add remote IPsec settings

Signed-off-by: Egor Savkin <es@m-labs.hk>

backupdl-module.nix

@@ -0,0 +1,56 @@
+{ config, pkgs, lib, ... }:
+with lib;
+let
+  makeBackup = pkgs.writeScript "make-backupdl" ''
+    #!${pkgs.bash}/bin/bash
+
+    set -e
+
+    export PATH=${pkgs.rsync}/bin:${pkgs.openssh}/bin
+
+    FILENAME=backup-`${pkgs.coreutils}/bin/date +%F`.tar.bz2.gpg
+
+    ssh nixbld.m-labs.hk mlabs-backup > /hdd/backupdl/backupdl/$FILENAME
+    rsync -az nixbld.m-labs.hk:/var/lib/nextcloud/data /hdd/backupdl/nextcloud
+  '';
+
+  cfg = config.services.backupdl;
+in
+{
+  options.services.backupdl = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Enable backups";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.backupdl = {
+      description = "Nixbld backups download";
+      serviceConfig = {
+        Type = "oneshot";
+        User = "backupdl";
+        Group = "backupdl";
+        ExecStart = "${makeBackup}";
+      };
+    };
+
+    users.users.backupdl = {
+      name = "backupdl";
+      group = "backupdl";
+      description = "Nixbld backups download";
+      isSystemUser = true;
+      createHome = true;
+      home = "/hdd/backupdl";
+      useDefaultShell = true;
+    };
+    users.extraGroups.backupdl = {};
+
+    systemd.timers.backupdl = {
+      description = "Nixbld backups download";
+      wantedBy = [ "timers.target" ];
+      timerConfig.OnCalendar = "wednesday,sunday *-*-* 08:00:00";
+    };
+  };
+}

nixbld-etc-nixos/afws-module.nix

@@ -0,0 +1,48 @@
+{ config, pkgs, lib, ... }:
+with lib;
+let
+  afws = pkgs.callPackage ./afws { inherit pkgs; };
+in
+{
+  options.services.afws = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Enable AFWS server";
+    };
+  };
+
+  config = mkIf config.services.afws.enable {
+    systemd.services.afws = {
+      description = "AFWS server";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        User = "afws";
+        Group = "afws";
+        ExecStart = "${afws}/bin/afws_server";
+        ExecReload = "${pkgs.coreutils}/bin/kill -USR1 $MAINPID";
+      };
+      path = [ pkgs.nix pkgs.git ];
+    };
+
+    security.acme.certs."afws.m-labs.hk".postRun =
+      ''
+      mkdir -p /var/lib/afws/cert
+      cp cert.pem /var/lib/afws/cert
+      cp key.pem /var/lib/afws/cert
+      chown -R afws:afws /var/lib/afws/cert
+      '';
+    security.acme.certs."afws.m-labs.hk".reloadServices = [ "afws.service" ];
+
+    users.users.afws = {
+      name = "afws";
+      group = "afws";
+      description = "AFWS server user";
+      isSystemUser = true;
+      createHome = false;
+      home = "/var/lib/afws";
+      useDefaultShell = true;
+    };
+    users.extraGroups.afws = {};
+  };
+}

nixbld-etc-nixos/backup-module.nix

@@ -1,29 +1,37 @@
 { config, pkgs, lib, ... }:
 with lib;
 let
+  excludePaths = [
+    "/var/lib/gitea/repositories/*/*.git/archives"
+    "/var/lib/gitea/data/repo-archive"
+    "/var/lib/gitea/data/indexers"
+    "/var/vmail/m-labs.hk/js"
+    "/var/lib/afws/.cache"
+    "/var/lib/mattermost/data/2019*"
+    "/var/lib/mattermost/data/2020*"
+    "/var/lib/mattermost/data/2021*"
+    "/var/lib/mattermost/data/2022*"
+    "/var/lib/mattermost/data/2023*"
+  ];
   makeBackup = pkgs.writeScript "make-backup" ''
-    #!${pkgs.bash}/bin/bash
+    #!${pkgs.bash}/bin/bash -p
 
     set -e
     umask 0077
 
-    FILENAME=backup-`date +%F`.tar.bz2.gpg
-
     DBDUMPDIR=`mktemp -d`
-    pushd $DBDUMPDIR
+    trap "rm -rf $DBDUMPDIR" EXIT
+    cd $DBDUMPDIR
 
