unkin/puppet-prod
3
0
Fork 0
Code Issues 10 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

dns: deploy dns-updater daemon in place of the shell nsupdate script [HOLD: needs dns-updater RPM published] #482

Merged
benvin merged 1 commits from benvin/dns-updater-daemon into develop 2026-07-17 23:35:00 +10:00
Conversation 1 Commits 1 Files Changed 4
+48 -104

1 Commits

Author SHA1 Message Date
unkinben 5b89e4336d dns: deploy dns-updater daemon in place of the shell nsupdate script
ci/woodpecker/pr/bolt-validate Pipeline was successful
Details
ci/woodpecker/pr/erb-validate Pipeline was successful
Details
ci/woodpecker/pr/epp-validate Pipeline was successful
Details
ci/woodpecker/pr/yamllint Pipeline was successful
Details
ci/woodpecker/pr/ruby-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-lint Pipeline was successful
Details
ci/woodpecker/pr/ruby-check Pipeline was successful
Details
ci/woodpecker/pr/puppet-validate Pipeline was successful
Details 
Replaces the profiles::dns::updater shell mechanism (dns-update.sh +
dns-update.path/.service + the in-run exec) with the packaged dns-updater
daemon, which watches the records file (inotify) and network interfaces and
pushes TSIG-signed RFC2136 updates natively.

- install the dns-updater package; manage /etc/dns-updater/env
- run the packaged dns-updater.service, restarting only on env/key change
  (records-file edits are picked up by the daemon's own watch, no churn)
- keep the concat records file and TSIG key file unchanged
- ensure the old script + .path/.service units are absent
- drop the now-dead dns-update.{sh,service,path}.epp templates

The daemon reports per-zone RCODEs and a health status API, so failures like
the recent empty-label/NOTZONE ones surface directly instead of as opaque
nsupdate stderr.
 2026-07-17 23:20:05 +10:00