silentmode/argus
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

install.ps1: NRPT rules for all BNS-native TLDs (.bch .p2p .bit .nav)

Browse source 
Was only .bch. The daemon and CA already handle these four TLDs; the NRPT
rule was the missing piece that made .p2p / .bit / .nav queries never reach
the daemon at all (they went to ICANN's normal DNS and NXDOMAIN'd).

Dual TLDs (.de .ru .dev .ltd) intentionally NOT here. They need the
daemon's DNS-forwarding path to work reliably for unregistered names,
and there's still an open EDNS/AAAA forwarding bug in bnsd.js that
would break most German/Russian sites if we NRPT'd .de.

Adding more native TLDs (.x .sia .dgb .nt from Theseus's expanded set)
needs a CA rotation first — the current CA's nameConstraints only permit
bch/p2p/bit/deviant/nav/test/bcnr. Deferred.
This commit is contained in:
Local Dev 2026-07-31 08:43:31 +02:00
parent 83bff76960
commit 6ff181b6c2
1 changed files with 11 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
setup/install.ps1
View file

@ -72,8 +72,17 @@ if (Test-Path $s3d) {
# 2) Route queries to it
$state = @{ mode = $Mode; adapters = @() }
if ($Mode -eq "nrpt") {
Add-DnsClientNrptRule -Namespace ".bch" -NameServers "127.0.0.1" -Comment "BNS .bch resolver"
Write-Host "[ok] NRPT rule added: .bch -> 127.0.0.1 (all other DNS untouched)"
# One NRPT rule per BNS-native TLD. These have no ICANN presence, so routing
# them to the local daemon carries no risk of hijacking real sites. Dual TLDs
# (.de, .ru, .dev, .ltd) are deliberately NOT here -- they need the daemon's
# DNS-forwarding path, which currently has an EDNS/AAAA bug that makes some
# strict clients reject the forwarded reply. Add those only after that fix.
$NATIVE_TLDS = @(".bch", ".p2p", ".bit", ".nav")
foreach ($tld in $NATIVE_TLDS) {
Add-DnsClientNrptRule -Namespace $tld -NameServers "127.0.0.1" -Comment "BNS $tld resolver"
Write-Host "[ok] NRPT rule added: $tld -> 127.0.0.1"
}
Write-Host "[ok] all other DNS untouched"
} else {
# Reinstall-safe backup: if the machine is ALREADY pointed at us (127.0.0.1) from a
# prior install, the "current" servers are a useless restore target. Reuse the last