-    ${config.services.mysql.package}/bin/mysqldump --single-transaction flarum > flarum.sql
-    ${pkgs.sudo}/bin/sudo -u mattermost ${config.services.postgresql.package}/bin/pg_dump mattermost > mattermost.sql
+    ${config.services.mysql.package}/bin/mysqldump --user=root --single-transaction flarum > flarum.sql
+    ${config.services.postgresql.package}/bin/pg_dump mattermost > mattermost.sql
+    ${config.services.postgresql.package}/bin/pg_dump rt5 > rt.sql
+    ${config.services.postgresql.package}/bin/pg_dump gitea > gitea.sql
 
-    ${pkgs.gnutar}/bin/tar cf - --exclude "/var/lib/gitea/repositories/*/*.git/archives" /etc/nixos /var/lib/gitea flarum.sql mattermost.sql | \
+    exec 6< /etc/nixos/secret/backup-passphrase
+    ${pkgs.gnutar}/bin/tar cf - ${lib.concatMapStringsSep " " (p: "--exclude \"${p}\"") excludePaths} /etc/nixos /var/vmail /var/lib/hedgedoc /var/lib/gitea /var/lib/afws /var/lib/mattermost/data /var/www/193thz flarum.sql mattermost.sql rt.sql gitea.sql | \
         ${pkgs.bzip2}/bin/bzip2 | \
-        ${pkgs.gnupg}/bin/gpg --symmetric --batch --passphrase-file /etc/nixos/secret/backup-passphrase | \
-        ${pkgs.rclone}/bin/rclone rcat --config /etc/nixos/secret/rclone.conf dropbox:$FILENAME
-
-    popd
-    rm -rf $DBDUMPDIR
-
-    echo Backup done
+        ${pkgs.gnupg}/bin/gpg --symmetric --batch --passphrase-fd 6
   '';
   cfg = config.services.mlabs-backup;
 in
@@ -37,20 +45,20 @@ in
   };
 
   config = mkIf cfg.enable {
-    systemd.services.mlabs-backup = {
-      description = "M-Labs backup";
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-        ExecStart = "${makeBackup}";
-      };
+    users.extraGroups.backupdl = { };
+    users.extraUsers.backupdl = {
+      isNormalUser = true;
+      extraGroups = ["backupdl" "nextcloud"];
+      openssh.authorizedKeys.keys = [
+        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCbH+l0FIBTPdUKOS9H5OOT5ro/nljKLsiCTzTzublCScdPPmCNy27ORbLgNHX5Ughlug5wr2rAIU9AexV+L71V5MeVHUWDfKgRsNIpUTtY6wpJkAP7r1ipk2kTWc/sxhrxyPea62cohmy1dOeLlwXO6U8FnsiZfYKmgjZ8wuTo6ixDB8krXsAZ8VY/bj5WFcXqeW8GF1Qjpel7HgpCpj3HIUyC63uwIyUoYe+cgnhjzNLbRYdU9Yx2iqcUCwEUX2cMdz5VX+xbLkL8CWcuiMFg6TFo+CUPFtuA/kVzHcZ4Pa3BiilL3rf7oXlIXGN12JVsN+caX7j2weVqm2b5u5eVsyDxiLx1KA37ukq92CYAAdOuKE+saMPsLuOn+Qd9B6D5oYnYgsWg460uEGgwczwOTXLAZTT5wrwRaKIE+ezKqtRP+Tz7l2IEixulyj1MUR+XpSwECZXiFJx5DGofwzxcd2kWnNOPBReDkHv0At5ZLNIrLuxFMz2L6UXbqvHwEu8= backupdl@minipc"
+      ];
     };
-
-    systemd.timers.mlabs-backup = {
-      description = "M-Labs backup";
-      wantedBy = [ "timers.target" ];
-      timerConfig.OnCalendar = "weekly";
+    security.wrappers.mlabs-backup = {
+      source = makeBackup;
+      setuid = true;
+      owner = "root";
+      group = "backupdl";
+      permissions = "g+x";
     };
   };
 }

