Skip to content

Introduce PowerDnsWriter for zone synchronization to PowerDNS #2758

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 25 commits into from

Conversation

qrtp
Copy link

@qrtp qrtp commented May 21, 2025

Introduce a new DNS writer package that can forward zone changes to a PowerDNS backend. Leverages the PowerDNS API to manage records, with full support for DNSSEC and TSIG key management.

Background

At Unstoppable Domains we use PowerDNS as the backend for DNS zones and DNSSEC management. We've created a Nomulus plugin to facilitate synchronization with PowerDNS, that we believe would be useful for the Nomulus community at large.

Usage

In order to use the new PowerDnsWriter, a TLD must be created with a PowerDnsWriter specified in the dnsWriters stanza of the TLD configuration yaml.

dnsWriters:
- "PowerDnsWriter"

The PowerDNS config can be modified in the main environment config files. For example, the default config shows the available options for the PowerDNS settings, which can be customized per environment.

powerDns:
  baseUrl: http://localhost:8081/api/v1
  apiKey: example-api-key
  dnssecEnabled: false
  tsigEnabled: true
  rootNameServers:
  - ns1.example.com.
  - ns2.example.com.
  soaName: nstld.example.com.

DNSSEC

If enabled, the PowerDnsWriter will ensure a TLD is properly configured with a KSK and ZSK and use them to sign zone records. The ZSK will be automatically rotated on a monthly basis. The Nomulus registry operator must still take the manual step to publish the KSK DS record to the parent root server(s) to establish a chain of trust. The DS value(s) to publish are available in the Nomulus GAE logs, or can be retrieved from the PowerDNS command line.

TSIG

If enabled, the PowerDnsWriter will establish a TSIG configuration for each managed TLD to facilitate secure zone replication. If zone replication is desired, the TSIG key needs to be manually retrieved from the PowerDNS command line and shared with the secondary DNS server.

PowerDNS configuration

Consult the PowerDNS documentation to setup your own instance. The key requirement is to ensure the PowerDNS API server is enabled and accessible from your Nomulus environment. An SSL connection is not directly supported from PowerDNS, and we suggest using Nginx to terminate SSL and proxy requests to the PowerDNS backend.


This change is Reviewable

Copy link

google-cla bot commented May 21, 2025

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@qrtp
Copy link
Author

qrtp commented Jun 3, 2025

The PowerDNS writer is now being managed in the source repository as a feature branch. Closing this PR and opening a new one based upon the new branch.

#2764

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant