificate and key.
155
-- `tlsCert` *(string)*: Path to the TLS certificate. Required only when `enableTLS` is true.
156
-- `tlsKey` *(string)*: Path to the TLS private key. Required when `enableTLS` is true.
157
-
158
-### Logging and client IP handling
159
-- `logLevel` *(string, default `info`)*: Minimum log level (`debug`, `info`, `warn`, or `error`).
160
-- `trustedProxies` *(array of strings, default empty)*: CIDR blocks or literal IPs that are trusted to populate `X-Forwarded-For`.
161
-- `trustedRemoteAddrLevel` *(int, default `1`)*: Number of additional trusted hops to peel off when deriving the end-user IP from the forwarded chain. Values less than `1` are coerced to `1` during load.
162
-
163
-## Notes
164
-
165
-- live = true requires write access to the Git repo for local commits.
166
-- With no remote configured, `dn42-wiki-go` initializes a local-only repository.
167
-- Template changes require restarting the server or rebuilding static output.
services/Distributed-Wiki.md
... ...
@@ -1,9 +1,12 @@
1
-[dn42-wiki-go](/services/Distributed-Wiki-New) is a lightweight, Git-backed wiki engine designed for DN42. It is based on [wiki-ng](https://git.dn42.dev/wiki/wiki-ng), aims to replace the old Gollum-based DN42 distributed wiki.
1
+# Distributed Wiki
2 2
3
-# this page is outdated and need update
3
+This wiki is mirrored by multiple operators across both the public internet and on dn42.
4
+Current operators providing the wiki service can be found on the page footer.
4 5
5
-The idea is to deploy mirrors across dn42 using [anycast](https://en.wikipedia.org/wiki/Anycast) addressing (BGP), thus providing redundancy, load-balancing and improved access times to the wiki. Sites are powered by [gollum](https://github.com/gollum/gollum) which has no native SSL support, so Nginx acts as a reverse proxy and handles the encryption.
6
-The local webserver is monitored with a simple [shell script](/services/Distributed-Wiki#exabgp_watchdog-script) working [in conjunction](Distributed-Wiki#exabgp) with [ExaBGP](https://github.com/Exa-Networks/exabgp), announcing/withdrawing the assigned route if the service is up/down.
6
+## Hosting the wiki
7
+
8
+For hosting the wiki one will need to decide whether they desire to host a public internet mirror, join the wiki.dn42 anycast or both.
9
+The idea is to deploy mirrors across dn42 using [anycast](https://en.wikipedia.org/wiki/Anycast) addressing (BGP), thus providing redundancy, load-balancing and improved access times to the wiki.
7 10
8 11
## Prerequisites
9 12
... ...
@@ -13,14 +16,22 @@ The local webserver is monitored with a simple [shell script](/services/Distribu
13 16
14 17
In contrast with the general spirit in dn42, this service should NOT be deployed by unskilled members for the purpose of learning and exploring - since it is the primary source of information related to the project, it should not be used as a playground.
15 18
16
- - Software:
17
- + [Git](https://en.wikipedia.org/wiki/Git_(software))
19
+ - Wiki Software (choose one):
20
+ + [dn42-wiki-go](https://github.com/iedon/dn42-wiki-go) (Recommended)
21
+ + [wiki-ng](https://git.dn42.dev/wiki/wiki-ng)
18 22
+ [gollum](https://github.com/gollum/gollum)
23
+
24
+ - Other Software:
25
+ + [Git](https://en.wikipedia.org/wiki/Git_(software))
19 26
+ [Nginx](https://en.wikipedia.org/wiki/Nginx)
20 27
+ [ExaBGP](https://github.com/Exa-Networks/exabgp)
21 28
22 29
It's recommended to use a debian distro on the host machine, where most of the above software can be installed using package manager(s) with ease. On some distros (RHEL based for example) it might not be an easy task.
23 30
31
+
32
+The local webserver is to be monitored with a simple [shell script](/services/Distributed-Wiki#watchdog-script) working [in conjunction](/services/Distributed-Wiki/#exabgp) with [ExaBGP](https://github.com/Exa-Networks/exabgp), announcing/withdrawing the assigned route if the service is up/down.
33
+Nginx acts as a reverse proxy and handles the encryption.
34
+
24 35
## Network
25 36
26 37
- Install wiki anycast IP addresses `172.23.0.80/32` and `fd42:d42:d42:80::1/64` on the system
... ...
@@ -29,8 +40,8 @@ The local webserver is monitored with a simple [shell script](/services/Distribu
29 40
30 41
## Data replication
31 42
32
-Site files are stored in a local [DVCS](https://en.wikipedia.org/wiki/Distributed_revision_control) repository (Git) on each node and replicated through a central server hosted by [XUU-DN42](https://io.nixnodes.net?t=person&l=XUU-DN42).
33
-Since gollum is built on top of Git, it is not overly complicated to keep the local site in sync with others, each site only triggers periodic pulls/pushes from/to the Git server.
43
+Site files are stored in a local [DVCS](https://en.wikipedia.org/wiki/Distributed_revision_control) repository (Git) on each node and replicated through a central server.
44
+Since the wiki is hosted on top of Git, it is not overly complicated to keep the local site in sync with others, each site only triggers periodic pulls/pushes from/to the Git server.
34 45
35 46
### Setup the repo
36 47
... ...
@@ -38,7 +49,6 @@ Since gollum is built on top of Git, it is not overly complicated to keep the lo
38 49
39 50
`git clone git@git.dn42.dev:wiki/wiki.git <path>`
40 51
41
- - Contact [XUU-DN42](https://io.nixnodes.net?t=person&l=XUU-DN42) and ask for write access to the repo
42 52
- Setup cron for periodic pull/push jobs for the repo (simple example):
43 53
44 54
+ **wiki-sync.sh**:
... ...
@@ -60,43 +70,13 @@ Since gollum is built on top of Git, it is not overly complicated to keep the lo
60 70
61 71
`*/10 * * * * <path>/wiki-sync.sh &> /dev/null`
62 72
63
- Running in 10 minute intervals is reasonable, if you choose to change this, please keep it in the range from 5 to 15 minutes.
64
-
65
-## gollum
66
-
67
- - Install [gollum](https://github.com/gollum/gollum)
68
- - Start two gollum instances, read-only and read/write on `127.0.0.1`:
69
-
70
- Read/write (SSL only):
71
- ```
72
- RACK_ENV=production gollum --css --host 127.0.0.1 --port 4568 <path>
73
- ```
74
- Read-only:
75
- ```
76
- RACK_ENV=production gollum --css --host 127.0.0.1 --port 4567 --no-edit <path>
77
- ```
78
-
79
- Set `<path>` to the location where wiki Git repo was cloned.
73
+ Running in 10 minute intervals is reasonable, if you choose to change this, please keep it in the range from 5 to 15 minutes. Also consider using dn42notifyd to get a callbacks instead.