nixbld-etc-nixos/flarum/default.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  php,
+  fetchFromGitHub,
+  fetchpatch,
+}:
+
+php.buildComposerProject (finalAttrs: {
+  pname = "flarum";
+  version = "1.8.1";
+
+  src = fetchFromGitHub {
+    owner = "flarum";
+    repo = "flarum";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-kigUZpiHTM24XSz33VQYdeulG1YI5s/M02V7xue72VM=";
+  };
+
+  patches = [
+    # Add useful extensions from https://github.com/FriendsOfFlarum
+    # Extensions included: fof/upload, fof/polls, fof/subscribed
+    ./fof-extensions.patch
+  ];
+
+  composerLock = ./composer.lock;
+  composerStrictValidation = false;
+  vendorHash = "sha256-z3KVGmILw8MZ4aaSf6IP/0l16LI/Y2yMzY2KMHf4qSg=";
+
+  meta = with lib; {
+    changelog = "https://github.com/flarum/framework/blob/main/CHANGELOG.md";
+    description = "Flarum is a delightfully simple discussion platform for your website";
+    homepage = "https://github.com/flarum/flarum";
+    license = lib.licenses.mit;
+    maintainers = with maintainers; [
+      fsagbuya
+      jasonodoom
+    ];
+  };
+})

nixbld-etc-nixos/flarum/fof-extensions.patch

@@ -0,0 +1,16 @@
+diff --git a/composer.json b/composer.json
+index c63b5f8..5ad1186 100644
+--- a/composer.json
++++ b/composer.json
+@@ -37,7 +37,10 @@
+         "flarum/sticky": "*",
+         "flarum/subscriptions": "*",
+         "flarum/suspend": "*",
+-        "flarum/tags": "*"
++        "flarum/tags": "*",
++        "fof/polls": "*",
++        "fof/subscribed": "*",
++        "fof/upload": "*"
+     },
+     "config": {
+         "preferred-install": "dist",

nixbld-etc-nixos/gitea-home.tmpl

@@ -3,7 +3,7 @@
 	<div class="ui stackable middle very relaxed page grid">
 		<div class="sixteen wide center aligned centered column">
 			<div>
-				<img class="logo" width="220" height="220" src="{{StaticUrlPrefix}}/img/logo.svg"/>
+				<img class="logo" width="220" height="220" src="{{AssetUrlPrefix}}/img/logo.svg"/>
 			</div>
 			<div class="hero">
 				<h1 class="ui icon header title">

nixbld-etc-nixos/gitea-signin.tmpl

@@ -2,9 +2,9 @@
 <div class="page-content user signin{{if .LinkAccountMode}} icon{{end}}">
 	{{template "user/auth/signin_navbar" .}}
 	<div class="ui middle very relaxed page grid">
-		<div class="ui container column">
+		<div class="ui container column fluid">
 			{{template "user/auth/signin_inner" .}}
-	        To get an account (also available to external contributors), simply write to sb@m-***s.hk.
+			To get an account (also available to external contributors), simply write to sb@m-***s.hk.
 		</div>
 	</div>
 </div>

