disable the chatty query channel

Remove jabber/xmpp SRV records -- we don't run that anymore

cfg/named.logging.conf

@@ -23,6 +23,12 @@ logging {
         print-severity yes;
         print-time iso8601-utc;
     };
+    channel "query" {
+        file "/var/log/named/queries.log" versions 6 size 1M suffix increment;
+        print-category yes;
+        print-severity yes;
+        print-time iso8601-utc;
+    };
     channel "default" {
         file "/var/log/named/named.log";
         print-category yes;
@@ -37,4 +43,5 @@ logging {
     category config { default; };
     category notify { xfr-out; };
     category zoneload { default; };
+    // category queries { query; };
 };

cfg/named.options.conf

@@ -7,9 +7,7 @@ options {
 
     listen-on { any; };    
     listen-on-v6 { ::1; };
-    # hopefully the default docker bridge network
+    allow-recursion { 127.0.0.1; ::1; };
-    # is consistently in 172.17.0.0/24
-    allow-recursion { 127.0.0.1; ::1; 172.17.0.0/24; };
 
 	dnssec-validation yes;
 };

cfg/named.primary.conf

@@ -6,14 +6,18 @@ zone "blacka.com" {
 
     notify yes;
     also-notify {
-        66.92.146.115;
+        45.79.181.51;   // typhoon.kahlerlarson.org
-        204.109.61.194;
+        104.225.12.28;  // keilir.ogud.com
+        66.92.146.115;  // foss.ogud.com
+        204.109.61.194; // katla.ogud.com
     };
     allow-transfer {
         127.0.0.1;
-        key zeke-tornado.;
+        45.79.181.51;  // typhoon.kahlerlarson.lorg
-        key zeke-ogud2.;
+        104.225.12.28;  // keilir.ogud.com
-        key zeke-ogud3;
+        // key zeke-tornado.;
+        // key zeke-ogud2.;
+        // key zeke-ogud3;
     };
 };
 
@@ -26,6 +30,8 @@ zone "ecotroph.net" {
     notify yes;
     allow-transfer {
         127.0.0.1;
+        45.79.181.51;  // typhoon.kahlerlarson.lorg
+        104.225.12.28;  // keilir.ogud.com
         key zeke-tornado.;
         key zeke-ogud2.;
         key zeke-ogud3;

docker.named.service

@@ -8,7 +8,8 @@ TimeoutStartSec=0
 Restart=always
 ExecStartPre=-/usr/bin/docker stop bind9
 ExecStartPre=-/usr/bin/docker rm bind9
-ExecStartPre=/usr/bin/docker pull docker.io/internetsystemsconsortium/bind9:9.18
+# note: this container is actually provding DNS service, so when that is missing, the pull fails.
+# ExecStartPre=/usr/bin/docker pull docker.io/internetsystemsconsortium/bind9:9.18
 ExecStart=/etc/bind/run_bind_container.sh
 
 [Install]

run_bind_container.sh

@@ -1,8 +1,6 @@
 #! /bin/bash
-
 BASE_CONF_DIR=/etc/bind
-: "${DNS_PORT:=55}"  # non-production default
+
-: "${RNDC_PORT:=955}"  # non-produciton default
 CMD="/etc/bind/run.sh"
 [ "$1" = "interactive" ] && ARGS="-ti --entrypoint=/bin/bash" && CMD=""
 
@@ -10,12 +8,25 @@ CMD="/etc/bind/run.sh"
 docker run $ARGS \
     --rm \
     --name=bind9 \
-    --add-host=host.docker.internal:host-gateway \
+    --network=host \
-    --publish "$RNDC_PORT:953/tcp" \
-    --publish "$DNS_PORT:53/udp" \
-    --publish "$DNS_PORT:53/tcp" \
     -v $BASE_CONF_DIR/cfg:/etc/bind \
     -v $BASE_CONF_DIR/cache:/var/cache/bind \
     -v $BASE_CONF_DIR/zones:/var/lib/bind \
     -v $BASE_CONF_DIR/log:/var/log \
     docker.io/internetsystemsconsortium/bind9:9.18 $CMD
+
+# using bridge networking
+# : "${DNS_PORT:=53}"
+# : "${RNDC_PORT:=953}"
+# docker run $ARGS \
+#     --rm \
+#     --name=bind9 \
+#     --add-host=host.docker.internal:host-gateway \
+#     --publish "$RNDC_PORT:953/tcp" \
+#     --publish "$DNS_PORT:53/udp" \
+#     --publish "$DNS_PORT:53/tcp" \
+#     -v $BASE_CONF_DIR/cfg:/etc/bind \
+#     -v $BASE_CONF_DIR/cache:/var/cache/bind \
+#     -v $BASE_CONF_DIR/zones:/var/lib/bind \
+#     -v $BASE_CONF_DIR/log:/var/log \
+#     docker.io/internetsystemsconsortium/bind9:9.18 $CMD

zones/blacka.com

@@ -1,14 +1,14 @@
 $ORIGIN .
 $TTL 3600	; 1 hour
 blacka.com		IN SOA	ns1.blacka.com. david.blacka.com. (
-				100053     ; serial
+				100054     ; serial
 				43200      ; refresh (12 hours)
 				3600       ; retry (1 hour)
 				2592000    ; expire (30 days)
 				86400      ; minimum (1 day)
 				)
 			NS	ns1.blacka.com.
-			NS	twister.kahlerlarson.org.
+			NS	typhoon.kahlerlarson.org.
 			NS	keilir.ogud.com.
 			A	70.164.19.155
 ; mail handled by google (google apps for business standard)

zones/ecotroph.net

@@ -1,6 +1,6 @@
 $TTL	1D
 @	IN	SOA	zeke.ecotroph.net. anewton.ecotroph.net. (
-			201501020;	Serial
+			202302270;	Serial
 			8H;			Refresh
 			2H;			Retry
 			1W;			Expire
@@ -9,7 +9,7 @@ $TTL	1D
 		TXT "v=spf1 a mx ip4:64.151.105.12 a:cliffie.verisignlabs.com -all"
 		NS	zeke
 		NS	ns.ogud.com.
-		NS	tornado.kahlerlarson.org.
+		NS	typhoon.kahlerlarson.org.
 		MX	10 zoidberg
 		A	70.164.19.155
 
@@ -37,11 +37,11 @@ zoidberg A	70.164.19.156
 zelda	 A	70.164.19.157
 
 zilch	A	64.83.8.178
-_xmpp-client._tcp SRV 5 0 5222 @
+;;_xmpp-client._tcp SRV 5 0 5222 @
-_jabber-client._tcp SRV 5 0 5222 @
+;;_jabber-client._tcp SRV 5 0 5222 @
-_jabber-ssl-client._tcp SRV 5 0 5223 @
+;;_jabber-ssl-client._tcp SRV 5 0 5223 @
-_xmpp-server._tcp SRV 5 0 5269 @
+;;_xmpp-server._tcp SRV 5 0 5269 @
-_jabber._tcp SRV 5 0 5269 @
+;;_jabber._tcp SRV 5 0 5269 @
 ;;_xmpp-server._tcp.yahoo SRV 5 0 5235 @
 
 ; reverse DNS entries from ZUBR