80 74
81 75
## Nginx reverse proxy
82 76
83 77
### SSL
84 78
85
- - Setup your maintainer object according to [Automatic CA](/services/Automatic-CA)
86
- - Generate a [CSR](/services/Certificate-Authority) and send DNS Key Pin to [xuu@sour.is](mailto:xuu@sour.is):
87
- - \<AS> is the as number with the prefix `as` like `as64737-ca.wiki.dn42`
88
-
89
-```sh
90
-./ca.dn42 tls-gen \
91
- <AS>-<CC>(-<UID>).wiki.dn42 \
92
- EXAMPLE-MNT \
93
- mail@example.com \
94
- DNS:<AS>-<CC>(-<ID>).wiki.dn42,DNS:wiki.dn42,DNS:www.wiki.dn42,DNS:internal.dn42,DNS:www.internal.dn42
95
-```
96
-
97
- Wait for a reply and then sign the certificate:
98
-
99
- `./ca.dn42 tls-sign wiki.dn42 MIC92-MNT`
79
+ - Generate an SSL certificate using the main Certificate authority using a method that supports anycasted IP addresses.
100 80
101 81
#### Header
102 82
... ...
@@ -133,10 +113,6 @@ The proxy should accept the following domain names:
133 113
- internal.dn42
134 114
- wiki.dn42
135 115
136
-Nginx should listen on a unicast address as well, so your site can be reached exclusively. Assign an IP address for the occasion and send it to [XUU-DN42](https://io.nixnodes.net?t=person&l=XUU-DN42) including your AS `<aut-num>` and the country code `<CC>` where your site is located. A forward DNS record will be created, pointing to the unicast IP address:
137
-
138
- - `<aut-num>`-`<CC>``(-<UID>)`.wiki.dn42
139
-
140 116
#### Config example
141 117
142 118
```conf
... ...
@@ -357,3 +333,195 @@ esac
357 333
358 334
exit 0
359 335
```
336
+
337
+## Setting up the wiki software
338
+See the documentation below for both gollum and dn42-wiki-go.
339
+
340
+
341
+## gollum
342
+
343
+ - Install [gollum](https://github.com/gollum/gollum)
344
+ - Start two gollum instances, read-only and read/write on `127.0.0.1`:
345
+
346
+ Read/write (SSL only):
347
+ ```
348
+ RACK_ENV=production gollum --css --host 127.0.0.1 --port 4568 <path>
349
+ ```
350
+ Read-only:
351
+ ```
352
+ RACK_ENV=production gollum --css --host 127.0.0.1 --port 4567 --no-edit <path>
353
+ ```
354
+
355
+ Set `<path>` to the location where wiki Git repo was cloned.
356
+
357
+
358
+## dn42-wiki-go
359
+
360
+### Introduction
361
+
362
+[dn42-wiki-go](https://github.com/iedon/dn42-wiki-go) is a lightweight, Git-backed wiki engine designed for DN42. It is based on [wiki-ng](https://git.dn42.dev/wiki/wiki-ng), aims to replace the old Gollum-based DN42 distributed wiki.
363
+
364
+It can serve pages live through its built-in Go HTTP server or generate a fully static HTML export for external hosting. All content is stored in a Git repository, making it easy to replicate across nodes or run in disconnected environments.
365
+
366
+### Live Version
367
+- [https://wiki.dn42/](https://wiki.dn42/) (DN42 Access)
368
+- [https://dn42.jp/](https://dn42.jp/) (Clearnet)
369
+
370
+![Screenshot of iEdon DN42 Wiki Go](/services/images/iedon-dn42-wiki-go.png)
371
+
372
+### Operating Modes
373
+
374
+You can run `dn42-wiki-go` in three different ways:
375
+
376
+1. **Run static build once then exit (`--build` or `live=false`)**
377
+ The App renders all Markdown files into HTML under outputDir and exits.
378
+ Best for setups where your own cron job handles Git sync and file publishing.
379
+
380
+2. **Live mode without reverse proxy (`live=true`)**
381
+ The built-in HTTP server directly serves pages, assets, and APIs.
382
+ Suitable for simple deployments.
383
+
384
+3. **Live mode behind a reverse proxy**
385
+ The reverse proxy (nginx, Caddy, HAProxy, etc.) serves the generated files, and only API endpoints are forwarded to the App.
386
+ See `config.example.json` for example configs and `nginx-vhost.conf` for a reverse-proxy reference.
387
+
388
+ **Recommended for production and anycast nodes**.
389
+
390
+### Features
391
+
392
+- Live mode with automatic Markdown rendering and scheduled Git pull/push.
393
+- Static mode for fully pre-built HTML exports.
394
+- Optional in-browser editor with commit metadata (author, message prefix, remote IP).
395
+- Webhook endpoints for remote pull/push triggers and optional polling integration(see `dn42notifyd`).
396
+- Themeable templates and bundled UI assets.
397
+- Designed for distributed, multi-node and anycast environments.
398
+
399
+### Quick Start
400
+
401
+Pre-built binaries are available in the [GitHub releases](https://github.com/iedon/dn42-wiki-go/releases).
402
+
403
+Please do not forget to clone the repository to copy `config.example.json`(to `config.json`) and the `template` folder. They should be put together in the same production directory.
404
+
405
+#### Manual Build
406
+
407
+1. Install Go 1.24+ and ensure the git executable is available in PATH.
408
+2. Copy the example config:
409
+ cp config.example.json config.json
410
+ Then edit the settings you need.
411
+3. Build for your platform (example: Linux amd64):
412
+ ```bash
413
+ export GOOS=linux
414
+ export GOARCH=amd64
415
+ ./build.sh
416
+ ```
417
+
418
+Determine which user is used to run `dn42-wiki-go`, then create `~/.gitconfig` for this user, which will be used by `git`.
419
+
420
+For example:
421
+
422
+```ini
423
+[user]
424
+ email = noreply@dn42.jp
425
+ name = IEDON.DN42 Wiki Mirror(116)
426
+```
427
+
428
+To create the isolated, low-privileged user `dn42-wiki-go`, you may run:
429
+```bash
430
+# This user cannot log in or get a shell.
431
+# This user has /opt/dn42-wiki-go as working directory.
432
+# No default home folder created automatically.
433
+sudo useradd -r -s /usr/sbin/nologin -d /opt/dn42-wiki-go -M dn42-wiki-go
434
+```
435
+
436
+Both systemd socket enabler and UNIX domain socket are supported, check example configuration files: `dn42-wiki-go.socket` and `dn42-wiki-go.service`.
437
+
438
+If you would like to use with Docker: `Dockerfile` and `docker-compose.yml` are also provided, bind proper directories and map `config.json` for the App to use, then you are all set.
439
+
440
+### Webhook Endpoints
441
+
442
+When `webhook.enabled` = true, the server exposes:
443
+
444
+- GET | POST /api/webhook/pull
445
+ Runs git pull and rebuilds the cached HTML.
