A containerized DNS server powered by BIND.
This project consists of two components:
- The DNS Recursor - By default, this component forwards queries to upstream DNS servers and caches their responses
- The DNS Nameserver - This component is a slightly different configuration of bind that functions as exclusively as an authoritative name server
- BIND SHOULD NOT simultaneously operate as a recursor and an authoritative name server - this is why the project consists of two components rather than one
To communicate between components bind needs a key to authenticate those communications. An RNDC key will be generated automatically at /etc/bind/rndc/rndc.key if one isn't found at startup. A new key can be generated at any time using the rndc-confgen command. Keys can be shared by mounting the containers at a shared volume at the time of deployment.
docker-compose.yml:
version: '3.3'
services:
...
recursor:
volumes:
- rndc_shared_key:/etc/bind/rndc/
...
nameserver:
volumes:
- rndc_shared_key:/etc/bind/rndc/
volumes:
rndc_shared_key:
driver: local
While you can turn off DNSSEC Validation the BIND_RECURSOR_DNSSEC_VALIDATION environment variable on the recursor, I'd leave this parameter alone. I use it only intesting.
On the recursor, set the BIND_NAMESERVER_IP to point to the host IP of the machine which runs your authoritative nameserver. If you're running the nameserver on the same host as the recursor then you can grab the host IP programmatically with scripts/hostIP.py.
To configure the name server, you need to override /etc/bind/local with a volume containing your local configuration, options, and zone files.
There are some secrets in this repository, like the zonefiles that I'm using in production. To see those secrets use git secrets reveal. You will need to have the necessary permission to reveal secrets, however.
It's possible to deploy to a target environment from within the devcontainer. Prior to loading the devcontainer, one must add the private ssh key for the target environment to the local ssh-agent.
NOTE:
The d 683E eployment script currently contains secrets and is hidden from the repository. To reveal the deployment script, use
git secret reveal.
On the local environment:
- Create an ssh key for the target environment
- Use
ssh-add $HOME/.ssh/private_keyto add the private key to your ssh-agent.
ssh user@example.com- This should succeed
You will need a GitLab Deploy Token to pull images from the private container registry. See: https://docs.gitlab.com/ee/user/project/deploy_tokens/index.html