cb601/dyndns
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

feat(dyndns): add optional rndc journal synchronization

Browse Source 
Add configurable post-update journal synchronization via rndc sync -clean.

Separate RFC 2136 update settings from local RNDC control settings.
Run synchronization only after a successful nsupdate request and only when
DYNDNS_RNDC_SYNC_CLEAN is enabled.

Treat RNDC synchronization failures as warnings because the DNS update has
already been accepted and named retains the authoritative state in its journal.
This commit is contained in:
sduesterhaupt
2026-09-05 13:55:34 +02:00
parent 24d23012c5
commit 4e375b130c
2 changed files with 93 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vars.example
+38 -2
View File
@@ -81,7 +81,12 @@
# DNS / BIND
# ------------------------------------------------------------------
# Authoritative DNS server used for update operations
# Authoritative DNS server used for RFC 2136 dynamic update operations.
#
# This address is used by nsupdate on DNS port 53. It must point to the
# authoritative BIND listener and matching view serving DYNDNS_BIND_ZONE.
#
# Do not use a local recursive-only listener or a non-authoritative view.
#set_var DYNDNS_BIND_SERVER "127.0.0.1"
# Service name used when reloading/reconfiguring the name server
@@ -90,7 +95,10 @@
# DNS zone handled by dynDNS
#set_var DYNDNS_BIND_ZONE "example24.com"
# TSIG key file or key identifier used for nsupdate access
# TSIG key file or key identifier used for nsupdate access.
#
# This key should be restricted in BIND with update-policy and must not be
# confused with the RNDC control key configured below.
#set_var DYNDNS_BIND_ZONE_KEY "keyfile"
# Directory containing the primary zone files
@@ -105,6 +113,34 @@
# Default TTL for generated/managed records
#set_var DYNDNS_BIND_ZONE_TTL 300
# ------------------------------------------------------------------
# RNDC POST-UPDATE ZONE SYNCHRONIZATION
# ------------------------------------------------------------------
# Local BIND control endpoint used for optional post-update synchronization.
#
# rndc connects to named's control interface, normally TCP port 953.
# This is independent from DYNDNS_BIND_SERVER, which is used by nsupdate
# against DNS port 53.
#set_var DYNDNS_RNDC_SERVER "127.0.0.1"
# RNDC control key authorized by the named controls {} configuration.
#
# This key is intentionally separate from DYNDNS_BIND_ZONE_KEY. The latter is
# used by nsupdate for RFC 2136 DNS updates, while this key authorizes BIND
# administrative operations such as "rndc sync -clean".
#set_var DYNDNS_RNDC_KEY "/etc/named/rndc.key"
# Synchronize dynamic zone journals after a successful nsupdate request.
#
# 0 = disabled; named handles zone dumps using its normal maintenance schedule.
# 1 = execute "rndc sync -clean <zone>" after a successful DNS update.
#
# A failed synchronization must be logged as a warning only. The dynamic update
# remains successful because named retains the authoritative state in its
# journal until the next successful zone dump.
#set_var DYNDNS_RNDC_SYNC_CLEAN 0
# ------------------------------------------------------------------
# MEMBER DEFAULTS
# ------------------------------------------------------------------