wip: Dns bind forwarders dot#5545
Draft
bryanwieg wants to merge 5 commits into
Draft
Conversation
When the zones and records grids shared a tab, the bottom records table collapsed instead of honoring its row count — sometimes to barely one row tall. Give records a dedicated tab with full pane height, remove the now-redundant zone filter, and add proper pagination with pinned column widths. Co-Authored-By: Claude <noreply@anthropic.com>
Drop an unused CSS class and pin only Enabled and Commands, letting other columns auto-size to accommodate long zone names without wrapping. Co-Authored-By: Claude <noreply@anthropic.com>
The BIND plugin's DNSBL blocklists had been unmaintained since 2018 while Unbound's lists are updated regularly. Populate the DNSBL type dropdown dynamically from Unbound's XML model and replace dnsbl.sh with a Python fetcher that resolves shortcodes against Unbound's blocklists.conf template — both feed from the same source so Bind stays in sync without needing separate maintenance. Co-Authored-By: Claude <noreply@anthropic.com>
Author
|
I have submitted this pr now to invite any feedback or guidance from the maintainers. I still have to create an issue, and I also am in the process of more thoroughly testing these changes in a working environment. |
bryanwieg
force-pushed
the
dns-bind-forwarders-dot
branch
from
2292747 to
315470c
Compare
Enable DNS-over-TLS forwarders in the BIND GUI via a new Forwarder model and "DNS Forwarders" tab. DoT forwarders (ip + port + TLS hostname) use BIND 9.20 native TLS: Strict (RFC 9103) when a hostname is set, Opportunistic otherwise. Plain DNS forwarders with per-forwarder ports are also supported; both types pool via SRTT ordering. Model migration M1_0_13 converts the legacy general.forwarders CSV into the new grid. General model bumped to 1.0.13. AI disclosure: developed with assistance from Claude (Anthropic), model claude-sonnet-5. Co-Authored-By: Claude <noreply@anthropic.com>
Users who configure DNS-over-TLS forwarders expect their queries to stay encrypted. Without a "forward only" directive, BIND silently falls back to unencrypted recursive resolution when the DoT forwarder is unreachable, which defeats the privacy purpose of DoT. This adds a Forwarding Mode dropdown to the General tab with two options: Forward First — try forwarders, fall back to recursive resolution (default) Forward Only — only use forwarders; fail if none respond Implementation: - OptionField "forwarding" in General.xml with default "first" - Dropdown in general.xml form with help text noting the DoT interaction - Template emits "forward first;" or "forward only;" alongside forwarders - No migration needed: defaults to "first", matches existing BIND behavior Co-Authored-By: Claude <noreply@anthropic.com>
bryanwieg
force-pushed
the
dns-bind-forwarders-dot
branch
from
315470c to
2c4fd3f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Important notices
Before you submit a pull request, we ask you kindly to acknowledge the following:
If AI was used, please disclose:
Describe the problem
BIND 9.20 supports native DNS-over-TLS forwarders with both Strict (RFC 9103) and Opportunistic TLS, but the plugin had no GUI support for configuring them. Per-forwarder destination ports were also unavailable — the legacy forwarders field was a flat CSV with no per-row configuration.
While working in this area, two other issues surfaced: the DNSBL blocklists had been unmaintained since 2018 while Unbound's equivalents are actively updated, and the primary zones/records grids had layout problems.
Describe the proposed solution
Related issue
Closes #5546