Initial implementation: dns-updater daemon #1

2026-07-17T23:25:04+10:00

unkinben commented

2026-07-17 23:25:04 +10:00

What

A Go daemon that keeps a hosts DNS records current on BIND via TSIG-signed **RFC2136** updates, replacing the puppet dns-update` shell script.

Reads the same zone|name|type|ttl|value records file puppet writes; pushes the delta as one signed UPDATE per zone, so a bad zone (NOTZONE) cannot abort the others.
Reconciles on: records-file change (inotify), a new interface address (DHCP/anycast — address removals/interface-down are ignored so a link drop never disturbs records), a periodic resync, and SIGHUP.
Names qualified correctly (already-FQDN names used verbatim — no .. empty-label bug); malformed records rejected with a clear error.
Native miekg/dns → structured per-zone RCODE; local status API (unix socket) + a facter fact reporting health/failed-zones (the observability the shell version lacked).
Quiet logging: INFO on real changes/failures, DEBUG for the no-op path.

Tests / packaging

Unit tests + an in-process TSIG server integration test (adds, deletes, per-zone NOTZONE isolation, no-op). systemd unit, nfpm RPM, Woodpecker build/test/pre-commit/release (RPM → artifactapi rpm-internal).

Pairs with puppet-prod#482 (switches hosts to this package) and terraform-git#33 (repo, merged).

## What A Go daemon that keeps a host`s DNS records current on BIND via TSIG-signed **RFC2136** updates, replacing the puppet `dns-update` shell script. - Reads the same `zone|name|type|ttl|value` records file puppet writes; pushes the **delta** as one signed UPDATE per zone, so a bad zone (NOTZONE) cannot abort the others. - Reconciles on: records-file change (inotify), a **new interface address** (DHCP/anycast — address *removals*/interface-down are ignored so a link drop never disturbs records), a periodic resync, and SIGHUP. - Names qualified correctly (already-FQDN names used verbatim — no `..` empty-label bug); malformed records rejected with a clear error. - Native `miekg/dns` → structured per-zone **RCODE**; local **status API** (unix socket) + a **facter fact** reporting health/failed-zones (the observability the shell version lacked). - Quiet logging: INFO on real changes/failures, DEBUG for the no-op path. ## Tests / packaging Unit tests + an in-process TSIG server integration test (adds, deletes, per-zone NOTZONE isolation, no-op). systemd unit, nfpm RPM, Woodpecker `build`/`test`/`pre-commit`/`release` (RPM → artifactapi `rpm-internal`). Pairs with puppet-prod#482 (switches hosts to this package) and terraform-git#33 (repo, merged).

unkinben added 1 commit 2026-07-17 23:25:04 +10:00

Initial implementation: dns-updater daemon

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

02e3e0315d

RFC2136 dynamic-DNS updater. Watches a records file (inotify) and new
interface addresses and pushes TSIG-signed updates to BIND per zone, sending
only the delta. Native miekg/dns (structured per-zone RCODEs), local status
API + facter fact, systemd unit, nfpm RPM, Woodpecker CI.

Replaces the puppet dns-update shell script; keeps the same records-file and
TSIG-key contract.

benvin merged commit c1795a2739 into main

2026-07-17 23:28:05 +10:00

benvin deleted branch benvin/initial-implementation

2026-07-17 23:28:05 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/dns-updater#1