Summary

We want our core services (DHCP, DNS, LDAP) to always work. So, we need to have them redundant. Not only as in multiple processes running the same functionality, but also on different physical systems.

Software to use

NSD and Unbound for DNS
ISC-DHCPD for DHCP
OpenLDAP

Architecture

There will be two systems, which can either be a VM or a physical system. Both of these systems should be running (almost) identical configurations, and should not require any further configuration or maintenance. Furthermore, care must be taken to make these machines as robust as possible. Both machines should be able to run by themselves. That is, there should be *no* external dependencies for these systems. If this means that, during an outage, the systems continue to run but their configuration cannot be modified, this is acceptable.

For DNS, the authoritative zones live in IPAM. On the ipam machine, a powerdns instance is running that notifies two BIND instances running on the two systems. For DHCP, we will either use a isc-dhcpd cluster or multiple machines running kea combined with JSON based configuration (which can be pushed towards both system). For LDAP, we run OpenLDAP with the syncprov overlay in a master-master fashion. Optionally, we can deploy slaves for systems that need to run standalone.