fediversity/fediversity
Watch
19
2
Fork
You've already forked fediversity
 10
Code Issues 86 Pull requests 20 Projects Activity Actions

reproduce DNS VM #200

New issue
Open
opened 2025-02-24 15:03:19 +01:00 by kiara · 2 comments
kiara commented 2025-02-24 15:03:19 +01:00
Owner
Copy link

needed to test #104

implementation notes

if we may put off related front-ends until #350, we should be able to handle DNS using Nix options such as NixOS-DNS, including for the purpose of migration (#100).

needed to test #104 ## implementation notes - [dns servers](https://search.nixos.org/packages?channel=unstable&from=0&size=50&sort=relevance&type=packages&query=dns) seem ([compared](https://en.wikipedia.org/wiki/Comparison_of_DNS_server_software#Feature_matrix), should be compatible with client (see #110)): - [`powerdns`](https://github.com/PowerDNS/pdns) aka [`pdns`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/pd/pdns/package.nix) (GPL-2.0, C++, stringly [module](https://search.nixos.org/options?channel=unstable&show=services.pdnsd.serverConfig&query=services.pdnsd)), front-end [powerdns-admin](https://github.com/PowerDNS-Admin/PowerDNS-Admin) - procolix currently has most experience operating this - [`hickory-dns`](https://github.com/hickory-dns) (MIT/Apache, rust, structured [module](https://search.nixos.org/options?channel=unstable&show=services.hickory-dns.settings.zones.*.file&query=services.hickory-dns)) - [`acme-dns`](https://github.com/joohoi/acme-dns/) (MIT, go, semi-stringly [module](https://search.nixos.org/options?channel=unstable&show=services.acme-dns.settings.general.records&query=services.acme-dns)) - [`bind`](https://gitlab.isc.org/isc-projects/bind9) (Apache, C, structured [module](https://search.nixos.org/options?channel=unstable&show=services.bind.zones&query=services.bind), [wiki](https://wiki.nixos.org/wiki/Bind), offers DNSSec) - [`technitium-dns-server`](https://github.com/TechnitiumSoftware/DnsServer) (GPL-3.0, python, simple [module](https://search.nixos.org/options?channel=unstable&from=0&size=50&sort=relevance&type=packages&query=services.technitium-dns-server)) - [`core-dns`](https://github.com/coredns/coredns) (stringly? [module](https://search.nixos.org/options?channel=unstable&show=services.coredns.config&query=services.coredns)) - [`tinydns`](https://github.com/projectdiscovery/tinydns) (stringly [module](https://search.nixos.org/options?channel=unstable&show=services.tinydns.data&query=services.tinydns)) - [eon](https://github.com/ryanGibb/eon) (MIT, OCaml, [intro](https://ryan.freumh.org/eon.html), nix included, nix module thru eilean) - [knot](https://gitlab.nic.cz/knot/knot-dns) (GPL, C, stringly [module](https://search.nixos.org/options?channel=unstable&query=services.knot), modern interfaces, allows zone scoping) - [deSEC](https://github.com/desec-io/desec-stack) (MIT, Python, no nix package/module yet?, allows zone scoping, tho DNSSec/TSIG unconfirmed) (hosted service?) if we may put off related front-ends until #350, we should be able to handle DNS using Nix options such as `NixOS-DNS`, including for the purpose of migration (#100).
kiara added this to the Fediversity project 2025-04-18 10:11:30 +02:00
kiara removed this from the Fediversity project 2025-06-10 19:07:07 +02:00
vanrein commented 2026-07-04 14:13:23 +02:00
Owner
Copy link

You're looking for an authoritative DNS server, of course. I suggest you look at Knot DNS. It's a modern DNS server developed by the .cz NIC. It can be a (hidden) master or slave, it has modern interfaces and has pleasant dynamics. It is not a caching resolver, that'd be the user end of things.

You're looking for an authoritative DNS server, of course. I suggest you look at Knot DNS. It's a modern DNS server developed by the .cz NIC. It can be a (hidden) master or slave, it has modern interfaces and has pleasant dynamics. It is not a caching resolver, that'd be the user end of things.
👍 1
kiara commented 2026-07-04 15:01:54 +02:00
Author
Owner
Copy link

@vanrein thanks, that may well be of (future) interest.

now, so far i've maybe somewhat tried to distinguish DNS servers for our internal automation use (immediate concern) vs user-facing applications in that area (to be added to #380 - iirc @koen would be quite interested).

for now over here i've tried to focus on the immediate concern still. i will admit i feel biased against many of the options in this space (considering C itself dated), but immediate pragmatic considerations seem to currently point in favor of BIND DNS as offering a the most usable nix module on top of supporting some of the DNS clients we could use for automation (see #110).

eventually tho both such integrations are something we could build for any of the software in this space, so this is definitely to be revisited as we settle on something amenable as an operator-facing application as well.

