internal DNS: nodes find each other via BIND populated by octodns (#785) #1146
No reviewers
fediversity/developers
Labels
No labels
ambition
application-offering
ambition
configure-applications
ambition
front-end
ambition/install-applications
ambition
security
ambition
switch-host
ambition
update-applications
ambition
user-management
blocked
component
api-service
component
fediversity-panel
component
nixops4
documentation
points
0
points
0.5
points
1
points
13
points
2
points
21
points
3
points
34
points
5
points
55
points
8
points
infinite
productisation
project-management
question
role
application-developer
role
application-operator
role
hosting-provider
role
maintainer
security
technical debt
testing
type
bug
type
deliverable
type
key-result
type
objective
type
task
type
unclear
type
user-story
user experience
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
fediversity/fediversity!1146
Loading…
Reference in a new issue
No description provided.
Delete branch "kiara/fediversity:785-nodes-find-each-other"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Closes #785 (and stands up the #200 internal DNS node).
What
Nodes in the hosting-provider group can now resolve each other by FQDN. A BIND
namedmaster forabundos.euruns in the group; the existingoctodns-zoneeffect renders one A/AAAA record per group node from the group'smachinesdata and pushes them into the live daemon via RFC2136 dynamic update. Other group nodes pointnetworking.nameserversat the BIND node.This is declarative, deploy-time discovery: the zone is a pure function of the data model, so adding a node or changing its IP is a redeploy, not a hand-edited zone file. No runtime service-discovery mesh. The
bind.nixheader documents when a runtime system (etcd+CoreDNS or Consul) would instead be the better fit -- once membership churns between deploys or resolution must be health-aware.Changes
src/effects/default.nix-- newbindprovider onoctodns-zone(octodns_bind.Rfc2136Provider, TSIGkey_secretvia thesecretFilesenv-ref mechanism, renderskey_secret: env/BIND_KEY_SECRET).src/applications/hosting-provider/bind/default.nix+bind.nix-- thin app + NixOS BIND master, RFC2136allow-update { key octodns; }, TSIG keyincluded from out-of-band/var/lib/named/octodns.key, writable zone dir so dynamic updates persist.src/applications/hosting-provider/internal-dns.nix-- group resolver module (nameservers = mkBefore [ bindIpv4 bindIpv6 ]), wired per-node inhosts-common.nix, gated on the group having a bind node and excluding the bind node itself (no forwarder self-loop). Upstream Procolix resolvers kept as fallback.src/setups/groups/hosting-provider.nix--bindmachine (network.name = "ns1"),mkZonehelper (skips null/0.0.0.0/::placeholders) + exportedzone.src/setups/hosts-common.nix-- octodns effect wiring mirroring the netbox block, surfacingoctodns.{validate,sync}.checks/integrations/octodns/nixosTest.nix-- group-derived-zone build-time assert + live subtests: TSIG-signed AXFR + RFC2136 push into a running bind, then cross-nodedig +short fedi201.abundos.eupeer resolution. Existing powerdns subtests retained (moved off :53 to :5300, only its :8081 API is used).Test
integrations-octodnsis green on fediversity-ci (117.75s), including the live RFC2136 update (signer "octodns" approved,adding an RR at 'fedi201.abundos.eu' A 95.215.187.201) and the peer node resolvingfedi201.abundos.eucross-network.Flag for review
95.215.187.200/2a00:51c0:13:1305::200) is a placeholder allocation -- confirm with the operator.setups/nixos/networking.nixdisables the NixOS firewall and uses a static default-dropnftablesruleset with no port 53. A real deploy also needs an nftables rule opening 53 scoped to the internal subnet (not cluster-wide); the per-appnetworking.firewall.allowed*Portsset here is a no-op there.Disclaimer: I used a coding agent in the creation of this patch.
600d020566de7c2e76f6WIP: internal DNS: nodes find each other via BIND populated by octodns (#785)to internal DNS: nodes find each other via BIND populated by octodns (#785)