uppdate knot.conf template with ns2

add ns2 (into dco)
add dco.sunet.se zone
2025-04-03 10:11:28 +02:00 · 2025-04-03 10:06:01 +02:00 · 2025-04-02 14:27:19 +02:00 · 2025-03-17 10:54:06 +01:00 · 2025-03-17 10:50:44 +01:00 · 2025-03-13 10:33:53 +01:00
61 changed files with 1050 additions and 65 deletions
--- a/dns-rest-api.sunet.se/README
+++ b/dns-rest-api.sunet.se/README
@ -1,3 +0,0 @@
-
-The system documentation is in the docs directory of the multiverse repository.
-
--- a/dns-rest-api1.sunet.se/README
+++ b/dns-rest-api1.sunet.se/README
--- a/dns-rest-api1.sunet.se/overlay/etc/hiera/data/local.eyaml
+++ b/dns-rest-api1.sunet.se/overlay/etc/hiera/data/local.eyaml
@ -0,0 +1,17 @@
+---
+knot_rest_token_secret: ENC[PKCS7,MIIC8gYJKoZIhvcNAQcDoIIC4zCCAt8CAQAxggJ6MIICdgIBADBeMEYxCzAJBgNVBAYTAlNFMQ4wDAYDVQQKDAVTVU5FVDEOMAwGA1UECwwFRVlBTUwxFzAVBgNVBAMMDjE5Mi4zNi4xNzEuMjE5AhQNByDxtRKM7mjQvskJVp1wrj/QxjANBgkqhkiG9w0BAQEFAASCAgBJrZoCKLB9RrjZtwYb5uFxDcuSngzvXVVZe3BtQdSgSq9PzG5dg9me59s7nhIj2WdWFuAdW+BuQ5pa8D+xxeKoqHhUQNCfgIE70tlhI0s9TrWJogDH+QZHE7TC3z8gUNdBo51C8Aq5FqU/Mql8MxnGMe2vgsT79pyM+2PZ6uqMqw1QiOjpFOgQ0uVb1qdYlOx6WbUuuRjGPxvxTogyX+ujdvVPnDmibgAv9UKYkfArsFLYRRB/p6uo4bTvyvwWLu1FLrVH8JSWP5o9otBNAJTCu49ayz09ED8CfnVRyRrgkKOOmqTeh44vyMJtgKjTKvldbypsdbvqFYgIazHBl3aCYlNs0GPyKVFtCNoWaAqv+waZCEccv6uz4q/9XdMLw6vcKYcc38EaYHUc0hp0XbKnGjgojsjhIjCEcqEsvbWyLqkH7Kf6Yot3zE8S3kp1LfV7eHipVysxVyHPTRKZXVl8s6nKvVGk5ZCyXS6B1Ky+aRVk7yt/QvtSAG19RRywhGVEOniugICCASnc4Dyeb1eQq6PBwq6O7b0A7QFIudR2LXNG8YHWqKBBOQMCk1n4sR0S+XgurQ5RX6G3L4hIJf6awZzD9pUdoDlRmnOduv7e1eg6vUstsFU1opEQM3P9BVQThv4wOVTjyJwscXAMFvwXEx2euyYY1qNp9rquBi/FHjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBD1ryvEYNdTd0+wpque24SfgDBOr110Jqv+Xq/onLdb1vWs6czuTQsoXqglRuZ9xxl4jcbbTawO9IHpvWug233sWQY=]
+knot_tsig:
+  knot-ladok: ENC[PKCS7,MIIC8gYJKoZIhvcNAQcDoIIC4zCCAt8CAQAxggJ6MIICdgIBADBeMEYxCzAJBgNVBAYTAlNFMQ4wDAYDVQQKDAVTVU5FVDEOMAwGA1UECwwFRVlBTUwxFzAVBgNVBAMMDjE5Mi4zNi4xNzEuMjE5AhQNByDxtRKM7mjQvskJVp1wrj/QxjANBgkqhkiG9w0BAQEFAASCAgArQaSsFq9yJcYkht/l3/FmpgcDcS4u9bWM27LKTgKAb86SSZmnkB9W2nYGqq1RZ9R9HmGrqQrwmT0xdNWWQSXpAHZ/EIg/Xeg/jGRvRuND9upuSLfrY72/dWDPGt1fXGPNXzgozhMIYC8DmPuZ1GfAC3PRJJAFmhq0Ynqe761aj2Bz//K5SGTzuYcTSRz42ZQ8Sojj9pTI7BmtRxISFpgBSO6jf/X0/6Xh/mHpgDQ/Rt4X6X1shqyqfGv4Wqlf81jE+DflXpcs+iPz/irpHKmfiYkKosOFLsPLqxe7esLCx4c/yC2DPS6cmCMVNCgjaL8oQrULnhisXwzl8FBAZIr8lMvPlitxjG4GebToYPIglTbdqaEi1sdDarSpNudjkJwMUAd8ZMGL0Yc5D5iCiCHjNHc6aN/dkBZAF5P53Du+GDlfGuDOoskPjBPkcLhJJkLYKYhx9Kl9X55/3DozXd4jocWz/pvKx8hnIWmpYqDFAgn+ZKg4o/ZoGu6Z1rrSCtlqqGE/ydpiZNdFZ1oY7Mt2hXVOcnJuhbTe1k+1bTTEBfvgp6aEonLgXaYt/59R75W8UZcO3n0fivBuo8KWtkLORgm6L/OrEYPToI6TlqIfGRnCtqgQKmzBs+FoTrTVW/C98G7SzwW5dtkRHglRZp93HUr8Vb50IqjI8jFEKnq3tjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAA7BBQTzi6WiPdXX4fXqMkgDDTkjtTf+zbSFSAuGoDAhRmODplTdJpViYxgnuu3UvX/G4qFRmA4X2giqe591qFXCA=]
+  alt-ladok: ENC[PKCS7,MIIC8gYJKoZIhvcNAQcDoIIC4zCCAt8CAQAxggJ6MIICdgIBADBeMEYxCzAJBgNVBAYTAlNFMQ4wDAYDVQQKDAVTVU5FVDEOMAwGA1UECwwFRVlBTUwxFzAVBgNVBAMMDjE5Mi4zNi4xNzEuMjE5AhQNByDxtRKM7mjQvskJVp1wrj/QxjANBgkqhkiG9w0BAQEFAASCAgBJkVAcgcKO8YR0yr2nGVTSQWb7A1eJMqBbPrjTojKepIJN4zdGhLSjETmcMDDBhOVoWSRoE6U9+FRZSwjtRy2yVyPBvoMo7lENncLbT8vISWlyBhWTsXrk8SctgyaDhjD/lNwfzk1VquVuw7ncAEP/iquS+3oTM8BGs62jmVUdKaug5wJWsGDeEkxXhWwmllXCbqblkLZ2oDVW1cbMrgDAda+YT4XsncKjpyiouyvxyPvWM+6e2/9Ijg/TMljhKBT/2NRSglUH5crqpg2LDBbLavjO1gS9nsgPEUkDcUD1sWVJU4J5o+TTuPuVe69G2M4koFNEzmuM37C9jiGKWUKwzX11ayD2xs4QGWKLfG62MdlPycHcMwTHnF+Cbej9iLx5MobXFhGN1VSpUCMRdPswwrWwPodR8h/19NVYoRegiS6E/h4iWDcWlaA1b/MVk/iBy9vWXR/XHDym+8W0TwNHhYT/U4LhmPJ3BvagP86eNwyjO6XyGPxO9QOqG2f2lkB33XqE39UlJacmwV/ex2Fvej4wG3dL0qN51tH6a4KpYU+kpFYckntm9jnvnclTF8D0WjU/sH19W/GjYVoad5fzrllZr/5wGKRJr+g7X5c1GLGV8Lwu2SU36NVlHQiz5XPCoDKHVR5Qfc03FfWVDsdAJ8fJijVMAUwh/xTuhSaoijBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBC/AZcyUWdl4sVHFWcs9xfkgDBwgB9SrJWksAkDU+GCplJz1ZsvqYVfIbzYb4omVc0LT0W4p12k4aCI0diQaBgIgAY=]
+  sun-ladok: ENC[PKCS7,MIIC8gYJKoZIhvcNAQcDoIIC4zCCAt8CAQAxggJ6MIICdgIBADBeMEYxCzAJBgNVBAYTAlNFMQ4wDAYDVQQKDAVTVU5FVDEOMAwGA1UECwwFRVlBTUwxFzAVBgNVBAMMDjE5Mi4zNi4xNzEuMjE5AhQNByDxtRKM7mjQvskJVp1wrj/QxjANBgkqhkiG9w0BAQEFAASCAgDcoiR9utHDFLRo0tTqOVpSkqwR0zq4ZYINcRT7FQJfN7A/3G6pJw5HbR62RxPXAZFWIoC/bqUWN4Yu7h47oSjG/rWPBlYRRPvs6Qk5BTkbkCofj32z+VT2dH65jgP0Td72kQFRVQ26j3S4D4WdylXZ/5aSIth9NxiKWcPo3to2WkDae2hPBoIg0OraLr3eRIQ3E/Ac8Mn6+zcN1HivE0QAz5jQPfagItbKqOitRY+hkCXWMxZhCJeGH7NQUizSuEEborqrsNIlQVuRs2/dhu4GZlZ4q7QnJCzl+ZjADhvXWfz0p1wDUkOArv7fmemAKkEkAIEOPTOC+nOKxceNYXDibguEV1U1Y2fWXIVdSUg5ghEuDm8683UtfFaf2MtMD0/zLdGc1n6j7FjTjYcPPs0vLdbbgSM0v87aWAgCnoEZnrAe58uUQuJKHjil96SI0blmaVLJkYeIlXtmV8b88jXdmpj8Ad1ZUczW/hANRd7Eu32CDRI9t6Ng57yH063yE7ulxzP0XhWyES47YttDCC97jqWx1qwx5I6a03rIZR17XJUvcXqX2D+W7W3IOjPlfi6N2LqnbZextZRdOyr6Kc1/hb05zRr+m8k6hhPoDPmckQURwPttpB/DRrTLFVr+ENukPmpxRyXL21Dhg1uT4KKl+1dbztgo5rQW5JNi9jn5wDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBD6+s0d1++YsLTwWtCwPP/GgDDrNDxqNaifS5dl81F/Nv+9YNcYDt5l0YjYJhoXrcMstCIJdQk5yUHZ+o/yGpY4I9w=]
+  infra-utv-ladok: ENC[PKCS7,MIIC8gYJKoZIhvcNAQcDoIIC4zCCAt8CAQAxggJ6MIICdgIBADBeMEYxCzAJBgNVBAYTAlNFMQ4wDAYDVQQKDAVTVU5FVDEOMAwGA1UECwwFRVlBTUwxFzAVBgNVBAMMDjE5Mi4zNi4xNzEuMjE5AhQNByDxtRKM7mjQvskJVp1wrj/QxjANBgkqhkiG9w0BAQEFAASCAgC0nCdeNmvlWHOrudr321lWnkSKHQiLL3/QV/a+PGXFH6zvlQQmWIXB/GXbkdqp6LV/9fBUQayW2jW71jqi1eOvkWAUeESaCxj7FEdCJvvIsJWal7Wz5zrlhrPZsDi5KkCi2FDyUnbSNiJ39b6PsG9N4uODGaSn0K+y2t1hX+yvSA/be+nNoIsj5qidv9g554u+hMVLYuv3Ha+5v4NQA+uBQqzeo3k1arzX0XtcAYQza2Se1ZkHyyTfnHx3P2a8PUcnfhJheLFlZGtFYPfS5saNjfjfalvCdOpZ/ptIhTZxQ6qT22d9pVWxppLjJQC8yunO/ZKgj73sXqe8XAww/0rbseqWvwk2TK+aK7TkAt0/m0J9+5PC4F9liCN1oOA/RhgOqcqfT132c4D2Zszol6oKWWp8wFIzE+sNFVM2tv3a+T/z0P4+l0oHkWS6Km+IrWqeR4Z2/I/VPdfGavhOZnjwVb9jy5x0rfcCA/UekCORuHXCIAz/bVFgQ0GpqLZfSATg0CFHU5V6x3JMNbe1QBvN55Q3loWHu8pygPz/fN/fnS59CMU1JBdKHyhzlyj5ooa1eiScX2go60JvYfIcQUTk0ZP45NyLMdpVa10cgYlMCcdhe7KrsjPCj6fvLoj/qrgTse8ws/ihAsTeX1bCWmPe8DIFHCRA1NRVcEGDz+S28DBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBtZBGN6rYNGhGlphF+SjkkgDBMoBy/RLBRBGENGaZxZ9vPSUxojCtq0z60nwZT05r/x27+WqNHJ1og6us/xhpVD3Q=]
+  lab-utv-ladok: ENC[PKCS7,MIIC8gYJKoZIhvcNAQcDoIIC4zCCAt8CAQAxggJ6MIICdgIBADBeMEYxCzAJBgNVBAYTAlNFMQ4wDAYDVQQKDAVTVU5FVDEOMAwGA1UECwwFRVlBTUwxFzAVBgNVBAMMDjE5Mi4zNi4xNzEuMjE5AhQNByDxtRKM7mjQvskJVp1wrj/QxjANBgkqhkiG9w0BAQEFAASCAgAV+Z3THlWHgOwWt6+KFt3peYIZkXs+JAzdzoCWhm1qqqMHZQ0lI2wDqvsyHX7ffh1h2hNUh9cFSGl8YSmJLqcFhKIJ3tpCEyIH4vYxY5IyBEXCAvng/fDrK9K46nIsL9oND6lamEDJc/PVEoiSwY4BdLcFGDdM7m8BXmi/vE2V93WRT99BWABhFE9vBtQ3bniphtGVvgraaoaO1e2Pc6Pn15EbRKWRlhGRcLyI3Db/k4DVoQZAbGRAmNUQJf5jPLNqz5kNwAEnsAU06V2ky37o041EMxaIF6zfBfFfhgkk1L8oIqjfRdN520XNCX0pUbYGakIP7OkTlKyoL9p3buUY0F3ou6MHUFHJENBslyXHra1AlOU6oP8VFDX6gWTpRNixTllGEnkuitBYcVFNeFoqqUjCp5wrq0nFDjJHtOiTmieAI9sPwRS+rvs2c5kdDnNpowzyBwFMF3pfH2T3s05KKmuFT04W6ajTXYz3mJ1xVuHnrkR2+jPC3I7t7Bf0edWeusDpGnz9x53NoarL99/FzjSb+Gxmtsao/1LSz0IC/Oe6xH1s4u/VxkDOMcHem4rBgr0bR8jixijdiA604MWiyP/1xvOlE3YhO33I8kus96TeS2YjrjXBAQCTOyIRyst/BpL0ISVUEH1i/j0wAw0XnyPR4nAPegd89Y/UJKMRCDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBCoUpXn8Nq9hu0sx22HpLOSgDBksY4jO87KhP9Qws/bBeeRuDNSZo1245AYbBVcF9DZmkjcqZKGFFuLYgj/g4fqrIo=]
+certbot_acmed_clients:
+  dns-rest-api.sunet.se:
+    allowfrom: []
+    fulldomain: 407340c1-4111-4524-a114-a7bf566235e1.acme-d.sunet.se
+    password: ENC[PKCS7,MIIC8gYJKoZIhvcNAQcDoIIC4zCCAt8CAQAxggJ6MIICdgIBADBeMEYxCzAJBgNVBAYTAlNFMQ4wDAYDVQQKDAVTVU5FVDEOMAwGA1UECwwFRVlBTUwxFzAVBgNVBAMMDjE5Mi4zNi4xNzEuMjE5AhQNByDxtRKM7mjQvskJVp1wrj/QxjANBgkqhkiG9w0BAQEFAASCAgAal7DXCacCAGYESfKOJnOWBS40FoJqSpNygndpO1arzgpB2IhgYbGPvrXPL9Ijw5c1x3cGPQz47FVVjflPBH4XgOvAEWmIIyI0BBvFxNq9BAtscCeeS59KsW0014gKqsoBwQHzlRHjJN6sXIT9jVCHgW2ULyEkFK3wZZt2yl9q5QNACUcV3/dKVQRuG+NZOCgi+BbdpzmDEBDmTdQIpQqYSsL49x7sA+fT/ynQ7jdttZYy/0LXTUostjAfwulUoADcbSMR1brd++ifJuiAZ3RJ6bdvdOW/LtslSGcG3MPOJY5mgmfM8R0UtxPPafnS1c6hujwcEbe/whXCB1LbMubCFDtJWvdsTJN14X3OkqlifOiVns1sI+KjaPuVyUTruLPSRnhVmAzUMLKN/PI8tQIW4760BVhKfwWtkItB/BoUEw1xUTSj6cwSc3jF+6srGAVsu0UQm5hikLHCdTDQh6XCylp3w9P8WzFplSfdzYZXJCQbOc0VYKRyg+tQbn+MfAkZuSFKzpxXAN3ZGNmCJBN5XaCWetNuEPgaO4lkf7l9tFbm6KYrbAfH1kZneMzgrflPSGxjY7xANh7lm3lvRsaYj9/BZ8DOO1Waj7T/1opejgX1ZBvVhBHpBbLDqRUektRuuwoK//3/GT1h2u1mJGyvuiZD9xZZVHvZxNbTgeqTUjBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBB6NQXRt0g/cFyQ+f0UtUg8gDD5/hyWVYQcTyTEn7O35pZhQeXDEJp6BRl+NpoKzKkiADvKEf7o9iAutux0ylZVhnA=]
+    subdomain: 407340c1-4111-4524-a114-a7bf566235e1
+    username: 99b14522-26cf-43da-9774-e9338488d808
+baas_password: ENC[PKCS7,MIIC0gYJKoZIhvcNAQcDoIICwzCCAr8CAQAxggJ6MIICdgIBADBeMEYxCzAJBgNVBAYTAlNFMQ4wDAYDVQQKDAVTVU5FVDEOMAwGA1UECwwFRVlBTUwxFzAVBgNVBAMMDjE5Mi4zNi4xNzEuMjE5AhQNByDxtRKM7mjQvskJVp1wrj/QxjANBgkqhkiG9w0BAQEFAASCAgApKtJEud7JKuBBtCVndp9z4bkRjbydCtEq6pnlwbFJngcJrKWRa06mqS5uRFxgwsu47sPM9p2Jmow2VpcxEO+ZAOUxvBW/DCnlHg6oPN/OwNsRVvh7kyEn00fdX6vYF6mEfOyv6/4T6VNKtXPchE6XPb/pFD4yF5GB4VbCKgDvoOQSqQuEuYcFZ+ICVhhOzBu5DdX1ApMYDNWN+RRBgP+AE4hO0r1WaDyesDtXzlWe6WvcXW5oPZfNgKPjGbVrxC7jE/I2qqQJ6cPAw2Oy89K7Xa2nEOMuxPittcbTjopCJRytH02eVpg2BzWcTasd0wZnneGZj1FUW5GTKAY/33zXKFZFfQoVmAvhxAN5hnSuifjbV7A5Pqmz9mYy6EDqvM0idJsIVzAXMlKlx84SKsJPjP/Mv4Vaza2g5QIlhxxq/zB3duAYDSR0Swsyqw8Z6UOqkFKy52l0ggPJGSJ9aL9kPmLzZN6BZCUrHAOty5Fc21Epi/1t/qw4qv0endyc+mVJUtK/rJZY0Zu1udf3Zs0l8U81FHcKJyZYTtXqIluXpd0btIo+/aANKQuZUEu3spAhymmRjRmh6nQfB24nYS2h9EYrbq3LwX0eeKguPNr7BkEhP1+eyRxRyzzXKVWgYPQ5AvqHxqU6mtbQJ4qUFFMm64zEs0doXPgpZh9lYg19BDA8BgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBA2Q9hE9HIs8e+43xsd48zogBBRpa04S1PajUle3+9Dp+UB]
+baas_encryption_password: ENC[PKCS7,MIIC8gYJKoZIhvcNAQcDoIIC4zCCAt8CAQAxggJ6MIICdgIBADBeMEYxCzAJBgNVBAYTAlNFMQ4wDAYDVQQKDAVTVU5FVDEOMAwGA1UECwwFRVlBTUwxFzAVBgNVBAMMDjE5Mi4zNi4xNzEuMjE5AhQNByDxtRKM7mjQvskJVp1wrj/QxjANBgkqhkiG9w0BAQEFAASCAgC/4/4WEYiKwXrIqkEVHdLjtcdDQ29gUcabKhxUnXnCEDVpa3IqnncRW5H+/en2AhMiANinUi/NbbTe5I2HC/hVr3rF6b36QcZ7b9M/1HoR7WrrW4qtyMfur2XvInwlHoayxwbqWad9yqe8DbrBxC1R5F/0y+VRARZjnnY1giqkAWlvuGlX3m7mMcopLrnR3/oLzTcmN5/7wJ00P8+yaBjHofma0BN5YPpokoTqs5puu0NZMXkX6JWaB0FblVbl85JocUZSeNYofxg0ai3X9PufJXY2e1EXT1n8kArbOI3xnq+aQeX98GUkLcssFv1LBAJ8lGcJARdJN8oNgzajd/0Tll4qzXqjBSDcpG04fK8IFeGIeWW/566SOszwfSHxu9Zl+deraACEEg7IaOcXdvyERlm6ojDDycRJZ8r70GFiZt8H4BHhQ2hORUq7CUjElpDjAj0yODELIZHvU7m261HkfM1tZnIUjJ/9epZ3Iz72yQjcSJYSLy2hk+k6LMZiueS1xnTbF91IoDyGlngLg2caqL+tm7y0fOe3P8jDm9jwIWM82TSXXuD4yZL84UrpXl5rlcVkmtyfNUilHrt8P5RlLIR4emBHyf0SAQrzMUXMIyyL1b+xS/ed2V7NhhNJyCOWqPMc/Avq+Zxps0HOkDj7ddgmiRLXmb9SEPogiLI+qzBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBDCkRsa80w/dwutQVe9qM1/gDDdXlik3LXsaZ8y8btkgZqzLJ+5U2Y9ISj9pODAkQa2bYNC5P5tJt8gaLaUxMI0iq4=]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/0sunet.catalog.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/0sunet.catalog.conf
