Commit aadc9bbf21ed

@@ -0,0 +1,41 @@
+options {
+    directory "/var/bind";
+    listen-on { any; };
+    listen-on-v6 { any; };
+    allow-query { any; };
+    forwarders {
+        8.8.8.8;
+        8.8.4.4;
+    };
+    dnssec-validation no;
+};
+
+zone "sbr.pm" {
+    type master;
+    file "/etc/bind/zones/db.sbr.pm";
+};
+
+zone "home" {
+    type master;
+    file "/etc/bind/zones/db.home";
+};
+
+zone "192.168.1.in-addr.arpa" {
+    type master;
+    file "/etc/bind/zones/db.192.168.1";
+};
+
+zone "demeester.fr" {
+    type master;
+    file "/etc/bind/zones/db.demeester.fr";
+};
+
+zone "vpn" {
+    type master;
+    file "/etc/bind/zones/db.vpn";
+};
+
+zone "10.100.0.in-addr.arpa" {
+    type master;
+    file "/etc/bind/zones/db.10.100.0";
+};

@@ -0,0 +1,12 @@
+listener 1883 0.0.0.0
+allow_anonymous false
+password_file /run/secrets/mosquitto-password
+
+# Logging
+log_dest syslog
+log_type warning
+log_type error
+log_type notice
+
+# Persistence (in-memory only on diskless)
+persistence false

@@ -0,0 +1,5 @@
+auto lo
+iface lo inet loopback
+
+auto eth0
+iface eth0 inet dhcp

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> piv-p256 ItIHHA AocsMVrW8vclPmy0V2zlKuGJpLtie76s+qcPZXfR93CU
+/9DZ8gsMBY2pSLaKaO6dQ0/hBI/ShajRCmbfdoX6eFI
+-> piv-p256 cUinNw Ar905PIDTJdSzE2b/dY7vSgIyrMigAFVFZhSQ6/91AlT
+QMBwADqkwAC+UbiUgsJD/1weA6FjVNhlFf4YpSeho9g
+-> ssh-ed25519 gecXFg SgJK1pd3JOZ0ExdRGpqUTJlfRAcFPvP2yeo2tDDO+U4
+/b6ZJCjUXg4y6+nwWwTgOlOCnGY1nXgeke2EEoB1G6Q
+--- h1iTgopcgE89YuRMpnysSKkm0wI3vm0bTVnlNi2ik5A
+^j�wY*Xě�,�������kI�����<S��[u�ȏ��
\ No newline at end of file

@@ -0,0 +1,3 @@
+OWNER=mosquitto
+GROUP=mosquitto
+MODE=400

@@ -0,0 +1,2 @@
+# Persistent partition for SSH host key, WireGuard key, seedrng
+LABEL=persist   /persist   ext4   noatime,ro   0 0

@@ -0,0 +1,1 @@
+demeter

@@ -0,0 +1,8 @@
+# DNS
+bind
+bind-tools
+
+# MQTT
+mosquitto
+
+# TODO: prometheus-bind-exporter not in Alpine repos — need static binary

@@ -0,0 +1,37 @@
+#!/bin/sh
+# Demeter-specific setup
+
+# Enable DNS services
+rc-update add named default
+
+# Enable MQTT broker
+rc-update add mosquitto default
+
+# Create mosquitto password file init script
+# (converts plain password from age secret to hashed password file)
+cat > /etc/init.d/mosquitto-password << 'INITEOF'
+#!/sbin/openrc-run
+description="Generate mosquitto password file from decrypted secret"
+
+depend() {
+    after secrets
+    before mosquitto
+}
+
+start() {
+    local plain="/run/secrets/mosquitto-homeassistant-password"
+    local pwfile="/run/secrets/mosquitto-password"
+    if [ ! -f "$plain" ]; then
+        ewarn "Mosquitto password secret not found"
+        return 0
+    fi
+    ebegin "Generating mosquitto password file"
+    printf 'homeassistant:%s\n' "$(cat "$plain")" > "$pwfile"
+    mosquitto_passwd -U "$pwfile"
+    chown mosquitto:mosquitto "$pwfile"
+    chmod 400 "$pwfile"
+    eend $?
+}
+INITEOF
+chmod +x /etc/init.d/mosquitto-password
+rc-update add mosquitto-password default