nixbld-etc-nixos/hydra-hack-allowed-uris.patch

@@ -1,13 +0,0 @@
-diff --git a/src/hydra-eval-jobs/hydra-eval-jobs.cc b/src/hydra-eval-jobs/hydra-eval-jobs.cc
-index 934bf42e..48f2d248 100644
---- a/src/hydra-eval-jobs/hydra-eval-jobs.cc
-+++ b/src/hydra-eval-jobs/hydra-eval-jobs.cc
-@@ -281,6 +281,8 @@ int main(int argc, char * * argv)
-            to the environment. */
-         evalSettings.restrictEval = true;
- 
-+        evalSettings.allowedUris = {"https://github.com/m-labs/misoc.git"};
-+
-         /* When building a flake, use pure evaluation (no access to
-            'getEnv', 'currentSystem' etc. */
-         evalSettings.pureEval = myArgs.flake;

nixbld-etc-nixos/hydra-msys2.patch

@@ -0,0 +1,122 @@
+diff --git a/src/root/product-list.tt b/src/root/product-list.tt
+index 4d545b3e..6049c2a6 100644
+--- a/src/root/product-list.tt
++++ b/src/root/product-list.tt
+@@ -162,6 +162,11 @@
+             <img src="[% c.uri_for("/static/images/iso.png") %]" alt="ISO" />
+           </td>
+           <td>ISO-9660 CD/DVD image</td>
++        [% CASE "msys2" %]
++          <td>
++            <img src="[% c.uri_for("/static/images/msys2.svg") %]" alt="MSYS2" width="32" height="32" />
++          </td>
++          <td>MSYS2 package</td>
+         [% CASE "binary-dist" %]
+           <td>
+             <img src="[% c.uri_for("/static/images/binary-dist.png") %]" alt="Binary distribution" />
+diff --git a/src/root/static/images/msys2.svg b/src/root/static/images/msys2.svg
+new file mode 100644
+index 00000000..46baff50
+--- /dev/null
++++ b/src/root/static/images/msys2.svg
+@@ -0,0 +1,100 @@
++<?xml version="1.0" encoding="UTF-8" standalone="no"?>
++<!-- Created with Inkscape (http://www.inkscape.org/) -->
++
++<svg
++   width="36.777081mm"
++   height="36.777081mm"
++   viewBox="0 0 36.77708 36.777081"
++   version="1.1"
++   id="svg8"
++   inkscape:version="1.1.1 (3bf5ae0d25, 2021-09-20)"
++   sodipodi:docname="msys2_logo.svg"
++   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
++   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
++   xmlns="http://www.w3.org/2000/svg"
++   xmlns:svg="http://www.w3.org/2000/svg"
++   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
++   xmlns:cc="http://creativecommons.org/ns#"
++   xmlns:dc="http://purl.org/dc/elements/1.1/">
++  <defs
++     id="defs2" />
++  <sodipodi:namedview
++     id="base"
++     pagecolor="#ffffff"
++     bordercolor="#666666"
++     borderopacity="1.0"
++     inkscape:pageopacity="0.0"
++     inkscape:pageshadow="2"
++     inkscape:zoom="3.959798"
++     inkscape:cx="121.34457"
++     inkscape:cy="27.274119"
++     inkscape:document-units="mm"
++     inkscape:current-layer="layer1"
++     showgrid="false"
++     fit-margin-top="0"
++     fit-margin-left="0"
++     fit-margin-right="0"
++     fit-margin-bottom="0"
++     inkscape:window-width="2560"
++     inkscape:window-height="1371"
++     inkscape:window-x="0"
++     inkscape:window-y="32"
++     inkscape:window-maximized="1"
++     inkscape:pagecheckerboard="true" />
++  <metadata