446
+
447
+- GET | POST /api/webhook/push
448
+ Pushes local commits to the remote.
449
+
450
+If `webhook.secret` is set, requests must include an Authorization header that matches the secret.
451
+If `webhook.secret` is empty, a random secret will be generated on startup to secure the endpoint (used for polling).
452
+
453
+#### Polling Integration
454
+
455
+When `webhook.polling.enabled` = true, the server registers with a remote notify service and triggers `/api/webhook/pull` whenever a refresh completes.
456
+
457
+This is compatible with `dn42notifyd` and similar tools.
458
+
459
+### Configuration Reference
460
+
461
+All settings are provided through a JSON file. Below is a concise reference of all options.
462
+
463
+#### Runtime
464
+
465
+- `live` *(bool, default `false`)*:
466
+ true -> run HTTP server and render on demand.
467
+ false -> render once to outputDir and exit.
468
+
469
+- `editable` *(bool, default `false`)*:
470
+ Enables in-browser editing and write operations.
471
+
472
+- `listen` *(string, default `":8080"`)*:
473
+ TCP address (host:port) or UNIX socket (unix:/path).
474
+
475
+ Advanced: See example systemd files `dn42-wiki-go.socket` and `dn42-wiki-go.service` in the repository.
476
+
477
+- `baseUrl` *(string, optional)*:
478
+ URL prefix when hosting under a subdirectory.
479
+
480
+- `siteName` *(string, default `"DN42 Wiki Go"`)*:
481
+ Display name of the wiki.
482
+
483
+#### Git
484
+- `git.binPath` *(string, default `git`)*: Path to the Git executable.
485
+- `git.remote` *(string, default empty)*: Remote URL. Leave empty for standalone/local repositories.
486
+- `git.localDirectory` *(string, default `./repo`)*: Directory where the wiki repository is cloned or initialised.
487
+- `git.pullIntervalSec` *(int, default `3600`)*: Seconds between background `git pull` operations in live mode. Disabled if no remote is set.
488
+- `git.author` *(string, default `"Anonymous <anonymous@localhost>"`)*: Author string used for commits generated by the application.
489
+- `git.commitMessagePrefix` *(string, default empty)*: Optional prefix prepended verbatim to commit messages supplied by users.
490
+- `git.commitMessageAppendRemoteAddr` *(string, default empty)*: Optional suffix appended when a request carries a remote address. If the value contains `%s` it is treated as a `fmt` format string; otherwise it is concatenated.
491
+
492
+#### Webhook
493
+- `webhook.enabled` *(bool, default `false`)*: Expose webhook endpoints on the main HTTP server.
494
+- `webhook.secret` *(string, default empty)*: Shared secret expected in the `Authorization` header. If empty, a random secret is generated on startup.
495
+- `webhook.polling.enabled` *(bool, default `false`)*: Keep a registration active with the remote notification service and trigger periodic pulls.
496
+- `webhook.polling.endpoint` *(string, default empty)*: URL of the notification service (eg. Usage with [dn42notifyd](https://git.dn42.dev/dn42/dn42notifyd): `https://git.dn42/dn42notify/poll`).
497
+- `webhook.polling.callbackUrl` *(string, default empty)*: Public URL for `/api/webhook/pull`. Required when `webhook.polling.enabled` is `true`.
498
+- `webhook.polling.pollingIntervalSec` *(int, default `3600`)*: Seconds between refresh attempts. Must be positive when polling is enabled.
499
+- `webhook.polling.skipRemoteCert` *(bool, default `false`)*: Insecure: Skip TLS verification.
500
+
501
+#### Paths and templating
502
+- `outputDir` *(string, default `./dist`)*: Destination directory for static builds or asset exports.
503
+- `templateDir` *(string, default `./template`)*: Location of layout templates and static assets bundled into the server/UI.
504
+- `homeDoc` *(string, default `Home.md`)*: Repository document to treat as the home page. Normalised to a `.md` path relative to the repo root.
505
+- `privatePagesPrefix` *(array of strings, default empty)*: Request to routes started with these prefixes will be blocked.
506
+
507
+#### Layout and footer
508
+- `ignoreHeader` *(bool, default `false`)*: Skip loading `_Header.md` when `true`. Leave `false` to include the fragment when present.
509
+- `ignoreFooter` *(bool, default `false`)*: Skip `_Footer.md` when `true`; otherwise render it if available.
510
+- `serverFooter` *(string, default empty)*: Markdown snippet rendered into the global footer at runtime.
511
+
512
+#### TLS
513
+- `enableTLS` *(bool, default `false`)*: Serve HTTPS using the provided certificate and key.
514
+- `tlsCert` *(string)*: Path to the TLS certificate. Required only when `enableTLS` is true.
515
+- `tlsKey` *(string)*: Path to the TLS private key. Required when `enableTLS` is true.
516
+
517
+#### Logging and client IP handling
518
+- `logLevel` *(string, default `info`)*: Minimum log level (`debug`, `info`, `warn`, or `error`).
519
+- `trustedProxies` *(array of strings, default empty)*: CIDR blocks or literal IPs that are trusted to populate `X-Forwarded-For`.
520
+- `trustedRemoteAddrLevel` *(int, default `1`)*: Number of additional trusted hops to peel off when deriving the end-user IP from the forwarded chain. Values less than `1` are coerced to `1` during load.
521
+
522
+### Notes
523
+
524
+- live = true requires write access to the Git repo for local commits.
525
+- With no remote configured, `dn42-wiki-go` initializes a local-only repository.
526
+- Template changes require restarting the server or rebuilding static output.
527
+
services/ca/Automatic-CA.md
... ...
@@ -1,7 +1,7 @@
1 1
DN42 Self-Serve CA
2 2
==================
3 3
4
-This client is used for automating the process of requesting TLS certificates. (Available via: [dn42](https://ca.dn42/ca-client), [iana](https://ca.dn42.us/ca-client), [git](anon@git.dn42:dn42/ca-client))
4
+This client is used for automating the process of requesting TLS certificates. (Available via: [dn42](https://ca.dn42/ca-client), [iana](https://ca.dn42.us/ca-client))
5 5
6 6
7 7
## VALIDATION PROCESS
services/dns/Architecture.md
... ...
@@ -0,0 +1,54 @@
1
+# Current DNS Architecture
2
+
3
+After frequent issues with the [Old Hierarchical DNS](/services/dns/historical/Old-Hierarchical-DNS) system in early 2018, work has started to build a new and more reliable DNS system. The main goals are:
4
+* Reliability and Consistency to avoid debugging very obscure issues that are also hard to reproduce.
5
+* Low maintenance burden on operators.
6
+* Proper DNSSEC support for everything.
7
+
8
+# End Users
9
+It is **strongly recommended** to run your own resolver for security and privacy reasons. Setting it up and maintaining it should be easy, see [services/dns/Configuration](/services/dns/Configuration).
