From 6ff181b6c2624497b2a58d2c591674f6a269e732 Mon Sep 17 00:00:00 2001 From: Local Dev Date: Fri, 31 Jul 2026 08:43:31 +0200 Subject: [PATCH] install.ps1: NRPT rules for all BNS-native TLDs (.bch .p2p .bit .nav) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Was only .bch. The daemon and CA already handle these four TLDs; the NRPT rule was the missing piece that made .p2p / .bit / .nav queries never reach the daemon at all (they went to ICANN's normal DNS and NXDOMAIN'd). Dual TLDs (.de .ru .dev .ltd) intentionally NOT here. They need the daemon's DNS-forwarding path to work reliably for unregistered names, and there's still an open EDNS/AAAA forwarding bug in bnsd.js that would break most German/Russian sites if we NRPT'd .de. Adding more native TLDs (.x .sia .dgb .nt from Theseus's expanded set) needs a CA rotation first — the current CA's nameConstraints only permit bch/p2p/bit/deviant/nav/test/bcnr. Deferred. --- setup/install.ps1 | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/setup/install.ps1 b/setup/install.ps1 index d89cac5..bbc03a6 100644 --- a/setup/install.ps1 +++ b/setup/install.ps1 @@ -72,8 +72,17 @@ if (Test-Path $s3d) { # 2) Route queries to it $state = @{ mode = $Mode; adapters = @() } if ($Mode -eq "nrpt") { - Add-DnsClientNrptRule -Namespace ".bch" -NameServers "127.0.0.1" -Comment "BNS .bch resolver" - Write-Host "[ok] NRPT rule added: .bch -> 127.0.0.1 (all other DNS untouched)" + # One NRPT rule per BNS-native TLD. These have no ICANN presence, so routing + # them to the local daemon carries no risk of hijacking real sites. Dual TLDs + # (.de, .ru, .dev, .ltd) are deliberately NOT here -- they need the daemon's + # DNS-forwarding path, which currently has an EDNS/AAAA bug that makes some + # strict clients reject the forwarded reply. Add those only after that fix. + $NATIVE_TLDS = @(".bch", ".p2p", ".bit", ".nav") + foreach ($tld in $NATIVE_TLDS) { + Add-DnsClientNrptRule -Namespace $tld -NameServers "127.0.0.1" -Comment "BNS $tld resolver" + Write-Host "[ok] NRPT rule added: $tld -> 127.0.0.1" + } + Write-Host "[ok] all other DNS untouched" } else { # Reinstall-safe backup: if the machine is ALREADY pointed at us (127.0.0.1) from a # prior install, the "current" servers are a useless restore target. Reuse the last