++     id="metadata5">
++    <rdf:RDF>
++      <cc:Work
++         rdf:about="">
++        <dc:format>image/svg+xml</dc:format>
++        <dc:type
++           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
++      </cc:Work>
++    </rdf:RDF>
++  </metadata>
++  <g
++     inkscape:label="Layer 1"
++     inkscape:groupmode="layer"
++     id="layer1"
++     transform="translate(-122.70998,-169.48973)">
++    <rect
++       style="fill:#894c84;fill-opacity:1;stroke-width:0"
++       id="rect946"
++       width="36.777081"
++       height="36.777081"
++       x="122.70998"
++       y="169.48973" />
++    <path
++       style="fill:#d35e64;fill-opacity:1;stroke-width:0.133635"
++       d="m 142.72948,201.89184 c -0.32408,-0.25492 -0.35455,-0.35395 -0.3187,-1.03567 l 0.0396,-0.75379 h 0.45908 c 0.44506,0 0.45934,0.0163 0.46772,0.53453 l 0.009,0.53454 0.70308,0.0405 c 0.53885,0.031 0.7217,-0.008 0.78281,-0.16735 0.15971,-0.41619 -0.10726,-0.89779 -0.98636,-1.77935 -0.49365,-0.49504 -1.03351,-1.07713 -1.19967,-1.29353 -0.38599,-0.50269 -0.40844,-1.38334 -0.0467,-1.83013 0.23417,-0.28918 0.35554,-0.31548 1.45595,-0.31548 1.36938,0 1.67817,0.15986 1.80376,0.93383 0.11523,0.71006 -0.0673,1.20433 -0.44479,1.20433 -0.26632,0 -0.34178,-0.0979 -0.46372,-0.60136 -0.13305,-0.54937 -0.1843,-0.60509 -0.59283,-0.64461 -0.24596,-0.0238 -0.58921,-0.008 -0.76279,0.036 -0.59536,0.14942 -0.37642,0.57816 0.95393,1.86806 l 1.26953,1.23092 v 0.90178 c 0,1.37811 -0.0436,1.41874 -1.52348,1.41874 -1.06598,0 -1.29877,-0.0409 -1.60514,-0.28187 z"
++       id="path3828"
++       inkscape:connector-curvature="0" />
++    <path
++       style="fill:#d35e64;fill-opacity:1;stroke-width:0.133635"
++       d="m 148.05027,204.08841 c 0.0471,-0.28134 0.11947,-1.05275 0.16076,-1.71424 0.0703,-1.12643 0.0353,-1.35529 -0.55133,-3.60814 -0.34453,-1.32299 -0.6573,-2.54073 -0.69504,-2.70611 -0.0594,-0.26014 -0.0147,-0.30067 0.33149,-0.30067 0.22006,0 0.46737,0.081 0.54957,0.18007 0.0822,0.099 0.30254,0.86578 0.48964,1.70385 0.41743,1.86975 0.45345,1.99148 0.58914,1.99148 0.15912,0 0.35622,-0.563 0.74822,-2.13717 0.38958,-1.56447 0.48518,-1.73823 0.9564,-1.73823 0.39274,0 0.46132,-0.43504 -0.70121,4.4477 -0.46869,1.96849 -0.93011,3.74249 -1.02539,3.94223 -0.11781,0.24694 -0.29559,0.37716 -0.55559,0.40696 -0.37406,0.0429 -0.38048,0.0327 -0.29666,-0.46773 z"
++       id="path3830"
++       inkscape:connector-curvature="0" />
++    <path
++       style="fill:#d35e64;fill-opacity:1;stroke-width:0.133635"
++       d="m 155.37958,199.87478 -0.001,1.04324 c 0,0 0.0415,0.99571 -0.10812,1.13694 -0.15218,0.14363 -0.72994,0.11875 -1.5324,0.11875 -1.39413,0 -1.4684,-0.0143 -1.66996,-0.32193 -0.14282,-0.21797 -0.19775,-0.55241 -0.17012,-1.03567 0.0397,-0.69411 0.0518,-0.71373 0.43989,-0.71373 0.2965,0 0.40947,0.0687 0.43951,0.26726 0.13121,0.86712 0.13264,0.86863 0.81803,0.86863 1.33065,0 1.18669,-0.7429 -0.41998,-2.16732 -0.98712,-0.87515 -1.3045,-1.34704 -1.30163,-1.93531 0.005,-1.02426 0.44219,-1.37639 1.70885,-1.37639 1.4449,0 1.89746,0.36739 1.89746,1.54037 0,0.85 -0.80733,1.01376 -0.94108,0.1909 -0.113,-0.69515 -0.21979,-0.79583 -0.84414,-0.79583 -0.59087,0 -0.88668,0.17572 -0.88861,0.52786 -5.3e-4,0.11392 0.5857,0.76291 1.30294,1.44221"