10
+
11
+If running your own resolver is not possible or desirable, you can choose one or more instances from [dns/recursive-servers.dn42 in the registry](https://git.dn42.dev/dn42/registry/src/master/data/dns/recursive-servers.dn42). Please make sure you fully understand the consequences and fully trust these operators.
12
+
13
+You can also use the globally anycasted a.recursive-servers.dn42 but you won't have any control over which instance you get. This is a **very bad idea** from a security standpoint.
14
+
15
+# Instances
16
+The new DNS system has two different components:
17
+* *.recursive-servers.dn42 and local resolvers responsible for handling queries from clients, validating DNSSEC and directing the queries at clearnet/dn42/ICVPN.
18
+* *.delegation-servers.dn42 and *.master.delegation-servers.dn42 are a normal master-slave setup for providing the few official infrastructural zones.
19
+
20
+## *.recursive-servers.dn42
21
+These are simple resolvers capable of resolving dn42 domains. Every operator gets a single letter name pointing to addresses assigned from their own address space and is strongly encouraged to use anycasting across multiple nodes to improve reliability. There is also the global anycast a.recursive-servers.dn42 which includes some/all other instances. Whether an *.recursive-servers.dn42 can resolve clearnet queries or not is decided by its operator but all a.recursive-servers.dn42 instances MUST resolve clearnet queries correctly. It is explicitly not supported to use clearnet nservers for dn42 zones and dn42 nservers for clearnet zones.
22
+
23
+## *.delegation-servers.dn42
24
+These are simple authoritative servers for the dn42 zone, rDNS and a few DNS infrastructure zones. Every operator gets a single letter name pointing to addresses assigned from their own address space and is strongly encouraged to use anycasting across multiple nodes to improve reliability. There is no anycast instance because that would make debugging much harder and *.recursive-servers.dn42 instances should do loadbalancing/failover across all instances listed in the registry.
25
+
26
+## *.master.delegation-servers.dn42
27
+These instances do not serve any clients. They poll the registry regularly and rebuild and resign (DNSSEC) the zones as needed. If any zone changes, all *.delegation-servers.dn42 instances are notified ([RFC1996](https://tools.ietf.org/html/rfc1996)) which then load the new zone data over AXFR ([RFC5936](https://tools.ietf.org/html/rfc5936)). The pool of masters is intentionally kept very small because of its much higher coordination needs and also the lacking support of a multi-master mode in many authoritative server implementations. The masters are only reachable over dedicated IPv6 assignments which are set up in a way that any master operator can hijack the address of a problematic master without having to wait for its operator to fix something.
28
+
29
+# Running your own instances
30
+* If you want to run your own instances, make sure you are subscribed to the [mailinglist](/contact). It is also strongly recommended to join #dn42-dns@hackint. All changes are announced to the mailinglist but IRC makes debugging sessions much easier.
31
+* Choose the implementation(s) you want to use. It should support at least AXFR+NOTIFY (*.delegation-servers.dn42) or DNSSEC (*.recursive-servers.dn42).
32
+* Check if [TODO](/TODO) already has configuration snippets for your implementation.
33
+ * If yes, download it from there and include it in the main configuration.
34
+ * If not, then join us in #dn42-dns@hackint so we can add it together.
35
+* Verify that everything works:
36
+ * For *.delegation-servers.dn42: Do an AXFR against all zones and compare with the result of an existing instance. The result should be identical.
37
+ * For *.recursive-servers.dn42: Query clearnet, dn42 and ICVPN domains including rDNS. Make sure that both signed and unsigned domains work properly.
38
+* (Optional) Choose your single letter name and ask in #dn42-dns@hackint to get it added to the registry. Once added to the list, you must implement changes announced to the mailinglist within a week (faster is obviously better) or you might get removed again. We try to keep maintenance work as low as possible but we can't do it without the cooperation of all operators!
39
+
40
+# [Monitoring](https://grafana.burble.com/d/E4iCaHoWk/dn42-dns-status?orgId=1&refresh=1m)
41
+burble is providing monitoring for the new DNS system. It does simple checks on all instances every minute and also logs all changes into #dn42-dns@hackint.
42
+
43
+Also, gatuno provides another simple [dns checker for all the top level domains](http://gatuno.dn42/dns/) in the registry. If you want to check whatever a domain is resolving or not, this tool may be useful. The tool gets in sync with the registry every 12 hours. You can schedule checks for any domain.
44
+
45
+# DNSSEC
46
+There are currently two KSKs managed by BURBLE-MNT and JRB0001-MNT. They are used once per quarter to sign the DNSKEY RRset. Each master operator has one ZSK which is used to sign the zones (except for the DNSKEY RRset). This setup leads to bigger responses but allows each KSK holder to solve emergencies independently. The signatures of the DNSKEY RRset are valid until the end of the first month of the next quarter to give enough time for coordinating the next signing. All other signatures are valid for 3 days and replaced at least once per day.
47
+
48
+The set of valid KSKs can be found in the registry.
49
+
50
+# See also
51
+
52
+* [DNS Quick Start](/services/dns/Overview)
53
+* [Old Hierarchical DNS](/services/dns/historical/Old-Hierarchical-DNS) - deprecated
54
+* [Original DNS (deprecated)](/services/dns/historical/Original-DNS-(deprecated)) - deprecated
services/dns/Configuration.md
... ...
@@ -20,7 +20,7 @@ multiple services from *.recursive-servers.dn42 for redundancy.
20 20
21 21
## Note on ICVPN Zones
22 22
23
-DN42 is [interconnected](/internal/Interconnections) with the Inter City VPN or in short "ICVPN". The registry of the ICVPN includes all the DNS information such as the Top level domains (TLDs) used inside ICVPN and the reverse DNS for the IP ranges of the ICVPN. Additionally, it includes the TLDs of some other networks that are interconnected with dn42 and share some of the IP space of ICVPN. The ICVPN [repository](https://github.com/freifunk/icvpn-scripts#dns-mkdns) includes a handy script to automatically generate all the required zones.
23
+DN42 is [interconnected](/Interconnections) with the Inter City VPN or in short "ICVPN". The registry of the ICVPN includes all the DNS information such as the Top level domains (TLDs) used inside ICVPN and the reverse DNS for the IP ranges of the ICVPN. Additionally, it includes the TLDs of some other networks that are interconnected with dn42 and share some of the IP space of ICVPN. The ICVPN [repository](https://github.com/freifunk/icvpn-scripts#dns-mkdns) includes a handy script to automatically generate all the required zones.
24 24
25 25
## BIND
26 26
... ...
@@ -370,7 +370,7 @@ multiple services from *.delegation-servers.dn42 for redundancy.
370 370
371 371
## Dnssec
372 372
All delegation servers have DNSSEC support and all records are signed.
373
-For more information about DNSSEC visit [New-DNS#dnssec](/services/New-DNS#dnssec).
373
+For more information about DNSSEC visit the [dns architecture#dnssec](/services/dns/Architecture#dnssec) page.
