unkinben
c3d8de5060
ci/woodpecker/pr/ruby-validate Pipeline was successful
ci/woodpecker/pr/puppet-lint Pipeline was successful
ci/woodpecker/pr/yamllint Pipeline was successful
ci/woodpecker/pr/bolt-validate Pipeline was successful
ci/woodpecker/pr/erb-validate Pipeline was successful
ci/woodpecker/pr/epp-validate Pipeline was successful
ci/woodpecker/pr/puppet-validate Pipeline was successful
ci/woodpecker/pr/ruby-check Pipeline was successful
profiles::dns::record publishes some records with an already-qualified name
(trailing dot), e.g. au-syd1-pve.main.unkin.net., cobbler.main.unkin.net.,
dashboard.ceph.unkin.net., and the halb service CNAMEs. The dns-update
script's fqdn() unconditionally appended the zone, producing a '..' empty
label; nsupdate rejects the whole per-zone update with 'invalid owner name:
empty label' + 'syntax error'. The reverse-PTR send (sorted first, always
relative) still applied, so affected hosts ended up with a PTR but no A.
Handle the already-FQDN case (name ends in '.') by using it verbatim; keep
the apex ('@'/empty) and relative cases as before.
Fixes hosts stuck with PTR-but-no-A (e.g. ausyd1nxvm2069-2073, 2098) and
repopulates the unkin.net service records (git/grafana/auth/fafflix).
65 lines
2.3 KiB
Plaintext
65 lines
2.3 KiB
Plaintext
<%- | String $server, String $key_file, String $records_file, String $state_file | -%>
|
|
#!/bin/bash
|
|
# Managed by puppet (profiles::dns::updater). Applies this host's records to the
|
|
# authoritative DNS server via TSIG nsupdate. Only the delta since the last
|
|
# successful run is sent; removed records are deleted.
|
|
set -euo pipefail
|
|
|
|
SERVER="<%= $server %>"
|
|
KEYFILE="<%= $key_file %>"
|
|
RECORDS="<%= $records_file %>"
|
|
STATE="<%= $state_file %>"
|
|
|
|
[ -f "$RECORDS" ] || exit 0
|
|
touch "$STATE"
|
|
|
|
# Format per line: zone|name|type|ttl|value (name is relative to zone, or @).
|
|
desired="$(grep -vE '^[[:space:]]*(#|$)' "$RECORDS" | sort -u || true)"
|
|
applied="$(grep -vE '^[[:space:]]*(#|$)' "$STATE" 2>/dev/null | sort -u || true)"
|
|
|
|
[ "$desired" = "$applied" ] && exit 0
|
|
|
|
fqdn() { # name zone
|
|
# $1 may be relative to the zone, "@"/empty for the apex, or already a FQDN
|
|
# (trailing dot). Only append the zone in the relative case; appending it to
|
|
# an already-qualified name yields a "..", which nsupdate rejects as an
|
|
# "invalid owner name: empty label".
|
|
case "$1" in
|
|
''|'@') printf '%s.' "$2" ;;
|
|
*.) printf '%s' "$1" ;;
|
|
*) printf '%s.%s.' "$1" "$2" ;;
|
|
esac
|
|
}
|
|
|
|
msg="$(mktemp)"
|
|
trap 'rm -f "$msg"' EXIT
|
|
printf 'server %s\n' "$SERVER" >> "$msg"
|
|
|
|
# Process per zone so each UPDATE message targets a single zone.
|
|
zones="$(printf '%s\n%s\n' "$desired" "$applied" | cut -d'|' -f1 | sort -u | grep -v '^$' || true)"
|
|
for zone in $zones; do
|
|
printf 'zone %s.\n' "$zone" >> "$msg"
|
|
# Additions/updates: replace the RRset for every desired record in this zone.
|
|
printf '%s\n' "$desired" | awk -F'|' -v z="$zone" 'NF>=5 && $1==z' | \
|
|
while IFS='|' read -r z name type ttl value; do
|
|
f="$(fqdn "$name" "$z")"
|
|
printf 'update delete %s %s\n' "$f" "$type" >> "$msg"
|
|
printf 'update add %s %s %s %s\n' "$f" "$ttl" "$type" "$value" >> "$msg"
|
|
done
|
|
# Deletions: records present last run but gone now.
|
|
comm -23 <(printf '%s\n' "$applied") <(printf '%s\n' "$desired") | \
|
|
awk -F'|' -v z="$zone" 'NF>=5 && $1==z' | \
|
|
while IFS='|' read -r z name type ttl value; do
|
|
f="$(fqdn "$name" "$z")"
|
|
printf 'update delete %s %s %s\n' "$f" "$type" "$value" >> "$msg"
|
|
done
|
|
printf 'send\n' >> "$msg"
|
|
done
|
|
|
|
if nsupdate -k "$KEYFILE" "$msg"; then
|
|
printf '%s\n' "$desired" > "$STATE"
|
|
else
|
|
echo "dns-update: nsupdate to ${SERVER} failed" >&2
|
|
exit 1
|
|
fi
|