@ -0,0 +1,77 @@
+# 0sunet.catalog (catalog generator)
+
+acl:
+  - id: txt_ddns_allow
+    action: update
+    key: knot-ladok
+    update-type: [TXT]
+    update-owner: name
+    update-owner-name: [ _acme-challenge.*.alternativ.ladok.se. ]
+    update-owner-match: pattern
+
+  - id: ddns_allow_alt_ladok
+    action: update
+    key: alt-ladok
+    update-type: [TXT]
+    update-owner: name
+    update-owner-name: [ _acme-challenge.*.alt.ladok.se., _acme-challenge.*.*.alt.ladok.se. ]
+    update-owner-match: pattern
+
+  - id: ddns_allow_sun_ladok
+    action: update
+    key: sun-ladok
+    update-type: [TXT]
+    update-owner: name
+    update-owner-name: [ _acme-challenge.*.sun.ladok.se., _acme-challenge.*.*.sun.ladok.se. ]
+    update-owner-match: pattern
+
+  - id: ddns_allow_infra_utv_ladok
+    action: update
+    key: infra-utv-ladok
+    update-type: [TXT]
+    update-owner: name
+    update-owner-name: [ _acme-challenge.*.infra.utv.ladok.se. ]
+    update-owner-match: pattern
+
+  - id: ddns_allow_lab_utv_ladok
+    action: update
+    key: lab-utv-ladok
+    update-type: [TXT]
+    update-owner: name
+    update-owner-name: [ _acme-challenge.*.lab.utv.ladok.se. ]
+    update-owner-match: pattern
+
+
+template:
+  - id: 0sunet-catz
+    catalog-role: member
+    catalog-zone: 0sunet.catalog.
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
+    storage: "/var/lib/knot/catzones"
+    file: "%s.zone"
+
+zone:
+  - domain: 0sunet.catalog.
+    catalog-role: generate
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
+
+  - domain: alternativ.ladok.se.
+    template: 0sunet-catz
+    acl: [txt_ddns_allow]
+
+  - domain: alt.ladok.se.
+    template: 0sunet-catz
+    acl: [ddns_allow_alt_ladok]
+
+  - domain: sun.ladok.se.
+    template: 0sunet-catz
+    acl: [ddns_allow_sun_ladok]
+
+  - domain: infra.utv.ladok.se.
+    template: 0sunet-catz
+    acl: [ddns_allow_infra_utv_ladok]
+
+  - domain: lab.utv.ladok.se.
+    template: 0sunet-catz
+    acl: [ddns_allow_lab_utv_ladok]
+
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/241.182.193.in-addr.arpa.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/241.182.193.in-addr.arpa.conf
@ -0,0 +1,7 @@
+# 241.182.193.in-addr.arpa. (sunet legacy)
+
+zone:
+    # Primary zone(s)
+  - domain: 241.182.193.in-addr.arpa.
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/34.121.192.in-addr.arpa.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/34.121.192.in-addr.arpa.conf
@ -0,0 +1,7 @@
+# 34.121.192.in-addr.arpa. (vr)
+
+zone:
+    # Primary zone(s)
+  - domain: 34.121.192.in-addr.arpa.
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/adva.sunet.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/adva.sunet.se.conf
@ -0,0 +1,7 @@
+# adva.sunet.se (noc)
+
+zone:
+    # Primary zone(s)
+  - domain: adva.sunet.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/cdn.sunet.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/cdn.sunet.se.conf
@ -0,0 +1,5 @@
+zone:
+    # Primary zone(s)
+  - domain: cdn.sunet.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/cert.sunet.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/cert.sunet.se.conf
@ -0,0 +1,7 @@
+# cert.sunet.se (pettai)
+
+zone:
+    # Primary zone(s)
+  - domain: cert.sunet.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/cnaas.io.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/cnaas.io.conf
@ -0,0 +1,7 @@
+# cnaas.io (mikott)
+
+zone:
+    # Primary zone(s)
+  - domain: cnaas.io
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/cnaas.sunet.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/cnaas.sunet.se.conf
@ -0,0 +1,7 @@
+# cnaas.sunet.se (mikott)
+
+zone:
+    # Primary zone(s)
+  - domain: cnaas.sunet.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/dc4eu.sunet.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/dc4eu.sunet.se.conf
@ -0,0 +1,7 @@
+# dc4eu.sunet.se (masv)
+
+zone:
+    # Primary zone(s)
+  - domain: dc4eu.sunet.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/dcn.sunet.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/dcn.sunet.se.conf
@ -0,0 +1,7 @@
+# dcn.sunet.se (bj)
+
+zone:
+    # Primary zone(s)
+  - domain: dcn.sunet.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/dco.sunet.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/dco.sunet.se.conf
@ -0,0 +1,6 @@
+# DCO.sunet.se (bj)
+
+zone:
+  - domain: dco.sunet.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3, ns2-sunet-se ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/drive.sunet.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/drive.sunet.se.conf
@ -0,0 +1,7 @@
+# drive.sunet.se (kano)
+
+zone:
+    # Primary zone(s)
+  - domain: drive.sunet.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/drive.test.sunet.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/drive.test.sunet.se.conf
@ -0,0 +1,7 @@
+# drive.test.sunet.se (kano)
+
+zone:
+    # Primary zone(s)
+  - domain: drive.test.sunet.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/eduroam.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/eduroam.se.conf
@ -0,0 +1,7 @@
+# eduroam.se (herrnilsson)
+
+zone:
+    # Primary zone(s)
+  - domain: eduroam.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/eduseal.sunet.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/eduseal.sunet.se.conf
@ -0,0 +1,6 @@
+# eduseal (masv)
+
+zone:
+  - domain: eduseal.sunet.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/edusign.sunet.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/edusign.sunet.se.conf
@ -0,0 +1,7 @@
+# edusign.sunet.se (steli?)
+
+zone:
+    # Primary zone(s)
+  - domain: edusign.sunet.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/example.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/example.conf
@ -0,0 +1,9 @@
+# Example zones, playground for the DNS REST API users
+
+zone:
+    # Primary zones
+  - domain: example.com
+    dnssec-signing: off
+
+  - domain: example.net
+    dnssec-signing: off
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/fidus.sunet.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/fidus.sunet.se.conf
@ -0,0 +1,7 @@
+# fidus.sunet.se (bjorn)
+
+zone:
+    # Primary zone(s)
+  - domain: fidus.sunet.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/geteduroam.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/geteduroam.se.conf
@ -0,0 +1,7 @@
+# geteduroam.se (jocar)
+
+zone:
+    # Primary zone(s)
+  - domain: geteduroam.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/geteduroam.sunet.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/geteduroam.sunet.se.conf
@ -0,0 +1,7 @@
+# geteduroam.sunet.se (jocar)
+
+zone:
+    # Primary zone(s)
+  - domain: geteduroam.sunet.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/knubbis.sunet.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/knubbis.sunet.se.conf
@ -0,0 +1,6 @@
+# knubbis.sunet.se (patlu)
+
+zone:
+  - domain: knubbis.sunet.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/komreg.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/komreg.se.conf
@ -0,0 +1,23 @@
+# komreg (swedenconnect)
+
+remote:
+  - id: localhost-nmugroup
+    address: [ 127.0.0.1, ::1 ]
+  - id: origo-nmugroup
+    address: [ 193.183.80.4, 2001:67c:1b2c::4 ]
+  - id: unit-nmugroup
+    address: [ 217.10.116.210, 2001:4db8:e004::2 ]
+  - id: ephemera-nmugroup
+    address: [ 213.164.206.197 ]
+  - id: vertex-nmugroup
+    address: [ 31.192.227.186, 2a02:750:5::4c0 ]
+
+zone:
+    # Primary zones
+  - domain: komreg.se
+    dnssec-signing: off
+    notify: [ localhost-nmugroup, origo-nmugroup, unit-nmugroup, ephemera-nmugroup, vertex-nmugroup ]
+    # served by NMUgroup
+
+#  - domain: komreg.net
+#    dnssec-signing: off
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/lab.sunet.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/lab.sunet.se.conf
@ -0,0 +1,7 @@
+# lab.sunet.se (lab)
+
+zone:
+    # Primary zone(s)
+  - domain: lab.sunet.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/labb.sunet.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/labb.sunet.se.conf
@ -0,0 +1,7 @@
+# labb.sunet.se (labb)
+
+zone:
+    # Primary zone(s)
+  - domain: labb.sunet.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/mail.sunet.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/mail.sunet.se.conf
@ -0,0 +1,7 @@
+# mail.sunet.se (kano)
+
+zone:
+    # Primary zone(s)
+  - domain: mail.sunet.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/platform.sunet.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/platform.sunet.se.conf
@ -0,0 +1,7 @@
+# platform.sunet.se (kushal)
+
+zone:
+    # Primary zone(s)
+  - domain: platform.sunet.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/prod.sunet.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/prod.sunet.se.conf
@ -0,0 +1,7 @@
+# prod.sunet.se (prod)
+
+zone:
+    # Primary zone(s)
+  - domain: prod.sunet.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/rut.sunet.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/rut.sunet.se.conf
@ -0,0 +1,7 @@
+# rut.sunet.se (mifr)
+
+zone:
+    # Primary zone(s)
+  - domain: rut.sunet.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/se-leg.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/se-leg.se.conf
@ -0,0 +1,7 @@
+# se-leg.se (leifj)
+
+zone:
+    # Primary zone(s)
+  - domain: se-leg.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/sfhm.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/sfhm.se.conf
@ -0,0 +1,11 @@
+# sfhm (sunet hosting)
+
+remote:
+  - id: ns-kth-se
+    address: 130.237.72.246@53
+
+zone:
+    # Primary zone(s)
+  - domain: sfhm.se
+    dnssec-signing: off
+    notify: [ ns-kth-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/social2saml.org.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/social2saml.org.conf
@ -0,0 +1,7 @@
+# social2saml.org (leifj)
+
+zone:
+    # Primary zone(s)
+  - domain: social2saml.org
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/staff.sunet.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/staff.sunet.se.conf
@ -0,0 +1,7 @@
+# staff.sunet.se (leifj)
+
+zone:
+    # Primary zone(s)
+  - domain: staff.sunet.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/sto3-private-cloud.in-addr.arpa.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/sto3-private-cloud.in-addr.arpa.conf
@ -0,0 +1,16 @@
+# xxxx-sto3.private-cloud.in-addr.arpa. (sunet/safespring)
+
+zone:
+    # Primary zone(s)
+  - domain: 236.45.89.in-addr.arpa.