++       id="path3832"
++       inkscape:connector-curvature="0"
++       sodipodi:nodetypes="ccssccscsccsssscc" />
++    <path
++       inkscape:connector-curvature="0"
++       id="path3826"
++       d="m 125.15872,195.23965 c -0.30592,-0.19939 -0.0836,-0.86189 0.8607,-2.56497 1.58255,-2.85415 5.22198,-10.62008 6.75854,-14.42159 0.91204,-2.25643 0.98557,-2.83541 0.41825,-3.29345 -0.30201,-0.24384 -0.34148,-0.33999 -0.22153,-0.53956 0.44174,-0.73497 2.98816,-1.05046 4.06353,-0.50346 1.1982,0.60947 1.74884,2.08184 2.47139,6.60826 0.57628,3.61017 1.00176,6.0369 1.0809,6.16495 0.21334,0.34519 0.63685,-0.49885 2.24466,-4.47355 2.25297,-5.56961 3.24559,-7.35862 4.41748,-7.9617 0.51912,-0.26714 0.89922,-0.34492 1.8995,-0.38866 1.60332,-0.0701 1.6509,-0.0327 1.64898,1.29653 -0.002,1.7237 -0.0807,1.96599 -0.76359,2.3662 -1.27599,0.74779 -2.16809,2.00702 -2.17,3.06305 -0.003,1.44987 1.07869,1.89961 2.0727,0.86208 0.20781,-0.2169 0.42671,-0.39436 0.48646,-0.39436 0.0597,0 0.10898,0.55626 0.10941,1.23612 5.2e-4,0.67987 0.0579,1.58514 0.12779,2.01171 0.14392,0.87871 0.16421,0.83597 -1.8354,3.86646 -1.11067,1.68327 -1.20806,1.92146 -0.90836,2.22164 0.18169,0.18198 0.60193,0.22609 2.48831,0.26119 l 2.26971,0.0422 0.55893,0.7403 c 0.68294,0.90455 0.72637,1.39945 0.1851,2.10909 -0.49391,0.64756 -1.48498,1.35585 -2.16303,1.54588 -0.98995,0.27744 -2.22523,-0.26803 -3.29926,-1.45686 -1.37797,-1.52525 -1.99486,-3.94203 -2.17991,-8.54021 -0.0642,-1.59436 -0.13883,-2.29481 -0.24099,-2.26075 -0.0814,0.0271 -0.99576,2.00431 -2.03189,4.39371 -3.28691,7.57995 -3.68415,8.28612 -4.54018,8.07127 -0.53578,-0.13448 -1.34919,-1.06203 -1.9102,-2.17825 -1.10951,-2.20757 -1.73511,-5.05031 -2.03723,-9.25721 -0.0871,-1.21273 -0.20858,-2.26094 -0.26996,-2.32935 -0.13588,-0.15144 -0.58442,0.82294 -2.08397,4.52711 -2.01481,4.97699 -2.79643,6.54288 -3.82036,7.65371 -0.87044,0.94432 -3.13721,1.88044 -3.68648,1.52243 z"
++       style="fill:#f9f9f9;stroke-width:0.133635" />
++    <g
++       id="g957"
++       transform="translate(36.843901,36.777081)"
++       style="fill:#999999">
++      <path
++         style="fill:#999999;fill-opacity:1;stroke-width:0.264583"
++         d="m 118.48002,154.38963 c -0.21263,-0.77937 -0.60053,-0.53763 -3.77862,-0.53763 -4.23812,0 -4.51001,0.21718 -2.65413,-2.44723 2.45703,-3.52744 3.4906,-5.92399 2.80851,-6.96499 -0.4719,-0.72022 -1.01247,-0.62449 -1.92709,0.34127 -0.84859,0.89603 -1.86894,0.41779 -1.86894,-0.95587 0,-2.01205 2.80561,-3.99992 5.38938,-3.9922 1.61399,0.005 2.43642,0.4039 3.21581,1.56044 1.12027,1.66236 0.73145,3.8557 -1.134,6.39695 -1.54383,2.10311 -0.73385,3.61259 0.95572,1.78109 1.46292,-1.68793 1.55952,0.86073 1.49098,1.70283 -0.2309,2.69619 -2.07701,4.65709 -2.49762,3.11534 z"
++         id="path961"
++         inkscape:connector-curvature="0"
++         sodipodi:nodetypes="sscccscccccs" />
++    </g>
++  </g>
++</svg>