374 374
375 375
Below is a list of links to the DS record for TLD and reverse zone.
376 376
To configure the key file, extract the value of ds-rdata and format it as follows.
services/dns/New-DNS.md
... ...
@@ -1,52 +0,0 @@
1
-After frequent issues with the [Old Hierarchical DNS](/services/Old-Hierarchical-DNS) system in early 2018, work has started to build a new and more reliable DNS system. The main goals are:
2
-* Reliability and Consistency to avoid debugging very obscure issues that are also hard to reproduce.
3
-* Low maintenance burden on operators.
4
-* Proper DNSSEC support for everything.
5
-
6
-# End Users
7
-It is **strongly recommended** to run your own resolver for security and privacy reasons. Setting it up and maintaining it should be easy, see [services/dns/Configuration](/services/dns/Configuration).
8
-
9
-If running your own resolver is not possible or desirable, you can choose one or more instances from [dns/recursive-servers.dn42 in the registry](https://git.dn42.dev/dn42/registry/src/master/data/dns/recursive-servers.dn42). Please make sure you fully understand the consequences and fully trust these operators.
10
-
11
-You can also use the globally anycasted a.recursive-servers.dn42 but you won't have any control over which instance you get. This is a **very bad idea** from a security standpoint.
12
-
13
-# Instances
14
-The new DNS system has two different components:
15
-* *.recursive-servers.dn42 and local resolvers responsible for handling queries from clients, validating DNSSEC and directing the queries at clearnet/dn42/ICVPN.
16
-* *.delegation-servers.dn42 and *.master.delegation-servers.dn42 are a normal master-slave setup for providing the few official infrastructural zones.
17
-
18
-## *.recursive-servers.dn42
19
-These are simple resolvers capable of resolving dn42 domains. Every operator gets a single letter name pointing to addresses assigned from their own address space and is strongly encouraged to use anycasting across multiple nodes to improve reliability. There is also the global anycast a.recursive-servers.dn42 which includes some/all other instances. Whether an *.recursive-servers.dn42 can resolve clearnet queries or not is decided by its operator but all a.recursive-servers.dn42 instances MUST resolve clearnet queries correctly. It is explicitly not supported to use clearnet nservers for dn42 zones and dn42 nservers for clearnet zones.
20
-
21
-## *.delegation-servers.dn42
22
-These are simple authoritative servers for the dn42 zone, rDNS and a few DNS infrastructure zones. Every operator gets a single letter name pointing to addresses assigned from their own address space and is strongly encouraged to use anycasting across multiple nodes to improve reliability. There is no anycast instance because that would make debugging much harder and *.recursive-servers.dn42 instances should do loadbalancing/failover across all instances listed in the registry.
23
-
24
-## *.master.delegation-servers.dn42
25
-These instances do not serve any clients. They poll the registry regularly and rebuild and resign (DNSSEC) the zones as needed. If any zone changes, all *.delegation-servers.dn42 instances are notified ([RFC1996](https://tools.ietf.org/html/rfc1996)) which then load the new zone data over AXFR ([RFC5936](https://tools.ietf.org/html/rfc5936)). The pool of masters is intentionally kept very small because of its much higher coordination needs and also the lacking support of a multi-master mode in many authoritative server implementations. The masters are only reachable over dedicated IPv6 assignments which are set up in a way that any master operator can hijack the address of a problematic master without having to wait for its operator to fix something.
26
-
27
-# Running your own instances
28
-* If you want to run your own instances, make sure you are subscribed to the [mailinglist](/contact). It is also strongly recommended to join #dn42-dns@hackint. All changes are announced to the mailinglist but IRC makes debugging sessions much easier.
29
-* Choose the implementation(s) you want to use. It should support at least AXFR+NOTIFY (*.delegation-servers.dn42) or DNSSEC (*.recursive-servers.dn42).
30
-* Check if [TODO](/TODO) already has configuration snippets for your implementation.
31
- * If yes, download it from there and include it in the main configuration.
32
- * If not, then join us in #dn42-dns@hackint so we can add it together.
33
-* Verify that everything works:
34
- * For *.delegation-servers.dn42: Do an AXFR against all zones and compare with the result of an existing instance. The result should be identical.
35
- * For *.recursive-servers.dn42: Query clearnet, dn42 and ICVPN domains including rDNS. Make sure that both signed and unsigned domains work properly.
36
-* (Optional) Choose your single letter name and ask in #dn42-dns@hackint to get it added to the registry. Once added to the list, you must implement changes announced to the mailinglist within a week (faster is obviously better) or you might get removed again. We try to keep maintenance work as low as possible but we can't do it without the cooperation of all operators!
37
-
38
-# [Monitoring](https://grafana.burble.com/d/E4iCaHoWk/dn42-dns-status?orgId=1&refresh=1m)
39
-burble is providing monitoring for the new DNS system. It does simple checks on all instances every minute and also logs all changes into #dn42-dns@hackint.
40
-
41
-Also, gatuno provides another simple [dns checker for all the top level domains](http://gatuno.dn42/dns/) in the registry. If you want to check whatever a domain is resolving or not, this tool may be useful. The tool gets in sync with the registry every 12 hours. You can schedule checks for any domain.
42
-
43
-# DNSSEC
44
-There are currently two KSKs managed by BURBLE-MNT and JRB0001-MNT. They are used once per quarter to sign the DNSKEY RRset. Each master operator has one ZSK which is used to sign the zones (except for the DNSKEY RRset). This setup leads to bigger responses but allows each KSK holder to solve emergencies independently. The signatures of the DNSKEY RRset are valid until the end of the first month of the next quarter to give enough time for coordinating the next signing. All other signatures are valid for 3 days and replaced at least once per day.
45
-
46
-The set of valid KSKs can be found in the registry.
47
-
48
-# See also
49
-
50
-* [DNS Quick Start](/services/DNS)
51
-* [Old Hierarchical DNS](/services/Old-Hierarchical-DNS)
52
-* [Original DNS (deprecated)](/services/Original-DNS-(deprecated))
services/dns/Old-Hierarchical-DNS.md
... ...
@@ -1,49 +0,0 @@
1
-This information is now **deprecated**. Please check [New DNS](/services/New-DNS) for the current architecture.
2
-
3
-***
4
-
5
-DNS in the global internet is designed as a tree starting from "." and traveling outward in layers. Currently in DN42 dns is flat. This leads to issues when trying to debug problems and makes it difficult to delegate to subnets smaller than /24. Another problem that arises is having the root dns setup as an anycast. If one of the anycast roots is having problems it creates inconsistent errors for some users. This has led to the problem of when a user has a poorly configured anycast available to create their own root anycast.
6
-
7
-The purpose of this project is to create a system of high quality dns roots. With them in place, an anycast resolver would only need to be a simple caching resolver that uses the roots to query.