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
+  - domain: 237.45.89.in-addr.arpa.
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
+  - domain: 238.45.89.in-addr.arpa.
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
+  - domain: 239.45.89.in-addr.arpa.
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/sto4-private-cloud.in-addr.arpa.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/sto4-private-cloud.in-addr.arpa.conf
@ -0,0 +1,16 @@
+# xxxx-sto4.private-cloud.in-addr.arpa. (sunet/safespring)
+
+zone:
+    # Primary zone(s)
+  - domain: 20.46.89.in-addr.arpa.
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
+  - domain: 21.46.89.in-addr.arpa.
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
+  - domain: 22.46.89.in-addr.arpa.
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
+  - domain: 23.46.89.in-addr.arpa.
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/streams.sunet.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/streams.sunet.se.conf
@ -0,0 +1,7 @@
+# streams.sunet.se (kano)
+
+zone:
+    # Primary zone(s)
+  - domain: streams.sunet.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/sunetdagarna.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/sunetdagarna.se.conf
@ -0,0 +1,7 @@
+# sunetdagarna.se (leifj)
+
+zone:
+    # Primary zone(s)
+  - domain: sunetdagarna.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/swami.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/swami.se.conf
@ -0,0 +1,7 @@
+# swami.se (leifj)
+
+zone:
+    # Primary zone(s)
+  - domain: swami.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/template.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/template.conf
@ -0,0 +1,8 @@
+# Template (copy me)
+# (if non-standard remote:s is to be used, they need to be in specified here)
+#
+#zone:
+#    # Primary zone(s)
+#  - domain: mydomain.com
+#    dnssec-signing: off
+#    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/test.sunet.se.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/test.sunet.se.conf
@ -0,0 +1,7 @@
+# test.sunet.se (test)
+
+zone:
+    # Primary zone(s)
+  - domain: test.sunet.se
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/thiss.io.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/thiss.io.conf
@ -0,0 +1,7 @@
+# thiss.io (leifj)
+
+zone:
+    # Primary zone(s)
+  - domain: thiss.io
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/urlproxy.app.conf
+++ b/dns-rest-api1.sunet.se/overlay/etc/knot/conf.d/urlproxy.app.conf
@ -0,0 +1,7 @@
+# urlproxy.app (pettai)
+
+zone:
+    # Primary zone(s)
+  - domain: urlproxy.app
+    dnssec-signing: off
+    notify: [ ns1-sunet-se, sunic-node1, sunic-node2, sunic-node3 ]
--- a/dns-rest-api1.sunet.se/overlay/usr/sbin/knot_lastlogin
+++ b/dns-rest-api1.sunet.se/overlay/usr/sbin/knot_lastlogin
@ -0,0 +1,29 @@
+#!/usr/bin/env python3
+
+import yaml
+import sqlite3
+
+try:
+    with open('/etc/knot_rest/knot_rest.yaml') as stream:
+        yamlconf = yaml.safe_load(stream)
+except Exception as e:
+    print(e)
+
+knotrestdb = yamlconf["database"].removeprefix("sqlite:///")
+
+try:
+    with sqlite3.connect(knotrestdb) as conn:
+        cur = conn.cursor()
+        cur.execute('select username, description, logged_in from user')
+        rows = cur.fetchall()
+        for row in rows:
+            username = row[0]
+            description = row[1]
+            if description == None:
+                description = "(no description)"
+            lastlogin = row[2]
+            if lastlogin == None:
+                lastlogin = "**never logged in**"
+            print(f"{username:<27}{description:<27}{lastlogin:<23}")
+except sqlite3.OperationalError as e:
+    print(e)
--- a/dns-rest-api1.sunet.se/overlay/usr/sbin/knotrestctl
+++ b/dns-rest-api1.sunet.se/overlay/usr/sbin/knotrestctl
@ -0,0 +1,2 @@
+export FLASK_APP=/usr/lib/python3/dist-packages/knot_rest
+runuser -u knot_rest -- flask "$@"
--- a/global/overlay/etc/cosmos/keys/pettai_6CAD709DD55A324786808BA99E7C616A5CDB13CF.pub
+++ b/global/overlay/etc/cosmos/keys/pettai_6CAD709DD55A324786808BA99E7C616A5CDB13CF.pub
--- a/global/overlay/etc/cosmos/keys/acrn-9A6A3E85446B9DABDD90DAC4B189A302EB5F91CA.pub
+++ b/global/overlay/etc/cosmos/keys/acrn-9A6A3E85446B9DABDD90DAC4B189A302EB5F91CA.pub
@ -0,0 +1,105 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGdEatABEACr5Hbp1ZNth5wDbij4TihAQdzbzc/5E2uxC5YvLwncTErlCoVw
+GhNcVfRMvqhbBbTdHmaCT/aZCHirnHjyG1Eay2mmjAeyiuXMJp/sYRYxvkeOZ0Mf
+3gKsB+KFwOEScDR6s62lju2c9eQo4WxQl9sojERNZm3KmEsvrmXkceNNMaXqoUoW
+YXciguEV891uUUeD0ft+vB9U8RQwsO/0qloNpqKj9FFFt0W0lvKEy+ErG+D0rlX3
+8N67syaxlRBl0zwgbnvAvnwr4nAFk/nGr9Hx/NhPrV/LU8leefPdzbtw/T+8ub8K
+smpatnUS4DrkDpLQoKQUACnqJObYN+pULBaO+L9E9/yngJJjYB5zG5S6b/Z+PZbJ
+/GRlnVay63PLRybYrOl2n8rjfwcUveHpPpw8wa2Vn/xbWtVKPfwiqBSthYudMiSz
+4kRb0jZ9W/YnRxgbY0QzXk3st6If0AulqDWEcx6vS5oG6tulTd+ZnpX7TylJ7aI9
+VZthPbzjSdsRRhzfjEW+A4x++ponU+rYaMvhIp2UnozT8PAuMlyFBf7aa2HWatnD
+OlMdtVngBFnkd4sLFcgLN0W+kzksxgz37DVDrLARN6J3YupcOLemNSnyK2dXw8vS
+qbjd34HsR9ZY+Vee4RyCVjhq7eDgogoCiPrXYLnxsO64ohcP9jur1hOe1wARAQAB
+iQKPBB8BCgCDBYJnRGrQBYkB4TOAAwsJBwkQsYmjAutfkcpHFAAAAAAAHgAgc2Fs
+dEBub3RhdGlvbnMuc2VxdW9pYS1wZ3Aub3JnjLK0kPIQ1qp5Tlx/Ozh0v7IEnsBF
+tCgsPe0Ga6DLKYgDFQoIApsDAh4BFiEEmmo+hURrnavdkNrEsYmjAutfkcoAAMl7
+D/0SbZypsT7ankLo7Xh/Xqww5rVec7Mr7NSLGaDpn4XHlZSh6JPc48JNngItHaTz
+69ZsT7dYy8urajrfHccCnzO72vKOcudefXjJHAUQ7z523sw7WlaM3NVyfHb5lhkX
+c1oIKoJqCDvCVqn11j6FL7fXBQQGRQl2KVYwcXNxMa4s91m+9TBIOXDCLBeYgZ0f
+EW8s/ahUkDetGLRqAv0/ePQa3PKnUAs2lOQNvn5hdzLEyyQTdKu/zxUf92EYfYJ9
+ub0w7re+FBk6o/mdNRSfmJYK+OeB+020AtfYSbLDayQK7mtL6rJqbdbwej45RjKA
+4emjDPu9C2oz4jRiHHB18GquyAIdwttfAzCEz7odsfzaiH8+y38iQ89NcSe4aUVL
+2l95gmRmql0KLGs6/y82YMYzWK/9PrfHbS3k4pAOFTqcFvk3v9AjiWKkRFSSnq4j
+RUQBI+WtcM6Rt/0DS0nzOPulmAMv372x40dAmpAUL5hzLX+LRimVCEBO75wMAF1o
+LHGV/c0Ajt7aq2PtUEs8IvrTyMBVW8Ne2xd9oBZO4eep8RsLtWb9A8cBRgOG4dQ0
+dfcOQzr4DMwHTpQa2PDAIyMydy9SduSkLS+VdnPL9Jk/9J/P2pJvto0PiASfdI1B
+5Q4C14PSNmAcFuFF4+y0anbbjsNwfBiAd7oOHrJLHn/SybQqQW5kZXJzIE9za2Fy
+c2VuIDxhbmRlcnMub3NrYXJzZW5Ac3VuZXQuc2U+iQKSBBMBCgCGBYJnRGrQBYkB
+4TOAAwsJBwkQsYmjAutfkcpHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9p
+YS1wZ3Aub3JnQlyG/D7l+nGUu6q0HhBFyY+HXida3auwlgYLTEYxmlkDFQoIApkB
+ApsDAh4BFiEEmmo+hURrnavdkNrEsYmjAutfkcoAAMvuD/9tKCqkmR4pKrQG97Us
+R1Di44fV1uG2kxnZsQA5iWbQ84QuSOxr2W+W4bwbb750VsIg+unXE64LQbhxprFQ
+QCC0X/sBeAHxrJJg+fgBI2KqFaQ3tF/7wXfxGk2pUgTir+tYk23H3Rky6cjQZipg
+VcTD+VxBGusVslkHU5nK0hMhueXmA43t57S1EYojDSpHm23iordQLE3RJGKVUmHE
+CHOktL+IJdFtJbc8YNKsp8IbZIcfOcfAsQhe0siI2y+yixl1/g22EGfdRTZtIzLt
+RQ5O68LxsFNPXYESufZye/3bCDG1MYqi3Wo1/K1QjUK+zjTjhjYrZ1Fq1EoLxLCF
+3URiewWxGQWK1qlthxI4HU8ZDeKUL6D6SM+IljPP/o5zqERlthNIlsQBVsRa8uSF
+iFjOO+8gEEnPlTyQg7OYZ4UjaQl6PDeeEzpMP7jyAfClO2uzdKDidLhLWW2cifMU
+p1B9u0zTp3S0/4Er2C1BoDlY2c/lT2mQ5sqHszMq52p5g82jdR5gF3/U7dOHPyfQ
+idqfZyqmjoH5h/BX8fIFgEC8ZHFV17I3U/NAPtSDf/+b7yoMew1Kfp7cb3aZE09k
+4DfyOKyAFdOgNeX2ESe2zmqA+i7IRRdtwZR42FxgcNXWTiMl7ATlGg9cIUu25E3W
+j5RQhyX6duhhBJ2dsadFcdnHg4kCMwQQAQoAHRYhBBLseLUp/K0TNT1/qBRn+daR
+NcI2BQJnRIdSAAoJEBRn+daRNcI2Ik8P/1Qr+2JYhKSxzKDnGIS2WWDMdOVI9dbL
+tHj4y3P7fWVTN+WlO+uWBKhWTzngJ2AjNhXjbYGZtXjQVdYpzGgYFUsGsyd1l91X
+C3tXdH5UTkaHgmP+zdrobszJxyfgfUGnbu5SUZsqnkoR3Qh4fjM55B4swQwyapB/
+IDcvC6fylEHaDh5ycZgndW8m89kuqCP7mIQjr9Q7gFJDl5i/6tDbjDYHDquftPq3
+Xg/i6/YjB9RC9JS0cWJMKjc2NtL1UwG9cgm8jmOE2MLESeJcOCKy+bFT98bzTZrn
+XZw0yOHAFcWL1/2P0wOGqKOWhurY1wbuOgbt025uWKAsZbTix7WV56iF0fwFTbsO
+jfBWrpmsdzgSMJZYWgIJXE4iOPM9JDtkXF0I8iZWUuXBH4tcp3T7ee2aUeYa4e9d
+qairZYYwkX8JJRvB7AfEazofu8Pc+b3r2fTagl9BF+agECRcabyWCzjDHbIwO4a7
+oofgozJ33nFpGfzbQj0kj/d85Vhdu1ro3uuGfVgLWKjBntnrG6EwIqHn70GJiZCX
+NY5KGH7uoS3i81LflqTj71gFS5YDMaHGNxbTbKsfYTH3h2AvLhQcCPcpQAjQnSWh
+vPTdDaBSsB5MNgO7WPcIlI4TMnQC1S1dCux6ggVhDf+Nn0exPt04DuqPucChLNfV
+q0qFPfUp5FIzuQINBGdEatABEACt6iuXs5y2M4dyRSUqezL1fu95aO4nA1FOMX0f
+LXAw/S0NAgimWbd8TlQLebCeiTt/NevU+eaGjLLeTkONQ+h+NiZ3fIgh+onTBWFU
