Introduce PowerDnsWriter for zone synchronization to PowerDNS

[qrtp]

Introduce a new DNS writer package that can forward zone changes to a PowerDNS backend. Leverages the PowerDNS API to manage records, with full support for DNSSEC and TSIG key management.

An older version of this PR has been closed by the author.

Background

At Unstoppable Domains we use PowerDNS as the backend for DNS zones and DNSSEC management. We've created a Nomulus plugin to facilitate synchronization with PowerDNS, that we believe would be useful for the Nomulus community at large.

Usage

In order to use the new PowerDnsWriter, a TLD must be created with a PowerDnsWriter specified in the dnsWriters stanza of the TLD configuration yaml.

dnsWriters:
- "PowerDnsWriter"

The PowerDNS config can be modified in the main config package within the files/power-dns directory. Environmental overrides are handled modularly for PowerDNS similar to the main config. For example, the default config shows the available options for the PowerDNS settings, which can be customized per environment using one of the files/power-dns/env-* files. The config structure is show below for reference:

powerDns:
  baseUrl: http://localhost:8081/api/v1
  apiKey: example-api-key
  dnssecEnabled: false
  tsigEnabled: true
  rootNameServers:
  - ns1.example.com.
  - ns2.example.com.
  soaName: nstld.example.com.

DNSSEC

If enabled, the PowerDnsWriter will ensure a TLD is properly configured with a KSK and ZSK and use them to sign zone records. The ZSK will be automatically rotated on a monthly basis. The Nomulus registry operator must still take the manual step to publish the KSK DS record to the parent root server(s) to establish a chain of trust. The DS value(s) to publish are available in the Nomulus GAE logs, or can be retrieved from the PowerDNS command line.

TSIG

If enabled, the PowerDnsWriter will establish a TSIG configuration for each managed TLD to facilitate secure zone replication. If zone replication is desired, the TSIG key needs to be manually retrieved from the PowerDNS command line and shared with the secondary DNS server.

PowerDNS configuration

Consult the PowerDNS documentation to setup your own instance. The key requirement is to ensure the PowerDNS API server is enabled and accessible from your Nomulus environment.

SSL

SSL connections are not directly supported from PowerDNS. As a security best practice, we suggest using Nginx to terminate SSL and proxy requests to the PowerDNS backend.

Private VPC

Due to the sensitive nature of the PowerDNS API, we suggest using a private VPC that is shared between the PowerDNS host and the Nomulus instance. This network pattern allows Nomulus to communicate with the PowerDNS API while shielding it from the public Internet traffic.

---

This change is 

[weiminyu]

Reviewed 4 of 31 files at r1.
Reviewable status: 4 of 31 files reviewed, 6 unresolved discussions

---

core/src/main/java/google/registry/dns/writer/powerdns/resources/openAPI.yaml line 1398 at r1 (raw file):

      result:
        type: string
        description: 'A message about the result like "Flushed cache"'

Missing a trailing newline.

Please run gradlew spotlessApply to update this and other files.

---

core/src/main/java/google/registry/dns/writer/powerdns/client/PowerDNSClient.java line 47 at r1 (raw file):

 * <p>The API key is retrieved from the environment variable {@code POWERDNS_API_KEY}.
 */
public class PowerDNSClient {

Can visibility be reduced to package-protected?

Code quote:

public

---

core/src/main/java/google/registry/dns/writer/powerdns/client/PowerDNSClient.java line 98 at r1 (raw file):

      if (requestBody != null) requestBody.writeTo(buffer);
      else return "";
      return buffer.readUtf8();

Our style guide requires braces. Please run gradlew :core:checkStyleMain.

Code quote:

      if (requestBody != null) requestBody.writeTo(buffer);
      else return "";
      return buffer.readUtf8();

---

core/src/main/java/google/registry/module/RegistryComponent.java line 66 at r1 (raw file):

      CloudTasksUtilsModule.class,
      ConfigModule.class,
      PowerDnsConfigModule.class,

Please pull from upstream and update the new DnsWritersModule introduced in pr 2769.

---

core/src/main/java/google/registry/config/RegistryConfig.java line 95 at r1 (raw file):

   * and those values merged into the POJO.
   */
  static RegistryConfigSettings getConfigSettings() {

Please keep getConfigSettings as a shorthand to the new method using default files.

Code quote:

 getConfigSettings() {

---

core/src/main/java/google/registry/dns/writer/powerdns/PowerDnsWriter.java line 52 at r1 (raw file):

 * This request is then converted into a PowerDNS Zone object and sent to the PowerDNS API.
 */
public class PowerDnsWriter extends DnsUpdateWriter {

Is package-protected access sufficient?

Code quote:

public