8
-
9
-## Hierarchy in DN42
10
-
11
- - . (dot)
12
- - arpa
13
- - in-addr
14
- - 172
15
- - 20
16
- - 22
17
- - 23
18
- - 31
19
- - dn42
20
- - \<dn42 domain names>
21
- - hack
22
- - ffhh
23
- - \<Future Top Level Domains?>
24
- - \<ano, bit or other organisation TLDs?>
25
- - \<ICANN TLDs>
26
-
27
-Note: With this system it could be possible to merge the IANA root file.. but it would be beyond the scope of this project.
28
-
29
-## Servers
30
-
31
-For all of these servers they have a specific IP assigned, only respond to their authoritative zones, and do not allow recursion.
32
-
33
-**\<name>.root-servers.dn42** - This server is authoritative for "." (root zone). Is authorative for ICANN root as well. "172.in-addr.arpa" is delegated to ICANN, except rfc1918 zones which are delegated to dn42. The rest of rfc1918 as well as rfc4193 address space is delegated to dn42.
34
-
35
-**\<name>.zone-servers.dn42** - This server is authoritative for "dn42", "hack", .. This would be where the records for all forward dns nameservers would be. Similar to our current root setup.
36
-
37
-**\<name>.in-addr-servers.arpa** - This server is authoritative for "arpa", "in-addr", and each of the 172 zones for dn42 ip space. For non dn42 ip space NS records to the respective darknet would need to be registered.
38
-
39
-**\<name>.dn42-servers.arpa** - This server is authoritative for RFC 2317 delegations. For any inetnum object smaller than /24 and whos parent has no nameserver records, a C class parent zone is created (all its subnetworks are delegated to appropriate nameservers with CNAME)
40
-
41
-Real-time server monitor is available at <http://nixnodes.net/dn42/dnsview>
42
-
43
-## Setup
44
-
45
-Contact one of the root-servers.dn42 operators if you wish to set up a root/zone/dn42 server.
46
-
47
-You may want to set up a resolver, see link below or use 172.23.0.53 directly.
48
-
49
-Techical information available [here](https://nixnodes.net/wiki/n/DN42_DNS)
services/dns/Original-DNS-(deprecated).md
... ...
@@ -1,46 +0,0 @@
1
-# Original DNS (deprecated)
2
-This information is now **deprecated**. Please check [New DNS](/services/New-DNS) for the current architecture.
3
-
4
-***
5
-
6
-*(tl;dr)* We have a TLD for dn42, which is `.dn42`. The anycast resolver for `.dn42` runs on `172.20.0.53` and `fd42:d42:d42:54::1`.
7
-
8
-**DNS is built from the [whois database](/services/Whois). Please edit your DNS records there.**
9
-
10
-## Using the DNS service
11
-
12
-Below are several ways to use the `dn42` DNS service, from easiest to more challenging. The recommended method is the second one.
13
-
14
-### Using the anycast resolver directly
15
-
16
-Please be aware that this method sends **all** your DNS queries (e.g. `google.com`) to a random DNS server inside dn42. The server could fake the result and point you towards the russian mafia. They probably won't, but think about what you are doing. At the end of the day, your ISP could be evil as well, so it always boils down to a question of trust.
17
-
18
-To do this, just use `172.20.0.53` or `fd42:d42:d42:54::1` as your resolver, for instance in `/etc/resolv.conf`.
19
-
20
-### Forwarding `.dn42` queries to the anycast resolver
21
-
22
-If you run your own resolver (`unbound`, `dnsmasq`, `bind`), you can configure it to forward dn42 queries to the anycast DNS resolver. See [DNS forwarder configuration](/services/dns/Configuration).
23
-
24
-### Recursive resolver
25
-
26
-You may also want to configure your resolver to recursively resolve dn42 domains. For this, you need to find authoritative DNS servers for the `dn42` zone (and for the reverse zones). See [services/dns/Recursive DNS resolver](/services/dns/Recursive-DNS-resolver).
27
-
28
-### Building the dn42 zones from the registry
29
-
30
-Finally, you may want to host your own authoritative DNS server for the `dn42` zone and the reverse zones. The zone files are built from the monotone repository: scripts are provided in the repository itself.
31
-
32
-## Register a `.dn42` domain name
33
-
34
-The root zone for `dn42.` is built from the [whois registry](/services/Whois). If you want to register a domain name, you need to add it to the registry (of course, you also need one or two authoritative nameservers).
35
-
36
-## DNS services for other networks
37
-
38
-Other networks are interconnected with dn42 (ChaosVPN, Freifunk, etc). Some of them also provide DNS service, you can configure your resolver to use it. See [External DNS](/services/dns/External-DNS).
39
-
40
-## Providing DNS services
41
-
42
-See [Providing Anycast DNS](/services/dns/Providing-Anycast-DNS).
43
-
44
-## [Old Hierarchical DNS](/services/Old-Hierarchical-DNS)
45
-
46
-This is a new effort to build a DNS system that mirrors how DNS was designed to work in clearnet.
services/dns/Overview.md
... ...
@@ -48,17 +48,17 @@ search dn42
48 48
49 49
There are multiple top level domains (TLDs) associated with DN42, its affiliated networks and for reverse DNS that must
50 50
be configured in order to run your own resolver. The registry is the authoritative source of active TLDs, but see also
51
-this page [dns/External-DNS](/services/dns/External-DNS) in the wiki.
51
+the [External-DNS](/services/dns/External-DNS) page in the wiki.
52 52
53 53
### Split horizon DNS
54 54
55 55
In this configuration, you run your own, caching resolver but forward DN42 related queries (with recursion bit set)
56
-to the anycast service. Example configurations for different recursor implementations are included in the [dns/Configuration](/services/dns/Configuration) page.
56
+to the anycast service. Example configurations for different recursor implementations are included in the [Configuration](/services/dns/Configuration) page.
57 57
58 58
### Full recursion
59 59
60 60
Authoritative DNS for DN42 is provided by the *.delegation-servers.dn42 servers, see the DNS architecture here
61
-[New DNS](/services/dns/New-DNS) Delegations servers have full support for DNSSEC. Example configuration unbound implementations are included in the [dns/Configuration](/services/dns/Configuration#resolver-setup) page.
61
+Delegations servers have full support for DNSSEC. Example configuration unbound implementations are included in the [Configuration](/services/dns/Configuration#resolver-setup) page.
62 62
63 63
## Additional client configuration
64 64
... ...
@@ -66,8 +66,7 @@ Authoritative DNS for DN42 is provided by the *.delegation-servers.dn42 servers,
66 66
67 67
## Further Information
68 68
69
-* [dns/Configuration](/services/dns/Configuration) - Forwarder/Resolver configuration examples
70
-* [New DNS](/services/dns/New-DNS) - current architecture
71
-* [dns/External-DNS](/services/dns/External-DNS) - external DNS zones from interconnected networks
72
-* [Old Hierarchical DNS](/services/dns/Old-Hierarchical-DNS) - deprecated
73
-* [Original DNS (deprecated)](/services/dns/Original-DNS-(deprecated)) - deprecated
69
+* [Configuration](/services/dns/Configuration) - Forwarder/Resolver configuration examples
70
+* [Architecture](/services/dns/Architecture) - Current DNS system architecture
71
+* [External-DNS](/services/dns/External-DNS) - External DNS zones from interconnected networks
72
+
services/dns/Providing-Anycast-DNS.md
... ...