+w/MXqj/gaZ0d+0U5gcIDohaw0ixCAy1RCR1Iv32wkzqICQtIdNuQ9AhUp0YWkJdb
+adzbHxZVMlxcxJ4ribjHPwWbs47aIArahJ6j3TNwyScRmRzSlpYXIMckj3+wnWBO
+u1sHNSLZpCydFE6xkK67icuDPL4tYk8mC6ZhTZGyhw5LUdIEUIMWXdPiCzYiOQiT
+19Q9G6MUOxqom5g+Vl3mBSq+nuG8WEPhCkqBv209hsg2c/jRgAGeIETrsp0zBEf9
+zwaaiXD6sozLYjAnLwi5ikIcdhkle9SjeXkZtyDJIURG8seJ0JXnBER0p7XPXLbq
+LDXQgD16TtYO8nO7qfl6QskcKYrDDeg9hmdMban6Tu9A5CtlTMV1iZBuBgkuADl6
+skqhfK6SjoPEo4qUGyd1K91d+gyPbO40WIUDV9skMOZYj9KhR4px7WeCRwxU//x9
+bnQkX7oL5HT6loka2rQh8RXFKguUb1kJi2x6DNydZLxOBwaou/SEGMC9519O1gMQ
+Pv3a21MPTalb+kYGoCrfZ43rroX9nkk9steQaZMZrhw1tJq95VkaLmLC8ZtiukFC
+RK1l2wARAQABiQKEBBgBCgB4BYJnRGrQBYkB4TOACRCxiaMC61+RykcUAAAAAAAe
+ACBzYWx0QG5vdGF0aW9ucy5zZXF1b2lhLXBncC5vcmfEs49ykl8gTmr2djmkdTdh
+tq/JHkmf2kt5anEgqs5kwQKbIBYhBJpqPoVEa52r3ZDaxLGJowLrX5HKAACf9g//
+RkyHb3ceNXRpMA+cNuRTRN6PbrlsjYK7afON8bxhbiwGwyM8p9Z3ckWTY0wFwUbJ
+uK7FskdjNn9wfz3922IqN/0/uU2G+wmTuQn6XJacrBKpQT2WidG0r1Xmu7QqSnkf
+iFgr5wjrGt3+pVn1Yf8DQTLf4UxwM+hAmMbCMNhfagVdCCVezozNrkwJfwADPknp
+AzzWZwsnFCHc4+CmJpgGaVt9VhUHsxEfcNACGbBsn+PbpJDWSoK2Cxi1d9iM+4x8
+kYke8LIrEHE8sUfcZbR27ybLdH6XiScmoOxoM3hCASmVpyxCAVFq0Apf3yT6+ra5
+BHme8QoQYbpgiwWAhZ7ghOkmTnVNbbYBOiJJbbtbl7Tl32pRrpf19UBaMHFMrGJx
+bT37N/3FGpcdcTqblfPVS+MUUgLwD98xOPe5cRlENHEcaiFvE6Tf2+x5nIPMwAEB
+65MrMPYZ+n/q0EuFZFM6nVs51CNn8geKoMKk5RLPQUh31uGV3CDoCXcuNObfV+6+
+CODBpz8/O+XNdTuIYGAaRZ0VzpFqxI5SHwCXDpMdZqE29qVD8EQzapvOZ5Er8e3w
+J/6d+hDhWeQefX4i5O1Vp7xDmfqF2XW3z9XElCtdXhoBM75+LCpkYQdKGHnDeI++
+hDQCk6ZyaaHuZED2HsC0BOT1eDS1PpQJ1DYbtM4PeYm5Ag0EZ0Rq0AEQAOCGd1qx
+mk7Qxi63Q8hMbESq6jByZ7sqhQ/wlCIpkPMrJAdLrpV7mus0JneLru7rhjkm4BJo
+eii0riDHPeA5l2a8jeY7EV8U5/vuOmny4PLmhKvGUeIxawTmInyGROzjBwGi60bL
+V5IvVOd5Cwqtvh3ecyxGxEXKiM+tvmlhP2yOrCO4pbf1OUkHY05cYrSw34birt9n
+U+2+4hEgceimNw3HAYnqNAILGRv2CYOMsNVzr7hI55Av41ZWSzwc5Hb4mW3Sftmt
+GD5130k9BVvCm/XInb7M010dVMFZhY+NhEpezGDpXK3cSCio7CxRuDEYTPPDxM1k
+LfO002kVS1L5VcpU/SsW7QZoPcLVwWFwrrm8HXTcVc/OVG6cI5Ki3+5K61neNkJ0
+TWG8oHZ4OCkaQePvnZjbKJj13TG3YcNIHoQHc+uUhiJBHn4nL6McdABbu3xOTIki
+j8GoYYMfWYARGh40AcSzgyKn/R2/ENgJQuQTrsvRevvshKq/3fcqqCwRQgJdNzyk
+md1qmxTO1BxalhFHEL+tdTCIr2MYIgVXiClg6wLlIWrTzYUGBnAEVlPi3ZjDwBHf
+43G4xcOoEzqu2ACJeYjypI24DM9hrJsG1ASXAVfzKQnWEiu+bEnOIXvTOPSvOzJ6
+DwTP8Me18gVxXbEU4gutAs30c8YlUTBZWrbtABEBAAGJAoQEGAEKAHgFgmdEatAF
+iQHhM4AJELGJowLrX5HKRxQAAAAAAB4AIHNhbHRAbm90YXRpb25zLnNlcXVvaWEt
+cGdwLm9yZ3UWdPz3a9vVsYUckrd6tvHaUbjXEDRLFj0WbZKe8nkcApsMFiEEmmo+
+hURrnavdkNrEsYmjAutfkcoAAL7mD/90KIWazWF4iZ4icF8Bkn8VsEPPOFvIlW0R
+t2u90MfWc2ogTS1CulX0pFzir2obo6lH0+7DK3+gTIOCe1evaqWm5ITDV1O2nbYW
+HD4Ace3zSrwTVoBlZJgn5m0MoPinHSWUejkMPzQZxqRz1UaUHwyoyLMfeE08ESAH
+gJWy91X120YXfXnfad71QJFuzz48T1Nmg0xJDY+ZZeqXszUtxQb8/sYSrubS4JLf
+yvXDHFVqHG7EC/c+7DKdxcAzm4xMbRaJvt7KYJg4emd1I0AHyeBGprtYWfdMOeBr
+tfnvdZpRsYWk0pCcufvct9+6LfqnSkNfknwOOd6kJk2Waf2WdKB8nAnhkddwTZhy
+hGQB12r4mE4WfvuKJYUQMOn7RUirJ90TKZxMrOcpVa2jyU4qKjwr7rvcMW9c4+75
+sz8pyOGEZS0t1TrJwdbOIBZ+ZwGYfYuLSZVjjaRm/s3Ynah2o/XO4h4L2JbVhXIP
+8JOE4r7IKXswfTGPRsTDD4Cu5EH/xw+LJLcffpvn10JvWViEhLQTRLsyrLoH7BcE
+1i8Wiz5xLASldJ6OIsbUVQBPpFFhZkE3KhkF7R64UJHZgtwGGv9WNHpFQcyenqn3
+kK+LbuiztBrUXIr7D2xndVtQbbtghboRcBcyDECNfo6EmsPd93XygoQDkSePuCED
+BnXKK29rg==
+=scZl
+-----END PGP PUBLIC KEY BLOCK-----
--- a/global/overlay/etc/cosmos/keys/jocar-BE4EC2EEADF2C31B.pub
+++ b/global/overlay/etc/cosmos/keys/jocar-BE4EC2EEADF2C31B.pub
@ -12,19 +12,19 @@ zLCHXPJzNi4a4vrO3GrV+zHdnNGdJ4p+VWXACwhnFyLkOW4T/nF+f04BS+J9yFMw
 80bk8tC3Ok4HFWFG1XHaVoafpSoy04Zi5gHAAI+xcEPE4te2Gqb/CRZik0RdUzCg
 fJFXMJycS6YwuXwUrlgB17mBXHDt7Yg4hiMGziQa+pnDmrgQQwg5WQs4PwARAQAB
 tB9Kb2hhbiBXYXNzYmVyZyA8am9jYXJAc3VuZXQuc2U+iQJUBBMBCgA+AhsDBQsJ
-CAcDBRUKCQgLBRYCAwEAAh4FAheAFiEEEzdr+JK1hxGBohjpvk7C7q3ywxsFAmTT
-lSYFCQP7M8UACgkQvk7C7q3ywxu24hAAj/FXBwFd4jxT3NWQFKyuLM/Q1NRnSbg3
-vvPggtyybCMQ8Jgak+H6dTXfA4/ltqeEJopqJgpbVkLOC5fatbzyOcFSR20oYbw7
-horamRhLhycS0PA/eYPE0THeGX7izgU7ds8vNNL+UwsgtUsS4e8iW5wfumi6oFq4
-oFyF/fxrBns7ECF5K0eErw56agpCW4dnjM3qs9EggQmzBz8UibuNsFhhDpw950BG
-WzXdKY2w1QRkpm1ZAQgknl8ouYKvFB5efuSeypyx6cHNZg5njna8pimL2zRReDBy
-Z6dl/i2fHvWqq8vK+OUJbpozPdpRzUsRPlIhRaP4ekOhGDZnX5sDIbgN8d2ivGhW
-XQUOqyBJhmyh1LGZw2A3/2OoFsNNZdSQVYDgYfhLlkfNXJRPO8ivMvpNpjIt3vji
-iSov/RvZe39/KvnH1S03A1bXm+RsilWnJYrnY9DpOwwyJoVpJNfT/XoGjnH7b4PA
-KsSg8lkbix7PocGLuxH9W2iC9gDqZNROVtbk2AUbRXYFpAC7O4xGEOWr6766Zr8U
-bkQCO6RI66M+TGVVP22A0j0H0ViaTYw2x1vwYQI7s6ZiQ3wIp5uJZRtyOThz44Ol
-sXhlX8R2SI+2T0c7tKyrJB5kVuLlma3NflMy+vZmwU7E4xTYYNBHA5A+8eqCRC0d
-jrfF3bZThEi5Ag0EYv90OwEQAMsHA8GGcQksqV55xg0TfGqSWtHVhXlA5GK40LLd
+CAcDBRUKCQgLBRYCAwEAAh4FAheAFiEEEzdr+JK1hxGBohjpvk7C7q3ywxsFAmb6
+s+gFCQXlraQACgkQvk7C7q3ywxs+5BAAlXIVK4vapth7VX56SBE2y/HIRcrGjDlx
+N4iLaU16yfma3YYEh2LpWQz7yMTJj+3YUaMuMcozL72BiNAQbK9lKOAqoScaScEL
+DKLDg0ngnELKuo4ACFYTiKQ8Iy+Z15WHD2WV/Sf8CM2wuWrvEcYn377Y3qkOapwA
+9DcU8D24UjgB/zpPiNVIMJNmwZLljKgzdqA4jVjWQW0UGl1NWM7ynJdPA6H4EShv
+3ZAbyy47DO8inSdtCU172LZpONbVjone32tOGaT2yqNE89bRTFcN6/5LhJABaG4F
+DALPzSCZjCJ0cYWVNJAmrYmLm+WSuYagAvR4eR9/FClZiSFQ1k/hUakYYtpSxNFh
+MrYnps5xr63uFGJ4atVytA779dqy0Y6wwsUCnxq7gZxpAyq8afPdf3km14kb14ud
+9wfIZgYPa9j0LRX4AZRPkrRx7021vhCkgjLKRn0zP7FYyBeKJvv4GsuFFg+wCGHc
+oorRf8xuC0sxanwmRRkO/3iITNUVK6wYOyJzFiYAnNHZgHsepS7D7nrZf+27Rjp4
+eag86shxmhuvSH4yLvQ9L4FK0Oa/Myi3VWo7ckqLhrFe82zENRQ7MzVbZmBkHAdT
+NZxZFNOXwsMpsYat6Xb2erJ3ai0XGTqZ1ckdChS2M6FHohk/0H78LfWrZ5DteApr
+1PhC9KUrttG5Ag0EYv90OwEQAMsHA8GGcQksqV55xg0TfGqSWtHVhXlA5GK40LLd
 8gUn7/0d8ymlo3ZOJWjG9NIpnNQ9mLRW3TsDYC/8ToJ5tlwIS9/fRoCfc7TMFWLC
 GrxpyhxrJVzgxZVE9qlKjafKOg/7ojXN8zolNlcUHWH3ehj2Fl9bwsavFDlFphK4
 plS5xUUqkjZIq3e40YNSNL4Swt6HWMwQ0taPWVTwcaX5ruN8jV26kFGA4EbacvAy
@ -71,5 +71,5 @@ wOfY49vKxhi6rTuC18HyxPrs7uwjpxUj7CDM/LKt/tXQoffc63F9GtREdzmJHSE0
 BCFc0lA0rh2PvbQQdyg2YPStg3o43hlKAl/RsyYCAvIUFWggHnrk/pLbBMxVnv+T
 /tm3SFDgtag4o/tI295NpFiroDu8zhPJTv2F2GxGPZmNawjw8hyqy2lF8oH9tD6N
 mhxC7iIM
-=w3OF
+=P0dT
 -----END PGP PUBLIC KEY BLOCK-----
--- a/global/overlay/etc/cosmos/keys/kano-0DA0A7A5708FE257.pub
+++ b/global/overlay/etc/cosmos/keys/kano-0DA0A7A5708FE257.pub
@ -0,0 +1,86 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGDHZkgBEADTRYoZqk3uXBusvXTxT9bheOKzAvgOD9MVzn2+nQ79sUtvdosB
+FHmr737cutILHl6dzn7B6R6FPvLnoDIaoSpIdBUePLyvNg2/XjQOVfb5ONyXxXIf
+iDWLtHNa5aGmKXjGFagY+1LEEh6v4cDZnu/KSiOc5KhDQsiMohe0zR39KPraE1bu
+IylESf7VZb/HYqmXQqwae41vgIIZ3HkDfnDYfqWHsFBsF9nrCBqgJRQjQlh9eusd
+7hGsY5ZdXawvF2vDXx917asr6b+deNb072+bvM6GqnKg68Q4rhGN+y7eO4Jzm9To
+yhSggOig+dllwDzVT1Dx39jdSaHVGeQVmouym5jT3HkS9VKE9uKef/Oylf6Pjom5
+Z5XbrWd+mPZgZed61yxFCT4Gs53cqt02Ce5vDYU4aJhwiDPG9zlO9kQNf6P/veik
+Ni50gdnboC7Tb5Vhaud3s9CTSUPfJbv509X+anuJG+yFpbYxrKgIKHIvnT4O9XYR
+OwpaCc+VI2scXyfR+5qorya6aHguop9WsAk2xLpM2gxsDi4E07HURkOb7M+DAhEJ
+U3eHREaJOWcVBgArrKoMFbvfYmMZKxCJByJ9qQPhhqstmOzMseEUZlcTasiegYg5
+4P9KDW5QbEbnTBuA+ClS8dxU+XHp6KfDrAd2XQFT9CF7V/6VXhxYFSaFvwARAQAB
+tBxNaWNrZSBOb3JkaW4gPGthbm9Ac3VuZXQuc2U+iQJUBBMBCgA+AhsDBQsJCAcD
+BRUKCQgLBRYCAwEAAh4BAheAFiEEIpL7dwHsMfazpY3ODaCnpXCP4lcFAmY7fRUF
+CQk2fc0ACgkQDaCnpXCP4ldfTQ/+MnbkICnnGvEyTqv3Z6UN0InVhKxnGh0y6/q/
+10RR0bN6gmn79CV1BMbuIIpwTBMe47oQiVuvF+Qypf1AJoc5HSqF1V+yeDN+a0yf
+cj3CXTQ1Hr/zCBhUCy2jZQLYyL2oL961XPnXsrMV7gkjupAXPzG7u9CrTX5gfi5w
+RzmMGLJfYtN0h9DU8ShyUk1YFJKHlLCZZBgjwT6ikX69Kndl+PDTlW53hhsgwoAL
+vIJKH0dKL+LVh/AYY2hmkwwvbH8tocFAQnPEXS4v9loug4wRfVikwtro3/xlIHyG
+1oMzgB1cPJBoO/wIpe0WIypcQnqZSCnm9n/QZhRtHhZC1UNvb1RlfqJaL3ygXsM6
+L9BTyS23/lKBRApHuqkr8VfP0oi28Vygmg61Xokwh1oFMfd/2Vn2MJtRnPLVtimg
+JLEIfuuhz5rvXjIE+2oJCDHK7aoHPukdhTdmxjYPhbXHHm1hqm5vgbVUNHTsIKWi
+P94FDgFet8yxjGnnlvb3sfbOFRtaoEIiBaokBIVgX5ktjyBILplaWVEXUR4rOjpK
+DM0p3RICJFrkdVxxD9oG5OxQ6dGjxBpce4293VqBmNJILPyXPI1IZyA6gs42suu9
+cfqW90iOemO+rJ5y6kHrPTcYoxZuyBJHuqBSfvUO3pSM0JGonvrWOoPfN/tCl9JY
+vGsyQxOJAjMEEAEIAB0WIQST2nAGwucEPowz7RumwVJzjQPH0QUCYMxZ+QAKCRCm
+wVJzjQPH0Z0OD/0Z0aWXOwISYaws9RFbCdRvEADZKEnYZ+rgv30VLvrmcvk8VNrR
+4m2bLmnKzMEJrXu9jegbhRNwq6kgFyb/j1P62RnriWaSXytVgLTIO6fh/qNkj0S5
+Z2tB0+/Ndml7qpFM1iXNiF0g57q2LAHUyasLiOH0Kj9Q+og/EfMYtjRI027S4DCd
+ZgFKbautW+TyxnmuZkHpRMNg8RJYkp4S0GsjmPOR17C6B+Btwp2hhuhg6QRqk8+b
+REp+lvKGc+2AoHeaoe+/2qnDUFeNZQHCW4MADXi82EQgz874sXV8vAJzn2372Kaf
+uTcr65/qUX0aDmT0LUEFAO2TQm0ho/ysVd0SpJ4jyof8WSw5gSUdgFUI2KnGZUYj
+UzhZ6A5VjOKqRanamQ/Ja7ms+d+86KT0INX5QFz0F62CencEkPOoGDTsUAWrLLBR
+jOo1FxhXIrCtWjdY98TnGrQ0f7CgyncLJ6ST5Gt9zz2+GTfmRhwa88civD+5Kb1W
+jGnzjTP+CGqC1s7RRjsU9iLNAOsEzpGwL7vtRwVcWLSqBlVtK3j4BcUalsErvJAx
+T0S99EomPwJGKSWSbHw6SOYz7lxihxNJFdJrnLtH3+LZEL8XfJN275pN8INF3wJU
+AUB0CO18I94Ep0wXjkyqxNjf0PiCe8yrRyeafPZDufVD8TlV40Y9qiZQYLkCDQRg
+x2ZIARAA762zqX4J1+rk/JGDYH6guh3UMM4M8e6X0WHYxo/9V2dNW/N1fyk1GQR3
+PcrPmUALsrBb3bQvW76orZmSnoP2rt5b6uR+y14/WrG2r98Pa9dYnKDO9YeozcTh
+ZRj/1gcRwVHAhNLIwE5B5c5h65c4wR5/ZUrhYp7X4/ugC7m8CL17df/2sK+m33Ey
+IuyGzVkNMn9lxWH2V6k1As6HsPA028XsINpOXAPqGDGqAAWkU9bVx0GYCtF6BUpK
+E+0N/OG7MzfOvBxmrSP6NyoWx4XMKzRwqb57QnPnCbMVifi82o+n6G/00GlqDAJ9
+cHL/d+XA4XPmpL5bDYPPOdD+oU2xVNBgdcs6+wYs1vm3QdsPDNB+KRMCWbMJLxJZ
+CTtkDadqYjhTOd6fLQTpAshaA9RjSKvEZqnwr63lNDYcX03trAoD060N8HQxyVMG
+qx/YEcHJili3iIkiZwdCrQ9NISrEuAtIQzDnirTuxPx0Cjl7gL4yY3mEvJkQ2tWW
+3hm3vPe4AeUar+ai6t+RqLGoehu24ImYhrJjhOb3YYH2ZkgzS7bF9i5+xmbqFxfT
+W/dznKUBaFFvisA4JG52pT8VnYWyBo2Q6GjaL5m/azTN3CZtp5VAwUuQyRLasL8h
+io0e6x7G9rcrxpB2mEg/s/PVcCmGD1iTTrfgGIUz5hTxdCDivsEAEQEAAYkCPAQY
+AQoAJgIbDBYhBCKS+3cB7DH2s6WNzg2gp6Vwj+JXBQJmO31MBQkJNn4EAAoJEA2g
+p6Vwj+JX7OoP/2FoNVz+KT/QcGFm6xF6TKFMeVxuaBqilsa94xQSKZ55BaepBL00
+pEXM+38eIU2ogNhLE8m8T2BtarFphzhALkGEI/XVtqfqzatMt1TLlTTkWwmRO9lF
+2zkq9e2TCLebgOuZfNEK9bpIc+/+dRsUcaicf4e6xAEzP8IFeTxuzD1FussMNC4f
+c9RrZxA9BGisrXyNAezuiAtgHg6j3AKQhTG95NUacZIJyWcaOMGMBs2HcZ/ranpF
+xnfpTqUlEuY6jk97k71beORy3mvH9U2MmadaoOjuSeXRBe1IgNTkCa8AR+rkmW7d
+utkgTNe5SYjuxptz/Pqzi2i0MpJev6p3AT+x5dCET5TLVy1vJe06y/eSgmYvpGw9
+ITDdgHhT3OL8V3k08L7gXZXAyAAchSYgipAOL0qxosYyyxq4TGDu/3wzhRf6nZ64
+Hu1tXv3iSniqx5HAq0WCl4e4YPjOD7yZvCrauctgBf2Sus/lUwoCDaIlWJjw0BN/
+TkKhPsuD267ORioHpONCfjhxxjZYDsmShATIohq2nqEl8+/a+Rtsv5QisfPhr3js
+RSdSOSgOGZgDR0VSaX/NZUcolIOhq+db3IoDhwkM9YxGFX7TGLiASNJ1mYE8O3nZ
+YS+AOdohIL0NQ0OLgnWco0/TC4ziNxF0b9pb8+xlwImoRMrFQVkNu6UjuQINBGDH
+ZnkBEAC5Llc/yl585Uj1CcJPcImWKFRkLOL1OhHhIHcVgj90eqoYz0vtmaw+MzlA
+j7DgwdtXb1WRAjjoulLZhEkHQ6iL9VePMJFqxN+YKvl+YZnJuOIAoH0CvS8Ej0Tz
+ZV2wuhchrWo5YrhVqi9PfFEt5xSHq/B0EFl797R6bFF75g0OE0EdJxtd1UmKQLJx
+tn/6gZoa7Z4ZuZqm8lL8cpBdm4qWFUGaz8CpCVwuGK9mdoszU/74tWkEcKnYD2DE
+IC0B/lZ9BeluRgw3Qf1Grf8G9D44OjbB+QkuiO34ru2hVKjTrfCnDEq+pfPzoNXV
+VUIlAxvoOqjCAnKZv080cJq3fYwjMkMTfU4JaH9y+Byidft1wcgV0T2aayUBMEuF
+6FbblUhLfhi5C04IfnCWYarquNfLkGy1LnVcejDG17o77Vz8oLlJ8kThMPdOt8hb
+OZjrdO7y9+Olk0QPYme8AW0sQTthM4+5mlQ3bHIX40QRoA6xm4+gPISqZQhdEmHR
+9iialCsx4KV2qpBkeNsvnBuC54Ltwmr5/nNSpKkfPJ8t7wKe42DPhxvg1Tb+GV6Y
+IhDYJaHzbT1OVLO9X9YsjKGxtF6kxo46+0rOx3FDfYfG77qKKc3XmDaJLUcwVHO+
+PlBAWnfvMuWzSLWFduOHvm9gb49jsxw4rAB8iYLO8YHv4eqkhwARAQABiQI8BBgB
+CgAmAhsgFiEEIpL7dwHsMfazpY3ODaCnpXCP4lcFAmY7fU0FCQk2fdMACgkQDaCn
+pXCP4ldKOg/8CkqL/5C+hDeMVxPzFwlMuRoSuixS9odZjyQ/2R9Q63TVe570Ilv4
+GNdkylzNy6qLGKw1U7Qr2pYgunB84Ii7VZ5zjh9SY/MB8/vS9AYseAEzl2QoU23k
+00t6E+VQckbrz3BCKOv3vmLmb4L0PbADPYcYqj4hnXSwwXli5odn+f/AogEZmMrl
+UAA9iM5cBrgqEzjHjpKUXbsY4ms+evO86Ei5h1soWKuRGcc5JIkH9mswA3UxRPFL
+VVUgxfBUCjrAksKO5ke0lGVYRmOEzCrxWsQUH6fqE8rip6BdCCuB1CXHtyYu9q8a
+d26da6N97V/cfGCz6e6Yl/JMIU1NXr3N6mUnXNO4hUZVXX6Knz+NTdnP/phAZPCc
+AUUk0RrHvKIfYpEV66/MpTinc4rWHrS/5UJMwoFAafe8SemyHxqzK8b1Wz/IEN/E
+RmddBqeNK4Uzs7guea8aL53IBL3Z8Ja4quhhulOaCd6rdARWSZSY9wwEXoZEDjac
+IKKIHl5Po7shmWCnyIaTCqMPiJ9a1odvH89QEpJPgRsFxUw1TnQQHBm5extA8wcj
+mr/oi+rYGQlC1jZC9Up76ThE93BFcipFwanZx2lHC7j8gHj13aCYwqhiRO2nJsm
+7vv1agpa5q0Zod4KgxR+oevGelHfzuY9BHnErkvwWhq9aq4hkXiqWqA=
+=GNcK
+-----END PGP PUBLIC KEY BLOCK-----
--- a/global/overlay/etc/cosmos/keys/pahol-BF20AD5E35F67514F132A2185D5B0D4E93F77273.pub
+++ b/global/overlay/etc/cosmos/keys/pahol-BF20AD5E35F67514F132A2185D5B0D4E93F77273.pub
@ -0,0 +1,75 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGN3Tr8BEADCExODyx4/0i53qRaDrRSBiwOTV3cyCTWLBu6x9T0JZ3tBnYn2
+4KVj26GCuxxrUDXNi2LRwDantg7DD4pTCYCgym1nYZ/SlmgzHSSaK33UvOu0ySVf
+m1tlTcJugNiHq/plGPt35MZhbc6PVmug6ghFIcrqzzLy25Kpo6FwuaYDteBOPVwB
+CeVgRjVJb/4gMoARVF6JQRvCa0Pl7q3hFk1pG8F+X9Vh/m5TjEpzoGDB9F696TJ3
+84jAg5HiSvLlcarz4BCHJYM1PMstrdkS1M7PY/FeOzqBezhvYjZ74RLIl1mTomCd
+hgy4JntEATsBpJgv3HTULQOAaeGlNr1RIW+MvAkfzyoVSJ+gFuCo4xX4pHpzMFRJ
+VTuhw2NXSpIAhsOz0RycMLJ7lgYCakVh23tJlpEAvlXOAmWZu+/WZ/CzdvCFqMsh
+Wb7g+jWJuf0A0UC1O1WVkTwcKz0CqqRVPBr1zz8Q30AyFC0DCj7eI7LHZyHExIev
+dwRp2DzFvh8zNT3VdJB4cw2nz5L2ZjSBXyrE+f/qpFSMinD52B3psWiQNfhGzsr7
+EHDu9oPq86uq7EtI4kTccbg4Yv5Ujc4KT0A5ZDCXxZ5GCkR0dAjNviX1X48QIwbp
+sm/Q2b2a4c8p3Pqrh+5pp4lEmIEgZqmqtiR2B+Tu+kxwRAzjFXQ/lUuD9QARAQAB
+tCFQYXRyaWsgSG9sbXF2aXN0IDxwYWhvbEBzdW5ldC5zZT6JAlQEEwEKAD4CGwMF
+CwkIBwMFFQoJCAsFFgIDAQACHgUCF4AWIQS/IK1eNfZ1FPEyohhdWw1Ok/dycwUC
+ZR/epQUJA8PTJAAKCRBdWw1Ok/dyc570D/4kvIPP+qgMftDdJ3ijlIlUCH9X+ogl
+JASbV61RP9HqaMaejuv3GVa87+w0fVdyds/Ph9iQ4U3XcsEoLirL92FpO7G73PRL
+qKI2Zvf3gNeiEStRWIRRQ1FxoHjxbhKm9hRAV9sm68U5fjSB1lFL/Z5yIJZzlaLK
+MOY24A+Q37uiIEjy8JKFdrhR94a7/B24MiEG1pHfQeaeFmGHyceGsFipGpUSfPhF
+KHjdXnouI6J/G2WNOMfLdWijtloPpoC44G3AvSBOyXTmSPn8qUMtJqaMepHnjL7p
+KWhZk0sWx81GiNhGBn9SAP3abJzt2hphRYmvmTKEF7oNFTjmVrU/FNZPmeYxn0g2
+HcVM89LRqfYGPq3LWeEpBlOpxGBjvDHLOQFguhDHvGJU+Rlga9MUqED+05xqn10C
+yEQBqLdPTgYPYsyGkarEhyUCfayN+2pObsnAPqAL0aEUXId/SbGRpXKPRnudwfpL
+HIpFmUvmv4q6SC6WFKyLX6jAMA5x81hYOg/Go8BM0k6aQ3jd9/seW3GFzDJW35r0
+SunkAzRUtCTlcTL8NQTZ3pQSfzfpdZFGtO+CrZ4yk+koxIREwMyhqKQFzXZss/4C
+jL/Wkpbxfv3OecBGdBYOS4HmISoagUiQpe5/AiKFg/fni0HQ8Hyhgv5PI2TqOk9F
+OxQdJGg1ci1GVbkCDQRjd06/ARAAzdjVOlhdismRUWnWgnPs5migD43J21fdLB3k
+TioR5FvZiYYljraFckqaMCSXJIvnLyMOEsi2dQjKctVljiMheZ0ppqGG/tHzOkKw
+xExczsR5AdHEEVSNX993KYgrjQ6wo+kvp1S4q9tG+jJQtbRlxAEXskFzVSz8Ep6h
+yLRTAtaQuNt85hHCB4Py94gLukYfn0u0EReiZSDtBlzmWhX6Vrjxbf+SG+FgkKym
+XYM102Q1Upgfdh69UmMavZF8Y+09Z1D/cMng3BZDGNO64CB86CH2yPyXaxPIZArG
+yhD6/Pb0aRYcKJbFWgNxmF8k+oEGISxoTtivsbppaZfWsAA3eD802TwVZawHSEVo
+vucDZSYv2PaeE1ywpQJ+vdb3kjdLBfp15lbAe1kgUOVBCKrWYirYk+Khrd1o3X2y
+YTU7tzwkG4OjCrWD2zlxf6ux497nHpUy8lB3Ol0CuYhuW0Ws2S7/bPcN/a9mQohY
+Hgu6BZbtUf9DfXep3FM35Gru7MWr6Y18/pXNRkki84+ylEFxBY1INc6J07geq2nS
+z3dEkbzy3X3JSCjOxxNOz8PRrBqRDnbnWR3Ir743Kug2+kcg6vLWch6f2/t4CIkf
+TNToYqHEv2IsUHfJ0FzR52VZklToVCJCcAV2Nrlx6EnWAgDjfu7dLNkNRX3zRntl
+JcOXYOEAEQEAAYkCPAQYAQoAJgIbDBYhBL8grV419nUU8TKiGF1bDU6T93JzBQJl
+H97aBQkDw7iAAAoJEF1bDU6T93JzXhMP/0f6X4MTyX2qq5sSbo8OahMj7kQ6j6zf
+PG+7+bMf0O5MKe56YwCTLUOAprrPbFOnMiC9AEQlorONGSy3nCZ370Z6RineBqsA
+K/Ir99GI/l8KBP4W0y98SqlM3tX1EZ/IlwhypYuE5OnE/T5OsRyOn6no4T6FGYfb
+7nxJFtQYtePIXGKdllftQY8eniyo3GOA9l9wT72ZMqJ1Gi0F9qhtNJ7fI1LQOLnp
+IshNVDXCu689KYbWvFFGALYfSKSNrm+R3/jk3R1KuwjB+4zlmrqqSB/56f79bLzM
+mr0NcJcT/QOWy81SQbXB+oGJXkYVPBiS+yJCjytwRq80QY7POAQ+dqHB2GOYk+Xr
+PiQN2tyOc4GoV7VTwNZEYK0KNO2OLPgejpPoco7GpcCWK9jxt/LllBzkfxdbRFpP
+JAAWYi2WE3sLEn6BGvHjLZWaxoljk2KUWsa5r0GgV5dcDZXjKvHv6lFlE95QiS3D
+NrFsljL6L/+cnoCrwuPfEWNHkIOL/l0TcbuXUZ6TudiZ7lH1wCDurEDnXgTaq1aE
+VjAaeTL+ZfEyuG5nvv7LwYp6bzcweY00ByIrkJey0u9nyWvrz5yBtAyc+vPn7Es6
+gkke2a79vLGJQXmR0TWB8DlBRwcb84TszkMAywcKAB5htnINCI6Wac9tTGLBkRZF
+CoLrPyhxVWBNuQINBGN3T00BEAC1jt8vKEVSX7VjUPRNNKBS9oTldnT3IaZ1Xh8m
+oGKX2ezaoQnuLaaKOkKHMPVYpwJNJcLtOP3btSNYC0e61aHmEO2MimSRvskSsd3f
+oP5wDg9f4Bel0XZla+SdNjHM/FK6MndM5GppYpgAMhVf+6xU9x9OVTcd4jCFKB7o
+3YlpRNSS3kUDJcMUPJ41qAg37CQyYCV02M581vYsCe/8qYEeihdLnEXBDiYqZ8C
+U4BdML83/xv7pqsSs0ZUknul2IcIwpElKMpkb3dYJcKaAac2WyEDAwtFywEPJLGo
+HuaEmhD421F9YhVZDmGB9r6yGdTlF5MYUFhpHyB9IdNm8Vv8tWjI8qAor19Y27H6
+kNPmnUx5ZEPOHuBtlldpyXZhixssutPb9+0D0xKzzvR6aOgXsAtpUnqi9WxF3OFZ
+mR6fIk4d0I4nezauX4fnlwrlNyQ7hWAvRDhYNei8ixpsMrp+0pcq987GpXe+KTGS
+eS4Fd8aXBl/iu6ZGPBQ6zNNwEfuDhVOJGO3mf3MDlIlBPctRyZleYApaDqNXF+bm
+4bkTSPmFxBSfuPQI34ZEMmXpXuFS0mL6gxwgIL/0VuU9Bqj+tqGmMSi6jtaQCrTD
+c78+GMmupj3jl3s5FYRcTdASkrSf2RNLm9f96hcwLp8ail3UTmSvVZ4I5QXMbwe4
+YWVcUwARAQABiQI8BBgBCgAmAhsgFiEEvyCtXjX2dRTxMqIYXVsNTpP3cnMFAmUf
+3ukFCQPDuIAACgkQXVsNTpP3cnM9Mg//elO/jVsVX99iaVDbVqJaV0n3GzrTRseA
+kdgJgoG+gUUWKbwrn1sBCQbUAeJ/cobL54kqAN6NCWY7R4FD8HsOBgXm7//vY2yI