nixbld-etc-nixos/named/193thz.com

@@ -0,0 +1,29 @@
+$TTL 7200
+
+@						SOA	ns.193thz.com. sb.m-labs.hk. (
+							2024060201
+							7200
+							3600
+							86400
+							600)
+
+
+						NS		ns.193thz.com.
+						NS		ns1.he.net.
+
+						A		94.190.212.123
+						A		202.77.7.238
+						AAAA	2001:470:18:390::2
+						MX		10 mail.m-labs.hk.
+						TXT		"v=spf1 mx a:router.alt.m-labs.hk -all"
+						TXT		"google-site-verification=5eIjLyhM_siRg5Fc2Z3AMSbheH0JFOn5iR3TCEXakqU"
+						CAA		0 issue "letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/1758987512"
+
+
+ns						A		94.190.212.123
+ns						AAAA	2001:470:18:390::2
+
+mail._domainkey			TXT	"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC9T0cONxGXeyETE0bJ6NJVGT58fVFrfb+WxQhMskCN/mJhODyDTkRCjzE8ZnKhZGjkFZNG+PoSZlW+kpSS1LvMwzQpMRaH4zAzIexffR0l7rJR1MuQiVMsfGWpO2SLEuN74L2qH8SUBHZjrRpeSaFxwQm+prIOzZe5wTZStt/6qQIDAQAB"
+_dmarc					TXT	"v=DMARC1; p=none"
+
+www						CNAME	@

nixbld-etc-nixos/named/200-29.98.206.103.in-addr.arpa

@@ -0,0 +1,20 @@
+$TTL 7200
+
+@						SOA	NS.XN--WBTZ5WPQAJ35CFXC.XN--J6W193G. sb.m-labs.hk. (
+							2024060201
+							7200
+							3600
+							86400
+							600)
+
+
+						NS		NS.XN--WBTZ5WPQAJ35CFXC.XN--J6W193G.
+						NS		ns1.he.net.
+						CAA		0 issue "letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/1758987512"
+
+200	PTR	router.alt.m-labs.hk.
+201	PTR	stewardship1.alt.m-labs.hk.
+202	PTR	stewardship2.alt.m-labs.hk.
+203	PTR	atse.alt.m-labs.hk.
+204	PTR	nasty-gareth.alt.m-labs.hk.
+205	PTR	zynq.alt.m-labs.hk.

nixbld-etc-nixos/named/m-labs-intl.com

@@ -0,0 +1,31 @@
+$TTL 7200
+
+@						SOA	ns.m-labs-intl.com. sb.m-labs.hk. (
+							2024081503
+							7200
+							3600
+							86400
+							600)
+
+
+						NS		ns.m-labs-intl.com.
+						NS		ns1.he.net.
+						NS		ns1.qnetp.net.
+
+						A		5.78.86.156
+						AAAA	2a01:4ff:1f0:83de::1
+						MX		10 mail.m-labs-intl.com.
+						TXT		"v=spf1 mx -all"
+						TXT		"google-site-verification=BlQd5_5wWW7calKC7bZA0GdoxR8-zj4gwJEg9sGJ3l8"
+						CAA		0 issue "letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/1768317117"
+
+ns						A		94.190.212.123