@@ -1,64 +0,0 @@
1
-# DEPRECATED - Please have a look at [Hierarchical DNS](/services/Old-Hierarchical-DNS) instead
2
-
3
-You may want to participate in the anycast DNS cloud.
4
-
5
-## Configuration
6
-
7
-Configuration requirements for all members of the anycast group are:
8
- * maintain your own zones based on whois database (scripts included in monotone repository)
9
- * allow recursion (including `.`)
10
- * listen on a unicast IP too for testing/debugging reasons
11
- * with bind, please use ```minimal-responses yes;``` (goes into ```options```/```view```)
12
-
13
-It is _really_ good to hang around in [IRC](/services/IRC) to get things sorted out, if something doesn't work. Letting some people test your DNS behavior before joining the anycast-group is considered best practice - better safe than sorry.
14
-
15
- * **IP:** 172.23.0.53
16
- * **Announciation Subnet:** 172.23.0.53/32
17
-
18
-### Generating Zone Files
19
-
20
-There are a few different scripts for generating zone files. They have been written in a few different languages. Please keep in mind that RFC 2317 is what keeps people from registering a /24 _just to have RDNS_, so scripts that support it have a positive effect on address space usage.
21
-
22
-| **Script** | **Language** | **Notes** |
23
-|---------------------|--------------|-----------|
24
-|rfc2317.rb | Ruby |
25
-|subnettr.py | Python 3 | Author: xuu, forward & reverse dns + RFC 2317
26
-|zonegen.bind.php | PHP |
27
-|zonegen.bind.sh | Bash |
28
-|zonegen.rb | Ruby |
29
-|zonegen.rdns.bind.sh | Bash |
30
-|zonegen.rdns.tinydns.sh | Bash |
31
-|zonegen.rev.bind.sh | Bash |
32
-|zonegen.smallblockrdns.tinydns.sh | Bash |
33
-|zonegen.tinydns.sh | Bash |
34
-|zongen.v2.sh | Sh | Author: Martin89, forward & reverse dns + RFC 2317
35
-
36
-## Persons providing anycast DNS
37
-
38
-| **Person** | **Region** | **AS** | **Unicast Address** | **Comments** |
39
-|-------------|---|:------:|:----------------------------------:|--------------------|
40
-| siska |SI | 76103 | a.resolvers.nic.dn42 (172.22.177.70) ||
41
-| xuu |UT,US | 64737 | xuu.root.dn42 (172.22.141.132) ||
42
-| xuu |ON,CA | 64737 | souris.root.dn42 (172.22.141.180) ||
43
-| Nurtic-Vibe |EU | 4242420123 | ns1.grmml.dn42 (172.23.149.20) ||
44
-| MWD |AU | 4242420002 | nsr1.mwd.dn42 (172.23.227.20) ||
45
-| Fritz | ?? | 64712 | ?? (??) | Advertised over bgp |
46
-| prauscher | DE | 64720 | prauscher.root.dn42 (172.22.120.1) | advertised in BGP |
47
-| hax404 | DE | 76114 | chero.hax404.dn42 (172.23.136.65) | advertised in BGP|
48
-| florianb | AT | 4242423955 | resolver.flo.dn42 (172.20.2.65) | advertisted in BGP |
49
-
50
-# IPv6 DNS
51
-
52
-**IP:** fd42:d42:d42:53::1/64
53
-
54
-[IPv6 Anycast Info](/services/IPv6-Anycast)
55
-
56
-## Persons providing anycast DNS for IPv6
57
-
58
-
59
-| **Person** | **Region** | **AS** | **Unicast Address** | **Comments** |
60
-|-------------|---|:---------:|:--------------------------------------:|--------------|
61
-| xuu |UT,US| 64737 | xuu.root.dn42 (fdea:a15a:77b9:d42::53) ||
62
-| xuu |ON,CA| 64737 | souris.root.dn42 (fdea:a15a:77b9:53::1) | |
63
-| Nurtic-Vibe |EU |4242420123 | ns1.grmml.dn42 (fd42:23:149:cccc::53) ||
64
-| florianb | AT | 4242423955 | resolver.flo.dn42 (fd42:d42:d42:53::1) | advertisted in BGP |
services/dns/Recursive-DNS-resolver.md
... ...
@@ -1,67 +0,0 @@
1
-If you want to run your own recursive DNS server, you must find upstream servers that are authoritative for the dn42 zones.
2
-
3
-You may use some servers listed in the [table of anycast servers](/services/dns/Providing-Anycast-DNS#Persons-providing-anycast-DNS), or just use `172.22.119.160` and `172.22.119.163` (ns{1,2}.fritz.dn42).
4
-
5
-## Configuration
6
-
7
-### Unbound
8
-
9
-Configuration for `unbound.conf`
10
-
11
-```conf
12
-server:
13
- local-zone: "22.172.in-addr.arpa." nodefault
14
- local-zone: "23.172.in-addr.arpa." nodefault
15
-
16
-stub-zone:
17
- name: "dn42"
18
- stub-prime: yes
19
- stub-addr: 172.22.119.160
20
- stub-addr: 172.22.119.163
21
-
22
-stub-zone:
23
- name: "22.172.in-addr.arpa"
24
- stub-prime: yes
25
- stub-addr: 172.22.119.160
26
- stub-addr: 172.22.119.163
27
-
28
-stub-zone:
29
- name: "23.172.in-addr.arpa"
30
- stub-prime: yes
31
- stub-addr: 172.22.119.160
32
- stub-addr: 172.22.119.163
33
-```
34
-
35
-### Unbound with root-hints
36
-Alternatively you can put dn42 root servers in the root-hints file for recursive resolving.
37
-
38
-```conf
39
-# /etc/unbound/unbound.conf.d/dn42.conf
40
-server:
41
- # DNSSEC validation will fail
42
- val-permissive-mode: yes
43
- # recursive queries for everyone
44
- access-control: 0.0.0.0/0 allow
45
- # dn42 root servers
46
- root-hints: /etc/unbound/dn42.hints
47
- # enable IPv6
48
- do-ip6: yes
49
- # allow reverse lookup of rfc1918 space, which includes the DN42 address space
50
- unblock-lan-zones: yes
51
- insecure-lan-zones: yes
52
-
53
-remote-control:
54
- control-enable: no
55
-```
56
-
57
-The `/etc/unbound/dn42.hints` file:
58
-```conf
59
-. NS a.root-servers.dn42.
60
-a.root-servers.dn42. 3600000 A 172.22.177.6
61
-. NS m.root-servers.dn42.
