Network/Roadmap/SelfHostedDNS: Difference between revisions

From NURDspace
(Created page with "= Summary = Take control of our own DNS zones, and host them on space infra. This will be done for the following domains: * nurd.space * nurdspace.nl = Architecture = We wil...")
 
No edit summary
 
(8 intermediate revisions by the same user not shown)
Line 2: Line 2:
Take control of our own DNS zones, and host them on space infra. This will be done for the following domains:
Take control of our own DNS zones, and host them on space infra. This will be done for the following domains:


* nurd.space
<s>* nurd.space</s>
* nurdspace.nl
* nurdspace.nl


= Architecture =
= Architecture =
We will use two secondary nameservers. One running @ BIT/Ede, one runnin2a02:898:62:f6::5ag at Soleus/Amsterdam. On erratic, we host a hidden primary DNS server, and using wireguard tunnels, we hook these up to the secondaries. Zone updates will be sent over these wireguard links
We will use two secondary nameservers. One running @ BIT/Ede, one running at Soleus/Amsterdam. On erratic, we host a hidden primary DNS server, and using wireguard tunnels, we hook these up to the secondaries. Zone updates will be sent over these wireguard links. Domains will be secured using DNSSEC, with keys being hosted on the hidden primary.
 
= Primary DNS server details =
== extdns.vm.nurd.space ==
* ipv4: 10.208.1.33
* operator: bofh


= Secondary DNS server details =
= Secondary DNS server details =
Line 38: Line 43:
* Done for nurd.space
* Done for nurd.space


== Setup primary namserver on space infrastructure
== Updated sponsor block on website ==
* This should be a KVM, 2 cores, 1024MB ram
Once both zones (and the wiki) have been migrated, update the sponsor block to reflect the current status.
* NSD will be used as the nameserver
 
* Machine should be hosted on internal ip space
== Setup primary namserver on space infrastructure ==
* Wireguard tunnels need to be setup between primary and secondaries
Primary is running on extdns.vm.nurd.space
* XFR needs to be configured between primary and secondaries
 
* Ask r3boot for a copy of the zonefiles (currently services.as65342.net is configured as a primary)
= Documentation =
See [[Network/Services/DNS|here]]

Latest revision as of 20:09, 23 October 2023

Summary

Take control of our own DNS zones, and host them on space infra. This will be done for the following domains:

* nurd.space

  • nurdspace.nl

Architecture

We will use two secondary nameservers. One running @ BIT/Ede, one running at Soleus/Amsterdam. On erratic, we host a hidden primary DNS server, and using wireguard tunnels, we hook these up to the secondaries. Zone updates will be sent over these wireguard links. Domains will be secured using DNSSEC, with keys being hosted on the hidden primary.

Primary DNS server details

extdns.vm.nurd.space

  • ipv4: 10.208.1.33
  • operator: bofh

Secondary DNS server details

services.as65342.net

  • ipv4: 213.154.229.26
  • ipv6: 2001:7b8:3:47:213:154:229:26
  • operator: r3boot

neutralino.soleus.nu

  • ipv4: 94.142.246.90
  • ipv6: 2a02:898:62:f6::5a
  • operator: BOFH team

Steps

Configure nameservers for both domains

This step has been completed

[16:36:11] alita [~] >> dig +short @213.154.229.26 soa nurd.space
ns1.r3blog.nl. hostmaster.r3blog.nl. 2023072001 86400 1800 2419200 300
[16:36:26] alita [~] >> dig +short @94.142.246.90 soa nurd.space
ns1.r3blog.nl. hostmaster.r3blog.nl. 2023072001 86400 1800 2419200 300
[16:36:33] alita [~] >> dig +short @213.154.229.26 soa nurdspace.nl
ns1.r3blog.nl. hostmaster.r3blog.nl. 2022122003 86400 1800 2419200 300
[16:36:37] alita [~] >> dig +short @94.142.246.90 soa nurdspace.nl
ns1.r3blog.nl. hostmaster.r3blog.nl. 2022122003 86400 1800 2419200 300

Request transfer keys

Request transfer of domains

  • Done for nurd.space

Updated sponsor block on website

Once both zones (and the wiki) have been migrated, update the sponsor block to reflect the current status.

Setup primary namserver on space infrastructure

Primary is running on extdns.vm.nurd.space

Documentation

See here