From 1b81c38e62a6152ddbc04ad9fff2cd57c9b3b1d1 Mon Sep 17 00:00:00 2001
From: Felix Albrigtsen <felix@albrigtsen.it>
Date: Sun, 18 Jan 2026 16:18:49 +0100
Subject: [PATCH] Don't try to steal NVGs DNS records

---
 zoneConfig.nix                |  3 ++-
 zones/reverse-ipv4-parent.nix | 45 +++++++++++++++++++++++++++++++++++
 zones/reverse-ipv4.nix        | 18 +++++++-------
 3 files changed, 56 insertions(+), 10 deletions(-)
 create mode 100644 zones/reverse-ipv4-parent.nix

diff --git a/zoneConfig.nix b/zoneConfig.nix
index d9bf773..8d1b3b5 100644
--- a/zoneConfig.nix
+++ b/zoneConfig.nix
@@ -13,7 +13,8 @@ let
       {
         "pvv.ntnu.no" = ./zones/pvv.ntnu.no.nix;
         "pvv.org" = ./zones/pvv.org.nix;
-        "in-addr.arpa" = ./zones/reverse-ipv4.nix;
+        "210.241.129.in-addr.arpa" = ./zones/reverse-ipv4-parent.nix;
+        "128-255.210.241.129.in-addr.arpa" = ./zones/reverse-ipv4.nix;
         #"reverse-ipv6" = ./zones/reverse-ipv6.nix;
       };
 in
diff --git a/zones/reverse-ipv4-parent.nix b/zones/reverse-ipv4-parent.nix
new file mode 100644
index 0000000..227beb7
--- /dev/null
+++ b/zones/reverse-ipv4-parent.nix
@@ -0,0 +1,45 @@
+{ dns, lib, ... }:
+
+with dns.lib.combinators;
+{
+  useOrigin = true; # Don't fully qualified names
+
+  SOA = {
+    nameServer = "dvask.pvv.ntnu.no";
+    adminEmail = "drift@pvv.ntnu.no";
+    serial = 2025021701; # TODO: Automate
+  };
+  NS = [
+    "dvask.pvv.ntnu.no"
+    "swix.nvg.ntnu.no"
+    "nn.unintett.no"
+  ];
+
+  subdomains = let
+    # $GENERATE	0-127	$	CNAME	$.0-127
+    nvgRedirects = builtins.listToAttrs ( builtins.genList (n:
+      { name = toString n; value.CNAME = [ "${toString n}.0-127" ]; }
+    ) 127);
+
+    # $GENERATE	128-255	$	CNAME	$.128-255
+    pvvRedirects = builtins.listToAttrs ( builtins.genList (n:
+      { name = toString (n+128); value.CNAME = [ "${toString (n+128)}.128-255" ]; }
+    ) 127);
+  in {
+    # 129.241.210.0/25 delegated to NVGs NS
+    "0-127" = {
+      NS = [
+        "swix.nvg.ntnu.no"
+        "nn.uninett.no"
+      ];
+    };
+
+    # 129.241.210.128/25 delegated to PVVs NS
+    "128-255" = {
+      NS = [
+        "dvask.pvv.ntnu.no"
+        "nn.uninett.no"
+      ];
+    };
+  } // nvgRedirects // pvvRedirects;
+}
diff --git a/zones/reverse-ipv4.nix b/zones/reverse-ipv4.nix
index 29eba02..c056509 100644
--- a/zones/reverse-ipv4.nix
+++ b/zones/reverse-ipv4.nix
@@ -2,29 +2,30 @@
 
 with dns.lib.combinators;
 let
-  pvvv4 = hostPart: "129.241.210.${toString hostPart}";
+  pvvv4Prefix = "129.241.210.";
   domainSuffix = ".pvv.ntnu.no.";
-  flipV4 = ip: lib.concatStringsSep "." (lib.reverseList (lib.splitString "." ip));
 
   pvvHostRecords = import ../pvv-subdomains.nix { inherit dns lib; };
-  # Take all the A-records, and flip them to generate opposing PTR records
-  # TODO: Handle duplicates?
+  # Find all the A-records pointing into the PVV-network, and generate the opposing PTR records
+  # TODO: Handle duplicates? Avoid NVG-IPs?
   pvvHostReverseRecords = builtins.listToAttrs (
       lib.concatLists (
         lib.mapAttrsToList ( target: host:
           lib.map
-          (aRecord: { name = flipV4 aRecord; value.PTR = [ (target + domainSuffix) ]; })
-            (host.A or [])
+          (aRecordKey: let
+            hostOctet = builtins.elemAt (lib.splitString "." aRecordKey) 3;
+          in { name = hostOctet; value.PTR = [ (target + domainSuffix) ]; })
+            (lib.filter (e: lib.hasPrefix pvvv4Prefix e) (host.A or []))
           ) pvvHostRecords
         )
       );
 
   additionalReverseRecords = {
-    "${flipV4 "129.241.210.129"}".PTR = [ "el-swd.nettel.ntnu.no." ]; # Gateway router/switch
+    "129".PTR = [ "el-swd.nettel.ntnu.no." ]; # Gateway router/switch
   };
 in
 {
-  useOrigin = false; # Use fully qualified names
+  useOrigin = true; # Don't use fully qualified names
 
   SOA = {
     nameServer = "dvask.pvv.ntnu.no";
@@ -36,6 +37,5 @@ in
     "nn.unintett.no"
   ];
 
-  # Additional
   subdomains = pvvHostReverseRecords // additionalReverseRecords;
 }