62
-m.root-servers.dn42. 3600000 A 172.23.67.67
63
-. NS t.root-servers.dn42.
64
-t.root-servers.dn42. 3600000 A 172.22.102.141
65
-. NS x.root-servers.dn42.
66
-x.root-servers.dn42. 3600000 A 172.22.141.1
67
-```
services/dns/historical/Old-Hierarchical-DNS.md
... ...
@@ -0,0 +1,49 @@
1
+This information is now **deprecated**.
2
+
3
+***
4
+
5
+DNS in the global internet is designed as a tree starting from "." and traveling outward in layers. Currently in DN42 dns is flat. This leads to issues when trying to debug problems and makes it difficult to delegate to subnets smaller than /24. Another problem that arises is having the root dns setup as an anycast. If one of the anycast roots is having problems it creates inconsistent errors for some users. This has led to the problem of when a user has a poorly configured anycast available to create their own root anycast.
6
+
7
+The purpose of this project is to create a system of high quality dns roots. With them in place, an anycast resolver would only need to be a simple caching resolver that uses the roots to query.
8
+
9
+## Hierarchy in DN42
10
+
11
+ - . (dot)
12
+ - arpa
13
+ - in-addr
14
+ - 172
15
+ - 20
16
+ - 22
17
+ - 23
18
+ - 31
19
+ - dn42
20
+ - \<dn42 domain names>
21
+ - hack
22
+ - ffhh
23
+ - \<Future Top Level Domains?>
24
+ - \<ano, bit or other organisation TLDs?>
25
+ - \<ICANN TLDs>
26
+
27
+Note: With this system it could be possible to merge the IANA root file.. but it would be beyond the scope of this project.
28
+
29
+## Servers
30
+
31
+For all of these servers they have a specific IP assigned, only respond to their authoritative zones, and do not allow recursion.
32
+
33
+**\<name>.root-servers.dn42** - This server is authoritative for "." (root zone). Is authorative for ICANN root as well. "172.in-addr.arpa" is delegated to ICANN, except rfc1918 zones which are delegated to dn42. The rest of rfc1918 as well as rfc4193 address space is delegated to dn42.
34
+
35
+**\<name>.zone-servers.dn42** - This server is authoritative for "dn42", "hack", .. This would be where the records for all forward dns nameservers would be. Similar to our current root setup.
36
+
37
+**\<name>.in-addr-servers.arpa** - This server is authoritative for "arpa", "in-addr", and each of the 172 zones for dn42 ip space. For non dn42 ip space NS records to the respective darknet would need to be registered.
38
+
39
+**\<name>.dn42-servers.arpa** - This server is authoritative for RFC 2317 delegations. For any inetnum object smaller than /24 and whos parent has no nameserver records, a C class parent zone is created (all its subnetworks are delegated to appropriate nameservers with CNAME)
40
+
41
+Real-time server monitor is available at <http://nixnodes.net/dn42/dnsview>
42
+
43
+## Setup
44
+
45
+Contact one of the root-servers.dn42 operators if you wish to set up a root/zone/dn42 server.
46
+
47
+You may want to set up a resolver, see link below or use 172.23.0.53 directly.
48
+
49
+Techical information available [here](https://nixnodes.net/wiki/n/DN42_DNS)
services/dns/historical/Original-DNS-(deprecated).md
... ...
@@ -0,0 +1,46 @@
1
+# Original DNS (deprecated)
2
+This information is now **deprecated**.
3
+
4
+***
5
+
6
+*(tl;dr)* We have a TLD for dn42, which is `.dn42`. The anycast resolver for `.dn42` runs on `172.20.0.53` and `fd42:d42:d42:54::1`.
7
+
8
+**DNS is built from the [whois database](/services/Whois). Please edit your DNS records there.**
9
+
10
+## Using the DNS service
11
+
12
+Below are several ways to use the `dn42` DNS service, from easiest to more challenging. The recommended method is the second one.
13
+
14
+### Using the anycast resolver directly
15
+
16
+Please be aware that this method sends **all** your DNS queries (e.g. `google.com`) to a random DNS server inside dn42. The server could fake the result and point you towards the russian mafia. They probably won't, but think about what you are doing. At the end of the day, your ISP could be evil as well, so it always boils down to a question of trust.
17
+
18
+To do this, just use `172.20.0.53` or `fd42:d42:d42:54::1` as your resolver, for instance in `/etc/resolv.conf`.
19
+
20
+### Forwarding `.dn42` queries to the anycast resolver
21
+
22
+If you run your own resolver (`unbound`, `dnsmasq`, `bind`), you can configure it to forward dn42 queries to the anycast DNS resolver. See [DNS forwarder configuration](/services/dns/Configuration).
23
+
24
+### Recursive resolver
25
+
26
+You may also want to configure your resolver to recursively resolve dn42 domains. For this, you need to find authoritative DNS servers for the `dn42` zone (and for the reverse zones). See [services/dns/Recursive DNS resolver](/services/dns/Recursive-DNS-resolver).
27
+
28
+### Building the dn42 zones from the registry
29
+
30
+Finally, you may want to host your own authoritative DNS server for the `dn42` zone and the reverse zones. The zone files are built from the monotone repository: scripts are provided in the repository itself.
31
+
32
+## Register a `.dn42` domain name
33
+
34
+The root zone for `dn42.` is built from the [whois registry](/services/Whois). If you want to register a domain name, you need to add it to the registry (of course, you also need one or two authoritative nameservers).
35
+
36
+## DNS services for other networks
37
+
38
+Other networks are interconnected with dn42 (ChaosVPN, Freifunk, etc). Some of them also provide DNS service, you can configure your resolver to use it. See [External DNS](/services/dns/External-DNS).
39
+
40
+## Providing DNS services
41
+
42
+See [Providing Anycast DNS](/services/dns/Providing-Anycast-DNS).
43
+
44
+## [Old Hierarchical DNS](/services/Old-Hierarchical-DNS)
45
+
46
+This is a new effort to build a DNS system that mirrors how DNS was designed to work in clearnet.
services/exchanges/IX-Collection.md
... ...
@@ -12,6 +12,6 @@ Currently available exchanges:
12 12
|:---|:--------------|
13 13
|IXP-frnte|[IXP-frnte](/services/exchanges/IXP-frnte)|
14 14
|mcast-ix|[mcast-ix](/services/exchanges/mcast-ix)|
15
-|SERNET-IX|[SERNET-IX](/services/exchanges/SERNET-IX), [https://blog.sherpherd.net/ix.html](https://blog.sherpherd.net/ix.html)|
15
+|SERNET-IX|[https://blog.sherpherd.net/ix.html](https://blog.sherpherd.net/ix.html)|
16 16
|SerinaIX|<https://ix.dn42.serinanya.cn/>|
17 17
|Nedifinita IX|https://ix.nedifinita.com/|
services/exchanges/SERNET-IX.md
... ...
@@ -1 +0,0 @@
1
-Placeholder.
... ...
\ No newline at end of file