-
Notifications
You must be signed in to change notification settings - Fork 284
Introduce PowerDnsWriter for zone synchronization to PowerDNS #2758
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Create a PowerDNS writer
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
Update console server for environment-aware assets and dispatch rules
The PowerDNS writer is now being managed in the source repository as a feature branch. Closing this PR and opening a new one based upon the new branch. |
Introduce a new DNS writer package that can forward zone changes to a PowerDNS backend. Leverages the PowerDNS API to manage records, with full support for DNSSEC and TSIG key management.
Background
At Unstoppable Domains we use PowerDNS as the backend for DNS zones and DNSSEC management. We've created a Nomulus plugin to facilitate synchronization with PowerDNS, that we believe would be useful for the Nomulus community at large.
Usage
In order to use the new PowerDnsWriter, a TLD must be created with a
PowerDnsWriter
specified in thednsWriters
stanza of the TLD configuration yaml.The PowerDNS config can be modified in the main environment config files. For example, the default config shows the available options for the PowerDNS settings, which can be customized per environment.
DNSSEC
If enabled, the PowerDnsWriter will ensure a TLD is properly configured with a KSK and ZSK and use them to sign zone records. The ZSK will be automatically rotated on a monthly basis. The Nomulus registry operator must still take the manual step to publish the KSK
DS
record to the parent root server(s) to establish a chain of trust. TheDS
value(s) to publish are available in the Nomulus GAE logs, or can be retrieved from the PowerDNS command line.TSIG
If enabled, the PowerDnsWriter will establish a TSIG configuration for each managed TLD to facilitate secure zone replication. If zone replication is desired, the TSIG key needs to be manually retrieved from the PowerDNS command line and shared with the secondary DNS server.
PowerDNS configuration
Consult the PowerDNS documentation to setup your own instance. The key requirement is to ensure the PowerDNS API server is enabled and accessible from your Nomulus environment. An SSL connection is not directly supported from PowerDNS, and we suggest using Nginx to terminate SSL and proxy requests to the PowerDNS backend.
This change is