dns: deploy dns-updater daemon in place of the shell nsupdate script [HOLD: needs dns-updater RPM published] (#482)

## Why
Replace the `profiles::dns::updater` shell mechanism (`dns-update.sh` + `dns-update.path`/`.service` + the in-run `exec`) with the packaged **dns-updater** daemon. The daemon watches the records file (inotify) and network interfaces and pushes TSIG-signed RFC2136 updates to BIND natively — with structured per-zone RCODEs and a status API/facter fact, so failures like the recent `invalid owner name: empty label` / NOTZONE surface directly instead of as opaque nsupdate stderr.

## Changes
- Install the `dns-updater` package; manage `/etc/dns-updater/env`.
- Run the packaged `dns-updater.service`, restarting **only** on env/key change — records-file edits are picked up by the daemon`s own inotify watch, so no service churn on record changes.
- Keep the `concat` records file and the TSIG key file unchanged (same paths/format).
- Ensure the old `/usr/local/bin/dns-update` + `dns-update.path`/`.service` units are absent.
- Drop the now-dead `dns-update.{sh,service,path}.epp` templates.

## Sequencing — HOLD
Do not merge until the `dns-updater` RPM is published to artifactapi `rpm-internal` (needs terraform-git#33 to create the repo, then the daemon code pushed + tagged so Woodpecker builds the RPM). Merging before the package exists makes `package { dns-updater }` fail on every host.

Supersedes the interim shell fix in #481 (which stays valid until this rolls out). Keeps the file as the desired-state interface (puppet owns desired records; the daemon reconciles + reports).

Reviewed-on: #482
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

site/profiles/manifests/dns/updater.pp

@@ -23,6 +23,12 @@ class profiles::dns::updater (
   Stdlib::AbsolutePath        $state_dir       = '/var/lib/dns-updater',
   Stdlib::AbsolutePath        $config_dir      = '/etc/dns-updater',
   Stdlib::AbsolutePath        $master_basedir  = lookup('profiles::dns::master::basedir'),
+  # dns-updater daemon (replaces the dns-update shell script).
+  String                      $package_ensure   = 'installed',
+  Stdlib::AbsolutePath        $api_socket       = '/run/dns-updater/api.sock',
+  String                      $resync           = '10m',
+  Enum['debug', 'info', 'warn', 'error'] $log_level = 'info',
+  Boolean                     $watch_interfaces = true,
 ) {
 
   $state_file  = "${state_dir}/applied"
@@ -91,36 +97,57 @@ class profiles::dns::updater (
         })),
       }
 
-      file { '/usr/local/bin/dns-update':
+      # dns-updater daemon: watches the records file (inotify) and network
+      # interfaces, pushes TSIG-signed RFC2136 updates to $server natively.
+      package { 'dns-updater':
+        ensure => $package_ensure,
+      }
+
+      $env_content = @("ENV")
+        # Managed by puppet (profiles::dns::updater).
+        DNS_UPDATER_SERVER=${server}
+        DNS_UPDATER_KEY_FILE=${key_file}
+        DNS_UPDATER_RECORDS_FILE=${records_file}
+        DNS_UPDATER_STATE_FILE=${state_file}
+        DNS_UPDATER_API=${api_socket}
+        DNS_UPDATER_RESYNC=${resync}
+        DNS_UPDATER_WATCH_INTERFACES=${watch_interfaces}
+        DNS_UPDATER_LOG_LEVEL=${log_level}
+        | ENV
+
+      file { "${config_dir}/env":
         ensure  => file,
         owner   => 'root',
         group   => 'root',
-        mode    => '0755',
-        content => epp('profiles/dns/dns-update.sh.epp', {
-            'server'       => $server,
-            'key_file'     => $key_file,
-            'records_file' => $records_file,
-            'state_file'   => $state_file,
-        }),
+        mode    => '0644',
+        content => $env_content,
+        require => [File[$config_dir], Package['dns-updater']],
+      }
+
+      # Restart only on config/key change; records-file changes are picked up by
+      # the daemon's own inotify watch, so no service churn on record edits.
+      service { 'dns-updater':
+        ensure    => running,
+        enable    => true,
+        subscribe => [File["${config_dir}/env"], File[$key_file]],
+        require   => [Package['dns-updater'], Concat[$records_file], File[$key_file]],
+      }
+
+      # Retire the previous shell-based mechanism.
+      file { '/usr/local/bin/dns-update':
+        ensure => absent,
       }
 
       systemd::unit_file { 'dns-update.service':
-        content => epp('profiles/dns/dns-update.service.epp', { 'script' => '/usr/local/bin/dns-update' }),
+        ensure => absent,
+        active => false,
+        enable => false,
       }
 
-      # The .path unit watches the records file and triggers the service.
       systemd::unit_file { 'dns-update.path':
-        content => epp('profiles/dns/dns-update.path.epp', { 'records_file' => $records_file }),
-        active  => true,
-        enable  => true,
-      }
-
-      # Also apply within the puppet run whenever the records change.
-      exec { 'dns-update-apply':
-        command     => '/usr/local/bin/dns-update',
-        refreshonly => true,
-        subscribe   => Concat[$records_file],
-        require     => [File['/usr/local/bin/dns-update'], File[$key_file]],
+        ensure => absent,
+        active => false,
+        enable => false,
       }
     }
   }