@vanrein thanks, that may well be of (future) interest. now, so far i've maybe somewhat tried to distinguish DNS servers for our internal automation use (immediate concern) vs user-facing applications in that area (to be added to #380 - iirc @koen would be quite interested). for now over here i've tried to focus on the immediate concern still. i will admit i feel biased against many of the options in this space (considering C itself dated), but immediate pragmatic considerations seem to currently point in favor of BIND DNS as offering a the most usable nix module on top of supporting some of the DNS clients we could use for automation (see #110). eventually tho both such integrations are something we could build for any of the software in this space, so this is definitely to be revisited as we settle on something amenable as an operator-facing application as well.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
hosting-providers-nixos
panel-docs
repro-dev3
netbox-location
operator-group-comes-up
ci-var-image-fingerprint-null
deploy-report-degraded
automation/npins-update/systemd-openbao
automation/npins-update/nixpkgs
deprecate-deployments
jsonschema-frontend
update-nixpkgs-forgejo-16
fix-git-pages-native-cli
automation/npins-update/nixpkgs-unstable
automation/npins-update/forgejo-src
promote-updater
test-action-main
host-garage-central
demo-new
demo-old
schema-change-visuals
schema-change-viz
ci/panel-incus
automation/npins-update/terraform-provider-proxmox
automation/npins-update/nix-src
automation/npins-update/nix
automation/npins-update/flake-parts
automation/npins-update/clan-core
kiara/nspawn-rebase
fix/nixpkgs-contracts-26-05
feat/garage-to-hosting-provider
feat/authelia-ancilliary
kiara/nspawn-panel-fix
kiara/nspawn
issues/124-database-backups
fix/forgejo-ci-secrets-rekey
fix/forgejo-ci-network-gateway
fix/forgejo-ci-ipv6-gateway-interface
feat/tests-thru-flake
issue/126-filesystem-backup
automation/update-workflow
kiara/fix-pixelfed
issues/125-garage-backups
ci/pixelfed
pixelfed-ci
No results found.
Labels
Clear labels   
ambition
application-offering

  
ambition
configure-applications

  
ambition
front-end

  
ambition/install-applications
  
ambition
security

  
ambition
switch-host

  
ambition
update-applications

  
ambition
user-management

  
blocked
  
component
api-service
 features related to the API service

  
component
fediversity-panel

  
component
nixops4

  
documentation
  
points
0
 fibonacci complexity: 0 points

  
points
0.5
 fibonacci complexity: 0.5 points

  
points
1
 fibonacci complexity: 1 point

  
points
13
 fibonacci complexity: 13 points

  
points
2
 fibonacci complexity: 2 points

  
points
21
 fibonacci complexity: 21 points

  
points
3
 fibonacci complexity: 3 points

  
points
34
 fibonacci complexity: 34 points

  
points
5
 fibonacci complexity: 5 points

  
points
55
 fibonacci complexity: 55 points

  
points
8
 fibonacci complexity: 8 points

  
points
infinite
 fibonacci complexity: infinite points

  
productisation
features out-scoped with the decoupling of the productisation effort

  
project-management
Project management related tasks

  
question
  
role
application-developer

  
role
application-operator

  
role
hosting-provider

  
role
maintainer

  
security

   
technical debt

   
testing
  
type
bug
 Anything that doesn't work as advertised

  
type
deliverable

  
type
key-result

  
type
objective

  
type
task

  
type
unclear

  
type
user-story

  
user experience
No labels
ambition
application-offering
ambition
configure-applications
ambition
front-end
ambition/install-applications
ambition
security
ambition
switch-host
ambition
update-applications
ambition
user-management
blocked
component
api-service
component
fediversity-panel
component
nixops4
documentation
points
0
points
0.5
points
1
points
13
points
2
points
21
points
3
points
34
points
5
points
55
points
8
points
infinite
productisation
project-management
question
role
application-developer
role
application-operator
role
hosting-provider
role
maintainer
security
technical debt
testing
type
bug
type
deliverable
type
key-result
type
objective
type
task
type
unclear
type
user-story
user experience
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Blocks
#225 kick-started initial feedback cycle
fediversity/fediversity
#1374 fallback available for DNS/email
fediversity/fediversity
Depends on
#116 hypervisor resources are provisioned to deploy services to
fediversity/fediversity
#309 port infra to terraform
fediversity/fediversity
#833 unit-tested functionality integrated in deployment pipelines
fediversity/fediversity
Reference
fediversity/fediversity#200
No description provided.