+fa0YXGD7FTt6Z5tCVO7fVPB9FDn1lXRD2vnqhnGhqnXQq5XXh3owkjRgBj07Q/FI
+7BiPWCuJV/UydNah+u6CtT+abBsFjjki7Sk498BRzhiXrXoFeDxOU34ok7KAtUD4
+lmrOfCHXJdywH/YEBPG0WJfRSqUKeTt9bUDw/W4tUxYQZqdRg24BbLSj/7+6e4qy
+g2XoO2kUUvobEqenLy6Mo2kEu3DA3zmCQZetBPbjmVEqayK3ZZ1erTTdxWxVx/1W
+hkndf/fy69Rkkejlug5IgXVvIBoIJiHmjjkRMhpWS53hNQxkuMLhMK0sptpwpVHk
+mpELhOeQarsZQm/VwrvIiedhsdsd1H+rYxcIknxYTMyIKGXfP+TgR9mVh/8FQ6ho
+2NDaM9OfcgEJqJKiNn2O+pr926CqecEwZCVI/Lhgm0dm8ZPdMqCercUP1KIiZe6x
+gJWFm4smNjQdQafVFVs/l9HLJxK1xRiVHDCTxhVvJ4Lc2K88mV2CZj5bk2+XC5NC
+q2dYmcuPpKHKnIVDfOaM+Hqmjq6GVqtQRrB+eA45yUcNIttijcdQeozoCEWGkj7A
+t+RRGsorBDI=
+=4GC/
+-----END PGP PUBLIC KEY BLOCK-----
--- a/global/overlay/etc/cosmos/keys/pettai-820E4E151A5370474619E77AD536054C16A6F808.pub
+++ b/global/overlay/etc/cosmos/keys/pettai-820E4E151A5370474619E77AD536054C16A6F808.pub
@ -0,0 +1,108 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Comment: 820E 4E15 1A53 7047 4619  E77A D536 054C 16A6 F808
+Comment: Fredrik Pettai <pettai@sunet.se>
+
+mQINBGeei+MBEACpsiLtn2bN4h9e1cTLc2evWacacamXKdm0Eg6VN2C/TSQvTzyf
+xrOtt8gfRoSNUfn4MEFXY2Pe/M+j69oRNmkyiULV4kZj9kbERnY5VVwLJOORECYN
+oE+/SQvMMbW5XrcS2206IYZYs4t5tOkyP20pGZwab43UQ2HzOV5MRlWWG3sa/6a2
+MszPO8fhVWwwqnOuzs6fSefTO/Iv+oE0/aOOSc/uv7fG0Zf+md77AlqkoP9ZyNzd
+1Kngeal5nNyzWlxfPUka3me334mSVbKNa1BbcwfvpFbEQhAnuZT9pydkIRzkBSc+
+Mh3fiselYrA0lQL0JaYQMXvR/Iu7Ah8BqNdzZcBbV2K+SR3V2UdVEv2SAmWDlRNI
+rewwmdXRN4Apm+PhXJSFU4d3qLmxe/lFpq197EZdwXQwX4DcVBDNQu2lkC6gtfZ4
+nUoQeMJlN3DE+IGj+YjYJ/3TDGt7zUZdk2IkNkQOwCYnGBYfzsfrdPRwmLn9697f
+qm9TlqOXbPzPQSwIYftXckdoyv9o+TYTQv0jwmEZn0PaD3sKG0dKQ47os4tmZM1j
+5SxhStUOhw43+NKslQ0lu6W/SND+mBtqBnaCYEf4h75mrXZzMzIBlZg8SkhCY3h+
+hDVebzqDNjS53X86ApviLfMHeIgS9e6IZaNQdTLe0vewH/N9BcV8QT4RkQARAQAB
+iQKPBB8BCgCDBYJnnovjBYkB4TOAAwsJBwkQ1TYFTBam+AhHFAAAAAAAHgAgc2Fs
+dEBub3RhdGlvbnMuc2VxdW9pYS1wZ3Aub3JncEMLdmr65PzmhSb/DfX80W3A3kKn
+6TZZx2jkxLGuYt4DFQoIApsDAh4BFiEEgg5OFRpTcEdGGed61TYFTBam+AgAABHM
+D/4qBztdFzC3Ly9e4DJxGl4ri5A6H6uZKvo2jlrW2EeRylCL/V7FVnIWbDySJIFZ
+qKUkfNq7xCjb1SToTKakNbKStxGkJfdUiy5okz2iZ6QVCMJlW3+5U4bWyKhnpx4W
+EVjHTcaMY1bQmrLcOs66YbgZtnxZdX5suFbUZ8RgdyK+ukZ4NJxVb/tJiUNu6v/A
+OddQsY24h93WXC85lFPgTiKkZK0r60DgTqsF/RWdBdeK4AtwkZeZfvPNDybgD7wG
+s4X4XSJeff67rNEOAUgEjb5nGbIy6+Ixsr4YQSHPS6Nw5Ge2/ro0w1qLvCXk78OI
+LeulOH/q1pnN3wHb/bIthArnUeLMNGeED9WAXR35qtGJRoZMc9QMsQ6Wg5zP3RGL
+2lLEVX4XM8ndgnYIWVFbgEGVFZngLIqDHp0wkO6WiwlUmI5Vc8r+AxDw3M02j3Ja
+Ps1BcKXnF0BY++5oB5IIl3r+CSJswEnHE0hD6ZDHduEu6yqZlLIGE7AHmag73JBd
+rfTiBzwIh72KhiRK6pr6IOr39z2zjoTJQw6XlBw58EA610+v+M/sFal08DaNesHZ
+sGTuPYw5ogGcspVit38GvTIlbPOwli8qjoRzMwi3rxRY6vYhB8RIGxQwz/+s3Uco
+QMAwIdlZbB19GO3auoOAJ2ucMQ0bG3kJEvW5HaqtRGFlZbQgRnJlZHJpayBQZXR0
+YWkgPHBldHRhaUBzdW5ldC5zZT6JApIEEwEKAIYFgmeei+MFiQHhM4ADCwkHCRDV
+NgVMFqb4CEcUAAAAAAAeACBzYWx0QG5vdGF0aW9ucy5zZXF1b2lhLXBncC5vcmcQ
+GLrBoG3bn+P2EJjXB0auZXX2XZUxgh6761ZzTIQE7gMVCggCmQECmwMCHgEWIQSC
+Dk4VGlNwR0YZ53rVNgVMFqb4CAAAsSwP/iuUw0slPPF2s5ctOcdWdIByRbsEYyj4
+zNeIWWYc8leNzT9e0XxcjhwD+tZUGAmHeERM9RawNId9+2rzLH+kH0tsLbO/2Pfv
+dJ4o/bC1nE3Mor1KBaq8n/Ek0koQv3JgcqCwx1+Vl1QzZP7ehNCaXnkZ9zHWsOnL
+eU8iOnRnJSr4PwcCanYI1Vykqlq7O9wCMcVOSk5wnnQgnOG3Nkn4yzTYDdoTI+Cg
+piNEEtskRRCBUFXb1MGRS9Nwi11ProFn0dqzZgjGNDK4gDEiBw3TrTW2duWoTeqb
+Z6WsAloK9tZddjGJcTsvif1yQeTLY+vpjqed+8XSDEOu53s7dpqBg0SkdRPT0cST
+tbkH3Qi4OLRiyeJhNYbgDkUExo+cInT+VdBg6qgHO8X4i9F+YKpObh5k5H552buV
+xRN686boQX3EVDYm1wOlGVXsa/30dCsFF6VD8jdVVtuEoLO9AbfYhY2y/Fnj/vsM
+uTstR9DzGwkMyhfFcC+QiGWOC5Zj07a8tRa126DfwJgB1YWEElb6266p/eXFl524
+spND4sFLCy5Xs8Q+odrolV7/63KUnMExobSutI3NNz8iOqAaYFq971sU90fYsJeb
+8SQBDXOPzd4aE1j4ypVS7GOTJHnZgGLDtZr6XIGJoX0WE+7TsWU6MXTkNAip37Mm
+cLUv1QmptiRLuQINBGeei+MBEADEd4cSKSbvWkvDO07oVCR0SguclZp+epA8gDOS
+hdPYoa4sX/2xVRv6ueaq/GtMv/G7TexdZnYyAGhyK76r9WzMOLDtCROuAXRxC4Ju
+fvs+7lj1+UHR7x8RvHl5zNmKFaALs5MBd9iNBjbGD1byVWm56OBusZ7lV5WDMWYv
+Wd6uFw6cx0esl//SCspFroFXgvim3zVomSuQFaac6Zff7mxRvpoG1Yzl3VKWhoBa
+DBxiWWXemJy6vco1ULgT7XLnexUS7f2JJgkEnB9pBoDrAdW4ESZM9FBbdo2+dQZv
+U7LgJN8M/Y7CntiLmTUN/nvAEZpwXJS9AgWckFbuS/sNH2Bvz2M3JdgFDGN8AM0G
+M/JSijvLsFD2Wljh6eGN5pwWBcKl1qFujdqLRpIMYVUoT8kfMFTtYCQy6DiC0RP2
+BjVyrY3pPJZjHCVTaInO2xcfmD3iqDmXKbczYdxYDLJ1cIZcIyrpFzpcMbKApPLm
+ff/XXtLyUvAv1ODfFegQV6Z92HgHaB7Ld3j9eLZJFuCOKcL2+tI9LZlEJ5wEjsAv
+8/dopVHo547Ofr8DvDmhI59j7Q/Z+YMY+aQQtV1JfF4V1yoASEIwcpwLrbC/dC5l
+5pSUl0I8FhqjjnR9kNtNznhHdoYcxglkbo9OXCrWUCLwIaZpKJ2KEu+PTV8tdi9N
+sFdZ9QARAQABiQKEBBgBCgB4BYJnnovjBYkB4TOACRDVNgVMFqb4CEcUAAAAAAAe
+ACBzYWx0QG5vdGF0aW9ucy5zZXF1b2lhLXBncC5vcmeA8+gtT2fLUQ5WyLjBb98y
+FOwu8Y8bK2v1OLwqeQJEAwKbDBYhBIIOThUaU3BHRhnnetU2BUwWpvgIAAD6qg//
+RZF13Gyz1rDkrHbCZSYd5hv4XvRyFGk4dzdbk3QkxfSoB38CCSuUAeNObVhEFgF3
+Hswu2kJmTTtmt0E9cxgvWfsqAVzbUx53yu2tKM0M1WZLTWHkjXdLZA48uMKg3nnp
+Qdl/xMLDrmD/lPlnQus8VCytEhP8XPADGr3OX/YLDeqBcrp98USyPkC6xiNxdeZ
+ABsb+Ac2r+tdXI9wIDj6awmdgjjNmaTZ+D9UBm3kApLJk8s3rX1Kp8FY9eEEdniz
+gfQabaaA8GjpyxShAVwMK6rXf/pvtsfGQD8ZGnBP56hms2cY95nU6XnvlGgTrwVF
+F/bvsN3pQ188LKT+P9AVesfa+bTdiaJbemQ1J315ioqE6e0+HdPlk0tI6oJaeppu
+MNmNAdVKFAqqh8OodvZk9REasokjl3dOMcoFgtJ4BVNj0cXEMNHSRedcB0l7YNWS
+fZkk/QRFTgvwhx08aK6+k86EOdxz31TIr4GCZkAYxbitIXr8Tnux4sm433biwi1+
+UOSUA6VhiwD408NU5g3kevyK72xKsvdXD1OUBx7q59CzcsujyD3gq2KDmaXHFOMl
+OI+lS5o4CAmXHE7vrEXRxv2yjzPXSVofrWqqSTKndiWn1wopqc2sakuT98AbOAaJ
+WvDlggfnCN7jnE3HK2k6uEXlwIiN99tP/86JB0MqkQq5Ag0EZ56L4wEQANvp3sPX
+ZDtdDVB7Pis72IBgbLB3vbKMaTUO9VWQu2z7YB2ndCS48eRaXGlI3oOCI/bipODY
+mxgMhY59GhenzbuQM9+SJT3auUWcSIA5QfbvbXwxh8U7Y1DBdY9cBNzGLrFEvxmD
+obe80ns9azYYbK2Xws4OtJzpF8q8rXS3TMLCFYtJ1bk/RnEzyBK4FGCF37iJC/3a
+yrpKoGrBu8UoM3MbXbCL0s8cslufI4G2b2sha6NFY/AGoUsIWAlX8jVxClc1QYnL
+6p6zGeKieKcXiX/U7GltnpdeaDleH/eJ2Psxkx7w+DxCUkhuaVK9lyTdlveYg9mR
+xXrLQPU+iPNyfq8kxUf7LfbU3RLfQqZJCoD7akAEpJxuAnx/xQzR9wBMbRgit0nG
+X7b32m6K5915oR3yYRhMUN1vDCKbOIg4w74IhI6+NDQ0d39zwMl6g/zuZFSHnECH
+gAShHJzbfgSghy8xLvrepn6x5q3C+xpV4TrDjsqkSRjr8+Mwe3Bjfss0CVUAHP79
+6YskvU5Uf9KKfRTxzilVRB1dx/6usI6vfGnCckovFW1GPCGckn2XzL/73QZtx9yk
+tyrLsJVrZIZJDsRRPmSHgdkKZOKU8vh4K7kormuSvN6pINzORt6n+S1Pa2KPWqZJ
+bqX3ArkibNCmhZLg/hND8/ip1mbia0KiPKHdABEBAAGJBQIEGAEKAvYFgmeei+MF
+iQHhM4AJENU2BUwWpvgIRxQAAAAAAB4AIHNhbHRAbm90YXRpb25zLnNlcXVvaWEt
+cGdwLm9yZ0zilRLFb6vv6Zt+GsLiQtSi8xXhGo0RFA9heYYDA0bKApsgwbygBBkB
+CgBvBYJnnovjCRAXzHaKBJTcHUcUAAAAAAAeACBzYWx0QG5vdGF0aW9ucy5zZXF1
+b2lhLXBncC5vcmcMFQG+bWxoyBfpLptEiyspMrn0leLhbTw11UQ8WH+gLxYhBL+I
+NUUer14Tp4Z1XxfMdooElNwdAAC+txAA1Aq0pl2YSypxos93eyZ1qLB4HnQOgXHy
+9YvAn5WBswyf5Wva58CVmGyd3PaZId0QrK/u0B9plGSBfZ5OoC4oKbVWWW1kxEV+
+PcZ3+Xv7klIDouUo7ivacFyNPfIeMzwuiodQDEtGlEsgJ/jnymgJJNoGRQVjqP4R
+4nT0NO5qzKmmabGcrzSUR0iZUig/qJ54Ek+fhVehabQlXy1paWiPKV9eoM2RxSYK
+SczUvb/wADck+E5a68G/5ZZuRafGoywe7xRVpUjf8Ai+D9LRQM0H5eVK3kaGGC8i
+tyae8BX0JGtyqY/yQW7SnOhYu6hz7BL+DNYfZRFBdi0293mL4F89NYDhn7Wlj7Ug
+aFMq9IijPv78i+Zxdz6nsRWf0PrOwWPmKgZ5OzNii/+rY2LYL6cnI69zdWsMI/6B
+vjJZIejHtiJQS63vGVH881pVdzre506ZWeprzcBJyAf8RAOQ19VKgcE78MdztpTv
+mSxrbpGIDKnbwk4lvBilKsHqoHo/zgf39JlWddRsXtOu/Ac29ZVuFUw2IQ3BP61+
+H87IcEPndoe4m+bSYUa9yw7fqXSp2IK+pJyAXdhYecIc8Y3Hl8cCv3rg8+RQbadq
+OoZjzEAQGr2qmLqW2wPrwtcxSWqdH1jOQBJAqAtkM2I4zdyf53AyZIwW4lXBMQf6
+YVQrd8C2HeQWIQSCDk4VGlNwR0YZ53rVNgVMFqb4CAAAI7AP/AiNHafRXUf9JbNd
+9FmZGgWNk4XcW2wQITLSIryxJZQQYA4RaRyEATkXRbkEMJXyMGmU602JMF9TB3gz
+Sp51C3lZd/O2q8m/vNDGvO70KKErYYhzaonfQOjLmVwX/8TFCgO1C94qVcVnAtXU
+SnG07DrxZh5hZKqiwBgOyTpC0wJJL4ghYtvlBWDoOe4s8jplmO6ZZDUZTqaSLsE3
+WTT7elCqiFUpGrD8zFwXLLq79tE4QStCBjGYW23xdanFXk51uEJBGQMWLG+7IsDO
+XvLxvPZZUfooIki22LseCm9tRy45a59d/6Cs68LlnH+QhMNgLU6yamx9pUSth+lc
+idrufqLtr/UeBY2HQCcg8W0BwCtPtoE9Di7zPLjJGSah4hS//JV8sf9Dqc4ipWON
+3vt7nUMq0vwhdaulXRc5i5O7ddMHQ1GJOzwjh+NeDLF5KmojsjFxz6EYXorMsXdw
+lZHJyTyUE6NRvcSyaBd7NrgDOPb2qktvdsHvYT56rcL7sCvLReZSpTs3/p5IsTa8
+FJDxBjDASoo9VcAfCLm9fuetEIA5wuiZyHtkx7UjL30sxQ9+tFPET6nbRSX4hGk4
+7630+KnqE4XGJr0pX3XOdSuHtaKIXqnc0l3G+ZWA2c+yCet43dC0TaMsPHc+V1Wu
+QqFL9FagOBDJIZd3gNShqrZhetcO
+=75u9
+-----END PGP PUBLIC KEY BLOCK-----
--- a/global/overlay/etc/hiera/data/common.yaml
+++ b/global/overlay/etc/hiera/data/common.yaml
@ -25,10 +25,14 @@ mgmt_addresses:
 # installed anywhere. Real ACLs refer to keys in this database.
 sunet_ssh_keys:

-  'pettai+07431497':
-    name   : 'pettai+07431497@sunet.se'
-    key    : 'AAAAB3NzaC1yc2EAAAADAQABAAACAQDnIQ2mZJT13YuBUOLM4Xlkp1165nlKvSC3oNE2Z47sKmcgwgKwPJssd1WsmkKDOsoxsvS6FJiAbmCQe/EdwT4dolRpVjczpp9p+w6wjtTXsWPsSUDbT0ZD8IOmOr24F8Z0WY/ho1Bmm3LwCMbW30KROpZn9VWyzGT6QTGwiZF/lyItsdGcYC2qgaXJpI0sEc5W1WK4ozpTu7z3BtzpyjOvVAQirF7Dp2yU3dLB93vj+/BYnB5F/1cmTWfu6lGRtO60E0j9DSH20AqTGfsJI4fPM7tbJnT2Fhj+MS8bHf6iEnh2QwlUSUdMlJAxXVu1XcLiSbbHXV4Mh7gCuGB0p0rMGiBg9W/t+D2dYsBQxuXq8fT4iqlaHaUwoVYtsDTMIg3c17mcYni5VRk2d49qpva6zR0zU3v0X2YtvHWlCCYBmjWSS/8X8FUgHVOaCEAOjTU89TvG9uvxXoqO64Wznx7sjywkaWuwmNck2K3xlhccw5iy+K1xxalKgcel6nMxdoBuW2RFRAYCCAT8IH+ONzLOcGj/+sRJx+bl18qYWcZGcYA9IbfJCNXuQHX4uRLjtml+zNac3Kefmw1jyBRUUkWbdcAsW3kvf3+CcP62URCk+eFMywnGk8N6UX9akSxgMKTR3IHuqZLHtzbgUxgeRHCLUid9GwsqDmu3fC8fLRK7sQ=='
+  'pettai+820E4E151A5370474619E77AD536054C16A6F808':
+    name   : 'pettai+820E4E151A5370474619E77AD536054C16A6F808@sunet.se'
+    key    : 'AAAAB3NzaC1yc2EAAAADAQABAAACAQDb6d7D12Q7XQ1Qez4rO9iAYGywd72yjGk1DvVVkLts+2Adp3QkuPHkWlxpSN6DgiP24qTg2JsYDIWOfRoXp827kDPfkiU92rlFnEiAOUH27218MYfFO2NQwXWPXATcxi6xRL8Zg6G3vNJ7PWs2GGytl8LODrSc6RfKvK10t0zCwhWLSdW5P0ZxM8gSuBRghd+4iQv92sq6SqBqwbvFKDNzG12wi9LPHLJbnyOBtm9rIWujRWPwBqFLCFgJV/I1cQpXNUGJy+qesxnioninF4l/1OxpbZ6XXmg5Xh/3idj7MZMe8Pg8QlJIbmlSvZck3Zb3mIPZkcV6y0D1Pojzcn6vJMVH+y321N0S30KmSQqA+2pABKScbgJ8f8UM0fcATG0YIrdJxl+299puiufdeaEd8mEYTFDdbwwimziIOMO+CISOvjQ0NHd/c8DJeoP87mRUh5xAh4AEoRyc234EoIcvMS763qZ+seatwvsaVeE6w47KpEkY6/PjMHtwY37LNAlVABz+/emLJL1OVH/Sin0U8c4pVUQdXcf+rrCOr3xpwnJKLxVtRjwhnJJ9l8y/+90GbcfcpLcqy7CVa2SGSQ7EUT5kh4HZCmTilPL4eCu5KK5rkrzeqSDczkbep/ktT2tij1qmSW6l9wK5ImzQpoWS4P4TQ/P4qdZm4mtCojyh3Q=='
+  'patlu-2249F294':
+    name    : 'patlu+2249F294'
+    key     : 'AAAAB3NzaC1yc2EAAAADAQABAAACAQCquMY5L5QIVq2QjLpfitlS1dSitYThlYxCxyhUG7Hl5IdM5w+PAm45hb/ensn8e/oWXk/W4NoYTlP22KzFwkEeUNlEq21AdYAcb+MwJdCqF/iLP0qpKsznWio7OU3gBn1XqsdVrpewnXIEH9rkin1YIa+m263lrvLKWOhWiu9dGyZYlbA3fIivBTad6gplWfMwjfbeS2uxPoLdN1lP7UYWefe9iVXvgVi19omA836fLRZKi+znHVdvExXVGfSxhF0OOylbjT9gohiaqhCWaIoskRaVqHHTQlqOwcei7XCrdz94Cmxq1XnkvKA9vNVWyv84i5DTpAcxIA/yEE5BXe3qLgek6H5POx6xjyp7EjOw533Q01iYBDXTiCzoK8zanPNYqlcwb0tYXfxT8HTSgUeHKQL1990yRIuKiwkK2YecFfCvpfz257VAZkVjN8IEfw/WhFxSOwL00pUmTLA/DxVFyHuYvdvEs+FANgXX81v1eniExslCcHp9HiOK3odVM1eE02V6O1Kwxyp7cooUEDZ610x0eePhvx20ssTm3qSXdWS1rgZ+ZTzhkwxm8OpSFGDrCgxdUs4tmTtjwcUDeOfTu77ef5t3XTqP9QoCz9CuSi3ZfKM9G1FXTcgU9ApEgCqeUA/56RgUjFvwt9TTnC6I71/0E2olIrp3O5B8l1kLXQ=='

 dns_ssh_keys:
  'root':
-    - 'pettai+07431497'
+    - 'pettai+820E4E151A5370474619E77AD536054C16A6F808'
+    - 'patlu-2249F294'
--- a/global/overlay/etc/puppet/cosmos-rules.yaml
+++ b/global/overlay/etc/puppet/cosmos-rules.yaml
@ -15,5 +15,17 @@
        "svl1.ntp.se",
        "lul1.ntp.se",
      ]
-dns-rest-api.sunet.se:
+dns-rest-api1.sunet.se:
+   dns:
   dns::knotdns:
+   dns::apache2:
+     dnsapiport: '8443'
+   sunet::certbot::acmed:
+   sunet::baas2:
+     nodename: 7B9DBFE1F4D1
+     backup_dirs:
+       - '/etc/'
+       - '/var/'
+     exclude_list:
+       - '/.../dsmsched.log'
+       - '/.../dsmerror.log'
--- a/global/overlay/etc/puppet/modules/dns/manifests/apache2.pp
+++ b/global/overlay/etc/puppet/modules/dns/manifests/apache2.pp
@ -0,0 +1,48 @@
+class dns::apache2 (
+  $dnsapiport = '8443',
+){
+
+  package { ['apache2', 'libapache2-mod-qos', 'python3-certbot-apache']:
+        ensure => installed,
+  }
+  file {'/etc/letsencrypt/options-ssl-apache.conf':
+    ensure  => present,
+    source => "/usr/lib/python3/dist-packages/certbot_apache/_internal/tls_configs/current-options-ssl-apache.conf",
+  }
+
+  service { 'apache2':
+    ensure  => running,
+    enable  => true,
+  }
+  # Configuration of the web service follows.
+  file { '/etc/apache2/sites-available/dns-rest-api.conf':
+    ensure  => file,
+    mode    => '0644',
+    content => template('dns/apache2/dns-rest-api.conf.erb'),
+    notify  => Service['apache2'],
+  }
+  exec { 'a2enmod ssl && a2enmod headers && a2enmod proxy && a2enmod proxy_http && a2enmod request && a2enmod rewrite && a2enmod allowmethods':
+    subscribe   => File['/etc/apache2/sites-available/dns-rest-api.conf'],
+    refreshonly => true,
+    notify      => Service['apache2'],
+  }
+
+  exec { 'a2dissite 000-default':
+    subscribe   => File['/etc/apache2/sites-available/dns-rest-api.conf'],
+    refreshonly => true,
+    notify      => Service['apache2'],
+  }
+  exec { 'a2ensite dns-rest-api':
+    subscribe   => File['/etc/apache2/sites-available/dns-rest-api.conf'],
+    refreshonly => true,
+    notify      => Service['apache2'],
+  }
+
+  # NFT rules
+  sunet::nftables::rule { 'apache-http':
+    rule => "add rule inet filter input tcp dport 80 counter accept comment \"allow-apache2-http\""
+  }
+  sunet::nftables::rule { 'apache-https':
+    rule => "add rule inet filter input tcp dport $dnsapiport counter accept comment \"allow-apache2-https\""
+  }
+}
--- a/global/overlay/etc/puppet/modules/dns/manifests/init.pp
+++ b/global/overlay/etc/puppet/modules/dns/manifests/init.pp
@ -22,4 +22,6 @@ class dns {
  #  match => '^SystemMaxUse=',
  #  line  => 'SystemMaxUse=500M',
  #}
+
+  include sunet::starship
 }
--- a/global/overlay/etc/puppet/modules/dns/manifests/knot.pp
+++ b/global/overlay/etc/puppet/modules/dns/manifests/knot.pp
@ -1,35 +0,0 @@
-class dns::knotdns(
-    $knotdnsrepo = "ppa:cz.nic-labs/knot-dns-latest"
-    $knotrestrepo = "ppa:pettai/knot-rest"
-    $knotrestversion = "0.0.2-1"
-){
-
-    # This is a control file used to skip these semi-heavy installation steps
-    $control_file="/var/cache/cosmos/knotdns_install_complete.txt"
-
-    exec {"Add KnotDNS repo":
-       command => "add-apt-repository $knotdnsrepo && apt-get update",
-       unless  => "test -f $control_file",
-    } ->
-    exec {"Add KnotREST repository":
-       command => "add-apt-repository $knotrestrepo && apt-get update",
-       unless  => "test -f $control_file",
-    }
-
-    # Install the package stuff
-    exec {"Install KnotDNS + KnotREST":
-       command => "apt-get install -fy knot python3-knot-rest=$knotrestversion && touch $control_file",
-    }
-
-    # Install KnotDNS configuration
-    file { "/etc/knot/knot.conf":
-       ensure  => "file",
-       content => template("dns/knot/knot.conf.erb")
-    }
-
-    # Install KnotREST configuration
-    file { "/etc/knot_rest/knot_rest.yaml":
-       ensure  => "file",
-       content => template("dns/knot/knot_rest.yaml.erb")
-    }
-}
--- a/global/overlay/etc/puppet/modules/dns/manifests/knotdns.pp
+++ b/global/overlay/etc/puppet/modules/dns/manifests/knotdns.pp
@ -0,0 +1,102 @@
+class dns::knotdns(
+    $knotdnsrepo = 'ppa:cz.nic-labs/knot-dns-latest',
+    $knotrestrepo = 'ppa:pettai/knot-rest',
+    $knotrestversion = '0.0.2-1~ubuntu22.04',
+){
+
+    $knot_rest_token_secret = lookup({ 'name' => 'knot_rest_token_secret', 'default_value' => undef })
+
+    # Stop & disable systemd-resloved
+    service { "systemd-resolved":
+       ensure => 'stopped',
+       enable => false,
+    }
+    # Use SUNETs resolvers directly (no local cache)
+    file { "/etc/resolv.conf":
+       ensure  => "file",
+       content => template("dns/knot/resolv.conf.erb")
+    }
+
+    # This is a control file used to skip these semi-heavy installation steps
+    $control_file="/var/cache/cosmos/knotdns_install_complete.txt"
+
+    exec {"Add KnotDNS repo":
+       command => "add-apt-repository $knotdnsrepo && apt-get update",
+       unless  => "test -f $control_file",
+    } ->
+    exec {"Add KnotREST repository":
+       command => "add-apt-repository $knotrestrepo && apt-get update",
+       unless  => "test -f $control_file",
+    }
+
+    # Install the package stuff
+    package { ['knot', 'knot-host', 'knot-dnsutils', 'libknot14']:
+       ensure => installed,
+    }
+
+    service { 'knot':
+       ensure  => running,
+       enable  => true,
+    }
+
+    exec {"Install KnotREST":
+       command => "apt install -fy python3-knot-rest=$knotrestversion && touch $control_file",
+       unless  => "test -f $control_file",
+    }
+    exec {"Let user knot_rest use knot's socket":
+       command => "usermod -a -G knot knot_rest",
+       unless  => "test -f $control_file",
+    }
+
+    # Install KnotDNS configuration
+    file { "/etc/knot/knot.conf":
+       ensure  => "file",
+       content => template("dns/knot/knot.conf.erb")
+    }
+    file { '/etc/knot/conf.d':
+       ensure => directory,
+       mode    => '0755',
+       owner   => 'root',
+       group   => 'root',
+    }
+    file { '/var/lib/knot/zones':
+       ensure => directory,
+       mode    => '0750',
+       owner   => 'knot',
+       group   => 'knot',
+    }
+    file { '/var/lib/knot/zones/*.zone':
+       #ensure => file,
+       mode    => '0750',
+       owner   => 'knot',
+       group   => 'knot',
+    }
+    #file { '/etc/knot/conf.d/*.conf':
+    #   ensure  => file,
+    #   owner   => 'knot',
+    #   group   => 'knot',
+    #   notify  => Service['knot'],
+    #}
+
+    # Install KnotREST configuration
+    if $knot_rest_token_secret {
+        file { "/etc/knot_rest/knot_rest.yaml":
+           ensure  => "file",
+           content => template("dns/knot/knot_rest.yaml.erb")
+        }
+    }
+    file{"/var/log/knot_rest":
+       ensure  => directory,
+       mode    => '0750',
+       owner   => 'knot_rest',
+       group   => 'knot_rest',
+    }
+
+    # NFT rules
+    sunet::nftables::rule { 'dns-udp':
+       rule => "add rule inet filter input udp dport 53 counter accept comment \"allow-dns-udp\""
+    }
+    sunet::nftables::rule { 'dns-tcp':
+       rule => "add rule inet filter input tcp dport 53 counter accept comment \"allow-dns-tcp\""
+    }
+}
--- a/global/overlay/etc/puppet/modules/dns/templates/apache2/dns-rest-api.conf.erb
+++ b/global/overlay/etc/puppet/modules/dns/templates/apache2/dns-rest-api.conf.erb
@ -0,0 +1,28 @@
+<VirtualHost *:80>
+	ErrorLog ${APACHE_LOG_DIR}/error.log
+	CustomLog ${APACHE_LOG_DIR}/access.log combined
+	RewriteEngine on
+	RewriteCond %{SERVER_NAME} =dns-rest-api.sunet.se
+	RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
+</VirtualHost>
+<IfModule mod_ssl.c>
+	Listen <%= @dnsapiport %>
+<VirtualHost *:<%= @dnsapiport %>>
+	ErrorLog ${APACHE_LOG_DIR}/error.log
+	CustomLog ${APACHE_LOG_DIR}/access.log combined
+
+	<Location "/">
