|David Blacka 169631ac4c|
zeke.ecotroph.net DNS service
This repo and directory consists of the revamped DNS service for
zeke.ecotroph.net. The goals of this service are:
- Host the primary zones we want.
- DNSSEC-sign those primary zones, if desired.
- Provide local recursive service for the host itself.
In the past, we just ran the version of BIND that came with our distribution (at this moment, that is CentOS 7, which translates to bind 9.11.) This new configuration runs a very recent version of BIND 9 via a docker image produced by ISC themselves. We started with 9.18.12 and now are up to 9.18.20.
This docker image imposes a few requirements:
- Internally, the image runs
binduser (104:105). Since we bind-mount directories, we do need those directories owned by whatever internal UID it is using.
- We need some way to ensure that our container is run on system reboots, etc. Here we chose to use
systemdto do this, although that is not ideal.
- Presumably the normal way to do logging for a docker container is to use the standard journal service, although this image is set up to bind-mount
/var/log. On the other hand, the standard command uses the
-gflag, which is "debug" mode, and causes all of the logs to go to stderr.
- We do want named to stay in the foreground here. Fortunately, there have always been command line options that do this (
-f). Thus, in order to log to
/var/log, we supply a different command:
/usr/sbin/named -f -4 -u bind. This will run in the foreground, only do IPv4 (
zekedoes not yet have IPv6 connectivity), and run as the internal
I have this in a local git repository on
zeke, however we can see it here: https://blacka.com/git/docker_bind.git.
We have in this repo:
- named configurations. I've broken this up into sections (options, keys, logging, primary, secondary, etc.), which all just get included in the primary named.conf. It isn't tricky.
- "keys". Well, mostly TSIG keys. Those are encrypted with
git-crypt. With a key that is ... somewhere. I've saved it in my password manager, but it can be extracted from the current checkout in
cd /etc/bind; git-crypt export-key /tmp/docker_bind_crypto.key.
git-cryptdoesn't seem to come via RPM and yum, but I built it and installed it into
- zone files. I have all of the zone files we started with, although currently the configuration does not load all of them.
- A script to launch the container (
- A script to use as the internal "command" (
cfg/run.sh) -- it isn't config, but we need to bind-mount it. It could possibly be moved to
- A helper script to run
rndcthat just runs that inside the container itself (via a docker exec). You would need to be in the
dockergroup to run it. Another few helper scripts to run other command line tools:
- A helper script to prepare
zeketo run this container and properly work, in case we want to do this install again (
- Clone this repo to
/etc-- we want the working copy to be
- Create a user to match the internal user (
useradd -u 104 -g 105 -M --no-log-init bind
- Change the ownership of everything under
binduser and group:
chown -R 104:105 /etc/bind.
- Copy the supplied
systemdunit file to
systemctl enable docker.bind.service, then
systemctl start docker.bind.service.
All of our zone files are now in this git repo, so we can just make changes and commit them, assuming you have write access to the local repo, that is. The
bind user should be able to do it, though. Once you've changed your zone, you could bounce the service via
systemctl, or we could use
rndc. I've made a little script that will do this with
sudo -u bind -s cd /etc/bind/zones vi <zonefile> # remember to update the serial git commit -a <zonefile> git push cd .. ./run_rndc.sh reload <zone>
More modern BIND releases have changed the configuration for this. Note how your zone is signed is based on a
dnssec-policy block (I've put those in
cfg/named.dnssec.conf). Then, in your zone, you add:
dnssec-policy "default_alg13"; inline-signing yes;
in your zone block. After restarting/reconfiguring BIND, it will create a
<zonefile>.signed.jnl file, and start serving a DNSSEC signed version of the zone. It will then take care of resigning activities, key rollovers etc.
We can find the zone files on
/etc/bind/zones, although note that your zone may be in BIND's raw format. If you want to see the contents, you can use
named-compilezone for that (either using a version inside the container or not):
named-compilezone -f raw -F text -o - blacka.com /etc/bind/zones/blacka.com.signed