Add README.md, unit file

diff --git a/README.md b/README.md
new file mode 100644 (file)
index 0000000..af3ae77
--- /dev/null
+++ b/README.md
@@ -0,0 +1,65 @@
+# zeke.ecotroph.net DNS service
+
+This repo and directory consists of the revamped DNS service for zeke.ecotroph.net.  The goals of this service are:
+
+1. Host the primary zones we want.
+2. DNSSEC-sign those primary zones, if desired.
+3. Provide local recursive service for the host itself.
+
+## Overview
+
+In the past, we just ran the version of BIND that came with our distribution (at this moment, that is CentOS 7, which translates to bind 9.11.)  This system runs a recent version of BIND 9 via a docker image produced by ISC themselves.  We are staring with 9.18.
+
+This docker image imposes a few requirements:
+
+* Interally, the image runs `named` as the `bind` user, (104:105) by default.  Since we bind-mount directories, we do need those directories owned by whatever internal UID it is using.
+* We need some way to ensure that our container is run on system reboots, etc.  Here we chose to use `systemd` to do this, although that is not ideal.
+* Presumably the normal way to do logging for a docker container is to use the standard journal service, however, this image is set up to bind-mount `/var/log` anyway.  On the other hand, the standard command uses the `-g` flag, which is "debug" mode, and causes all of the logs to go to stderr.
+* We do want named to stay in the foreground here.  Fortunately, there have always been command line options that do this (`-g` and `-f`).
+
+## Source
+
+I have this in a local git repository on zeke, however we can see it (sort of) here: <https://blacka.com/cgi-bin/gitweb.cgi?p=docker_bind.git;a=tree> (athough the viewer here is subject to change, and when that does, the URL will change.)
+
+## Design
+
+We have in this repo:
+
+* named configurations.  I've broken this up into sections (options, keys, logging, primary, secondary, etc.), which all just get included in the primary named.conf.  It isn't tricky.
+* "keys".  Well, mostly TSIG keys.  Those are are but are encrypted with `git-crypt`.  With a key that is ... somewhere.
+* zone files.  I have all of the zone files we started with, although currently the configuration does not load all of them.
+* A script to launch the container
+* A script to use as the internal "command" (`cfg/run.sh`) -- it isn't config, but we need to bind-mount it.
+* A helper script to run `rndc` that just runs that inside the container itself (via a docker exec).  You would need to be in the `docker` group to run it.
+* A helper script to prepare zeke to run this container and properly work, in case we want to do this install again.
+
+## Installation
+
+1. Clone this repo to `/etc/bind`
+2. Create a user to match the internal user (uid 104): `useradd -u 104 -g 105 -M --no-log-init bind`
+3. Change the ownership of everything under `/etc/bind` to the `bind` user and group: `chown -R 104:105 /etc/bind`.
+3. Copy the supplied systemd unit file to /etc/systemd/system, and `systemctl enable docker.bind.service`, then `systemctl start docker.bind.service`.
+
+## Zone Changes
+
+All of our zone files are now in this git repo, so we can just make changes and commit them, assuming you have write access to the local repo, that is.  Root certainly does, though.  Once you've changed your zone, you *could* bounce the service via systemctl, or we could use `rndc`.  I've made a little script that will do this with `docker exec`, `/etc/bind/run_rndc.sh`.  Thus:
+
+```bash
+cd /etc/bind/zones
+vi <zonefile> # remember to update the serial
+git commit -a <zonefile>
+git push
+cd ..
+./run_rndc.sh reload <zone>
+```
+
+## DNSSEC
+
+More modern BIND releases have changed the configuration for this.  Now, *how* your zone is signed is based on a `dnssec-policy` block (I've put those in `cfg/named.dnssec.conf`).  Then, in your zone, you add:
+
+```
+  dnssec-policy "simple_alg15";
+  inline-signing yes;
+```
+
+in your zone block.  After restarting/reconfiguring BIND, it will create a <zonefile>.signed and <zonefile>.signed.jnl file, and start serving a DNSSEC signed version of the zone.  It will then take care of resigning activities, key rollovers etc.  Although the policy I'm starting with has just a single DNSKEY with an unlimited lifetime.

diff --git a/cfg/run.sh b/cfg/run.sh
index e47dbe1..13786bf 100755 (executable)
--- a/cfg/run.sh
+++ b/cfg/run.sh
@@ -1,3 +1,5 @@
 #! /bin/bash
-useradd -u 1005 -M davidb
-exec /usr/sbin/named -g -4 -u davidb
+# run in the forground, but not in debug-mode
+# use IPv4 only -- if zeke ever gets IPv6 access, we can turn that on
+# use the built-in `bind` user
+exec /usr/sbin/named -f -4 -u bind

diff --git a/docker.named.service b/docker.named.service
new file mode 100644 (file)
index 0000000..422319d
--- /dev/null
+++ b/docker.named.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=BIND9 Container
+After=docker.service
+Requires=docker.service
+
+[Service]
+TimeoutStartSec=0
+Restart=always
+ExecStartPre=-/usr/bin/docker stop bind9
+ExecStartPre=-/usr/bin/docker rm bind9
+ExecStartPre=/usr/bin/docker pull docker.io/internetsystemsconsortium/bind9:9.18
+ExecStart=/etc/bind/run_bind_container.sh
+
+[Install]
+WantedBy=multi-user.target
\ No newline at end of file

diff --git a/run_bind.sh b/run_bind_container.sh
similarity index 87%
rename from run_bind.sh
rename to run_bind_container.sh
index fa30089..deaba3e 100755 (executable)
--- a/run_bind.sh
+++ b/run_bind_container.sh
@@ -2,8 +2,8 @@
 
 #BASE_CONF_DIR=/etc/bind
 BASE_CONF_DIR=/home/davidb/src/docker_bind
-: "${DNS_PORT:=53}"
-: "${RNDC_PORT:=953}"
+: "${DNS_PORT:=55}"  # non-production default
+: "${RNDC_PORT:=955}"  # non-produciton default
 CMD="/etc/bind/run.sh"
 [ "$1" = "interactive" ] && ARGS="-ti --entrypoint=/bin/bash" && CMD=""