+           AllowMethods GET POST PATCH PUT DELETE
+	</Location>
+
+	ProxyTimeout 59
+        RequestHeader unset X-Remote-User early
+        ProxyPass "/" "http://localhost:5000/" connectiontimeout=59 timeout=59 Keepalive=On
+	ProxyPreserveHost On
+
+ServerName dns-rest-api.sunet.se
+SSLCertificateFile /etc/letsencrypt/live/dns-rest-api.sunet.se/fullchain.pem
+SSLCertificateKeyFile /etc/letsencrypt/live/dns-rest-api.sunet.se/privkey.pem
+Include /etc/letsencrypt/options-ssl-apache.conf
+</VirtualHost>
+</IfModule>
--- a/global/overlay/etc/puppet/modules/dns/templates/knot/knot.conf.erb
+++ b/global/overlay/etc/puppet/modules/dns/templates/knot/knot.conf.erb
@ -17,18 +17,27 @@ database:
 remote:
  - id: localhost
    address: 127.0.0.1@53
+  - id: ns1-sunet-se
+    address: 89.47.185.240@53
+    address: 2001:6b0:5a:4020::384@53
+  - id: ns2-sunet-se
+    address: 130.242.114.44@53
+  - id: sunic-node1
+    address: 130.242.3.49@53
+    address: 2001:6b0:1e:2::22d@53
+  - id: sunic-node2
+    address: 130.242.3.241@53
+    address: 2001:6b0:1e:2::22f@53
+  - id: sunic-node3
+    address: 130.242.3.125@53
+    address: 2001:6b0:1e:2::231@53

 template:
  - id: default
    storage: "/var/lib/knot/zones"
    file: "%s.zone"

-zone:
-    # Primary zones
-  - domain: example.com
-    dnssec-signing: off
-    notify: [ localhost ]
+include: conf.d/*.conf
+
+# All zone:s conf ^^^ should go into that directory

-  - domain: example.net
-    dnssec-signing: off
-    notify: [ localhost ]
--- a/global/overlay/etc/puppet/modules/dns/templates/knot/resolv.conf.erb
+++ b/global/overlay/etc/puppet/modules/dns/templates/knot/resolv.conf.erb
@ -0,0 +1,3 @@
+search sunet.se
+nameserver 89.32.32.32
+nameserver 2001:6b0:89::32:32:32
Author	SHA1	Message	Date
pettai	e00a7dc7b5	uppdate knot.conf template with ns2	2025-04-03 10:11:28 +02:00
pettai	899cf92d6d	add ns2 (into dco)	2025-04-03 10:06:01 +02:00
pettai	097895b63d	add dco.sunet.se zone	2025-04-02 14:27:19 +02:00
pettai	95f4855290	add key	2025-03-17 10:54:06 +01:00
pettai	8b9c4ec8b3	add sun.ladok.se	2025-03-17 10:50:44 +01:00
pettai	cf6ff5f3a3	add new acls	2025-03-13 10:33:53 +01:00
pettai	1c945a4ad6	add zone infra.utv.ladok.se, lab.utv.ladok.se	2025-03-12 14:52:35 +01:00
pettai	f8e3d05d70	update acl	2025-03-11 09:48:18 +01:00
pettai	85d7afb9da	add new tsig key	2025-03-10 12:07:33 +01:00
pettai	5b84480f8d	add alternativ	2025-03-10 11:01:10 +01:00
pettai	76f403a6ed	load from config, don't hardcode	2025-03-05 16:04:57 +01:00
pettai	f448be8bf8	add simple checker	2025-03-05 15:34:55 +01:00
pettai	a273ba637d	add subs pattern acl to ladok.se	2025-03-04 08:55:17 +01:00
pettai	793989e599	acl CNAME -> TXT	2025-02-28 21:49:15 +01:00
pettai	aec4b7297e	add ddns support for ladok	2025-02-27 20:37:10 +01:00
Patrik Lundin	dac959b288	Enable starhip to get SUNET prompt	2025-02-04 12:13:28 +01:00
Patrik Lundin	1093b8f546	Update SSH key for pettai From cnaas-ops	2025-02-04 12:11:10 +01:00
Patrik Lundin	7465f1e424	Add Anders key from nunoc-ops Needed to fix ``` Checking signature on puppet-module:tag sunet:stable-2023v1-2025-02-03-v02 FAILED signature check on puppet-module sunet object 0d718c7ab161cba8f75783782b7f4285da0ed7c3 type commit tag stable-2023v1-2025-02-03-v02 tagger Anders Oskarsen <anders.oskarsen@sunet.se> 1738585413 +0100 bump. gpg: Signature made Mon Feb 3 12:23:33 2025 UTC gpg: using RSA key 9A6A3E85446B9DABDD90DAC4B189A302EB5F91CA gpg: Can't check signature: No public key ```	2025-02-04 11:47:46 +01:00
Patrik Lundin	22b08e9f57	Update pettai key From cnaas-ops	2025-02-04 11:21:01 +01:00
pettai	99117ed5c7	add catalog generator conf	2025-01-22 15:06:09 +01:00
pettai	009c9f058b	enable	2024-12-16 14:46:37 +01:00
pettai	5a24ba2564	add ns-kth-se secondary	2024-12-16 14:43:58 +01:00
pettai	6feb3938c9	add sfhm.se	2024-12-16 14:36:03 +01:00
pettai	0bb13eb0e9	add dc4eu.sunet.se	2024-12-12 17:22:07 +01:00
pettai	1e8c0d4b04	add localhost too	2024-12-12 10:30:03 +01:00
pettai	6e4c67f62e	fix localhost	2024-12-12 10:29:26 +01:00
pettai	666b58f327	reconf komreg.se	2024-12-12 10:27:46 +01:00
pettai	f0a5740e9d	add nmugroup acl	2024-12-12 10:08:37 +01:00
pettai	359e0865ed	add edusign.sunet.se	2024-12-11 16:37:55 +01:00
pettai	bcec577e89	add komreg.se primary	2024-12-11 10:44:38 +01:00
pettai	65dc23c664	adderar streams.sunet.se	2024-10-15 11:07:24 +02:00
pettai	bcb6f5c7b5	addera labb, test and prod .sunet.se	2024-10-15 10:50:08 +02:00
Patrik Lundin	42919f3f93	Update jocar key that has expired Copied from platform-ops	2024-10-03 09:09:03 +02:00
Patrik Lundin	72d714eac6	Add cdn.sunet.se	2024-10-03 08:57:22 +02:00
pettai	baed59db55	add new zone(s) conf	2024-09-17 10:01:11 +02:00
pettai	27c0c1057e	remove deprecated zone	2024-09-12 09:26:30 +02:00
pettai	0fb00691ad	remove deprecated zones	2024-09-12 09:24:23 +02:00
pettai	4d44ca098a	add cert.sunet.se zone	2024-09-09 16:32:47 +02:00
pettai	b422600556	revert	2024-09-04 14:41:20 +02:00
pettai	610d958305	enable nrpe	2024-09-04 14:28:36 +02:00
pettai	3417521658	add reverse zones for SafeSpring STO3 + STO4 private-cloud	2024-09-03 15:15:35 +02:00
pettai	996bc2a7dd	add adva.sunet.se	2024-08-30 13:57:07 +02:00
pettai	196ede5430	add geteduroam.sunet.se	2024-08-30 12:52:49 +02:00
pettai	6ac2d7b5ed	add mail.sunet.se conf	2024-08-30 12:08:07 +02:00
pettai	ac8b681d34	add eduseal	2024-08-29 23:09:30 +02:00
pettai	3821e448e8	add another zone	2024-08-28 20:37:27 +02:00
pettai	6623055ebc	activate 11 more zone(s) from hidden-master	2024-08-28 15:31:31 +02:00
pettai	638656bb1d	add cnaas.sunet.se	2024-08-27 15:40:00 +02:00
Patrik Lundin	5972eea025	Do not notify ourselves Try to fix warning from startup: ``` Jun 26 12:47:35 dns-rest-api1 knotd[729521]: warning: [example.com.] notify, outgoing, remote 127.0.0.1@53 TCP, server responded with error 'NOTAUTH' Jun 26 12:47:35 dns-rest-api1 knotd[729521]: warning: [example.net.] notify, outgoing, remote 127.0.0.1@53 TCP, server responded with error 'NOTAUTH' ```	2024-06-26 14:56:36 +02:00
Patrik Lundin	b153e10981	dns-rest-api: remove use of sunic-sunet-se We only need to notify the backend sunic nodes directly, there is no need to notify the anycasted service addresses.	2024-06-26 14:39:53 +02:00
Patrik Lundin	98835107cf	Do not notify sunic-sunet-se for knubbis.sunet.se Test if this works as expected.	2024-06-26 11:40:48 +02:00
Patrik Lundin	a8416c23af	Add knubbis.sunet.se	2024-06-26 10:27:23 +02:00
pettai	ebff583e82	add drive.sunet.se conf	2024-06-25 17:17:00 +02:00
pettai	9c3176a6d5	add knotrestctl	2024-06-25 14:06:22 +02:00
pettai	96ca654aaf	comment out none-working stuff	2024-06-25 13:13:11 +02:00
pettai	6dd1228908	add rut.sunet.se -zone	2024-06-25 12:57:20 +02:00
pettai	7c63b8e4bd	add pahol's key	2024-06-20 12:52:22 +02:00
pettai	c50b52b90b	align rights with what knotdns prefers	2024-06-20 11:23:29 +02:00
pettai	0956ef607b	add drive.test.sunet.se zone	2024-06-19 14:28:14 +02:00
pettai	e1987a3080	add nft rules for dns	2024-06-14 21:43:29 +02:00
pettai	8c6cf419bf	fix	2024-06-14 16:19:57 +02:00
pettai	fe6c1124c8	fix?	2024-06-14 16:18:03 +02:00
pettai	7671061441	auto fix file perms	2024-06-14 16:15:40 +02:00
pettai	1f6992cf4f	fix	2024-06-14 16:13:30 +02:00
pettai	485ff34e51	typo	2024-06-14 16:12:06 +02:00
pettai	cc36ec8957	restruct	2024-06-14 16:08:57 +02:00
pettai	c879b4566b	test notify knot if file(s) changes	2024-06-14 16:02:17 +02:00
pettai	f05cb85e38	add first "real" zones	2024-06-14 15:49:32 +02:00
pettai	7a809fe7b5	knot conf templating	2024-06-14 14:36:47 +02:00
pettai	cb7937c282	remove old crap	2024-06-14 13:35:23 +02:00
pettai	dc3b39a430	add Listen for custom port	2024-06-14 12:59:43 +02:00
pettai	bd09f33737	order	2024-06-14 12:12:04 +02:00
pettai	b49151ca77	fix	2024-06-14 12:10:04 +02:00
pettai	7f0df1b813	add kano's gpg-key	2024-06-14 12:07:25 +02:00
pettai	d273d9db96	add LE SSL options	2024-06-14 12:04:35 +02:00
pettai	3c956bbb01	fix syntax :(	2024-06-14 10:24:52 +02:00
pettai	c077fa4405	make $dnsapiport dynamic	2024-06-14 10:20:46 +02:00
pettai	4605f00aa2	OCD fix	2024-06-13 15:22:54 +02:00
pettai	3589751773	don't reload apache2 all the time	2024-06-13 15:00:22 +02:00
pettai	4e124a1714	enable BaaS2	2024-06-13 14:41:17 +02:00
pettai	c85bd24126	nft's table inet is IPv4+IPv6 aware, no need for special IPv6 rule	2024-06-13 13:12:32 +02:00
pettai	ebbc77db04	disable faulty ipv6 for now	2024-06-13 13:02:49 +02:00
pettai	c7e9cf4df8	ntf rules	2024-06-13 12:59:00 +02:00
pettai	c14b7ba08f	fix again	2024-06-13 12:36:25 +02:00
pettai	b0d7c7196f	fix	2024-06-13 12:33:59 +02:00
pettai	7215ddeb2b	add init apache conf	2024-06-13 12:31:51 +02:00
pettai	e2154852e4	test	2024-06-13 11:05:07 +02:00
pettai	369390c4fd	enable apache2	2024-06-13 11:03:03 +02:00
pettai	720331cd43	add apache2	2024-06-13 11:01:58 +02:00
Patrik Lundin	27289f0be5	Create knot_rest_token_secret variable from secret	2024-06-13 09:39:05 +02:00
pettai	a54c86b584	use SUNETs resolver	2024-06-13 09:31:52 +02:00
pettai	21b6eae8d9	add acme-d for certs	2024-06-13 09:19:54 +02:00
pettai	fe6e9e5a30	exec -> package for knot	2024-06-12 22:00:12 +02:00
pettai	7c7ed0c7c0	fix typo	2024-06-12 17:20:31 +02:00
pettai	edc6f7a7b1	stop systemd-resolved	2024-06-12 17:18:08 +02:00
pettai	eebf6dae98	yaf	2024-06-12 16:45:10 +02:00
pettai	e0274dba57	add more fixes	2024-06-12 16:33:23 +02:00
pettai	81cdc7801e	fix comment	2024-06-12 16:27:46 +02:00
pettai	6a8f7dbe58	add fixes	2024-06-12 16:25:26 +02:00
pettai	adac2dfd11	add included knot-conf	2024-06-12 16:17:28 +02:00
pettai	1f0cd9544d	update secret	2024-06-12 15:56:40 +02:00
pettai	a8d4d352fd	don't (re)install unless ...	2024-06-12 15:20:55 +02:00
pettai	8799d758ca	fix dpkg name	2024-06-12 15:18:08 +02:00
pettai	4303861003	add more knot packages	2024-06-12 15:15:00 +02:00
pettai	bd32b1cb43	precise version	2024-06-12 15:10:18 +02:00
pettai	68688bca07	add conf	2024-06-12 15:06:02 +02:00
pettai	8b5db0625a	dns-rest-api1.sunet.se added	2024-06-12 13:48:52 +02:00
pettai	c75d64d114	fix	2024-06-12 11:34:01 +02:00
pettai	51087c591a	change " -> '	2024-06-12 11:31:38 +02:00
pettai	80cec401c8	rename and enable knotdns again	2024-06-12 11:26:34 +02:00
pettai	0d2f05ef98	add class dns	2024-06-12 10:20:14 +02:00
Patrik Lundin	fe51aab0e5	Disable class so my ssh key can get applied	2024-06-11 17:08:07 +02:00
Patrik Lundin	da67069ff0	Add my ssh key	2024-06-11 16:53:06 +02:00
				`@ -1,3 +0,0 @@`

				`The system documentation is in the docs directory of the multiverse repository.`