refactor: DNS backend

.docker/Dockerfile

@@ -35,7 +35,7 @@ ENV VIRTUAL_ENV=/venvs/.venv \
     VERSION=${VERSION:-beta}
 
 
-RUN set -eux; apk add --no-cache krb5-libs curl openssl netcat-openbsd
+RUN set -eux; apk add --no-cache krb5-libs curl openssl netcat-openbsd libsodium-dev
 COPY app /app
 COPY pyproject.toml /
 

.docker/dev.Dockerfile

@@ -33,7 +33,7 @@ ENV VIRTUAL_ENV=/venvs/.venv \
     PATH="/venvs/.venv/bin:$PATH" \
     VERSION=${VERSION:-beta}
 
-RUN set -eux; apk add --no-cache krb5-libs curl openssl netcat-openbsd
+RUN set -eux; apk add --no-cache krb5-libs curl openssl netcat-openbsd libsodium-dev
 
 COPY app /app
 COPY pyproject.toml /

.docker/pdns_auth.Dockerfile

@@ -0,0 +1,66 @@
+FROM alpine:3.20 AS builder
+
+RUN apk add --no-cache --virtual .build-deps \
+      build-base \
+      lmdb-dev \
+      openssl-dev \
+      boost-dev \
+      autoconf automake libtool \
+      git ragel bison flex \
+      lua5.4-dev \
+      curl-dev
+
+RUN apk add --no-cache \
+      lua \
+      lua-dev \
+      lmdb \
+      boost-libs \
+      openssl-libs-static \
+      curl \
+      libstdc++
+
+RUN git clone https://github.com/PowerDNS/pdns.git /pdns
+WORKDIR /pdns
+
+RUN git submodule init &&\
+    git submodule update &&\
+    git checkout auth-5.0.1
+
+RUN autoreconf -vi
+
+RUN mkdir /build && \
+    ./configure \
+      --sysconfdir=/etc/powerdns \
+      --enable-option-checking=fatal \
+      --with-dynmodules='lmdb' \
+      --with-modules='' \
+      --with-unixodbc-lib=/usr/lib/$(dpkg-architecture -q DEB_BUILD_GNU_TYPE) && \
+    make clean && \
+    make $MAKEFLAGS -C ext &&\
+    make $MAKEFLAGS -C modules &&\
+    make $MAKEFLAGS -C pdns && \
+    make -C pdns install DESTDIR=/build &&\ 
+    make -C modules install DESTDIR=/build &&\ 
+    make clean && \
+    strip /build/usr/local/bin/* /build/usr/local/sbin/* /build/usr/local/lib/pdns/*.so
+
+FROM alpine:3.20 AS runtime
+
+COPY --from=builder /build /
+
+RUN apk add --no-cache \
+    lua \
+    lua-dev \
+    lmdb \
+    boost-libs \
+    openssl-libs-static \
+    curl \
+    libstdc++
+
+RUN mkdir -p /etc/powerdns/pdns.d /var/run/pdns /var/lib/powerdns /etc/powerdns/templates.d /var/lib/pdns-lmdb
+
+COPY ./.package/pdns.conf /etc/powerdns/pdns.conf
+
+EXPOSE 8082/tcp
+
+CMD ["/usr/local/sbin/pdns_server"]

.docker/test.Dockerfile

@@ -27,7 +27,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
 FROM python:3.13.7-alpine3.21 AS runtime
 
 WORKDIR /app
-RUN set -eux; apk add --no-cache openldap-clients openssl curl krb5-libs
+RUN set -eux; apk add --no-cache openldap-clients openssl curl krb5-libs libsodium-dev
 
 ENV VIRTUAL_ENV=/venvs/.venv \
     PATH="/venvs/.venv/bin:$PATH" \

.github/workflows/build-beta.yml

@@ -156,7 +156,7 @@ jobs:
             --build-arg BUILDKIT_INLINE_CACHE=1 \
             --build-arg VERSION=beta
 
-  build-bind9:
+  build-pdns_auth:
     runs-on: ubuntu-latest
     needs: [build-tests, run-ssh-test, run-tests]
     steps:
@@ -173,14 +173,14 @@ jobs:
 
       - name: Build docker image
         env:
-          TAG: ghcr.io/${{ env.REPO }}_bind9:beta
+          TAG: ghcr.io/${{ env.REPO }}_pdns_auth:beta
           DOCKER_BUILDKIT: '1'
         run: |
           echo $TAG
           docker build \
             --push \
             --target=runtime \
-            -f .docker/bind9.Dockerfile . \
+            -f .docker/pdns_auth.Dockerfile . \
             -t $TAG \
             --cache-to type=gha,mode=max \
             --cache-from $TAG \

.github/workflows/build-dev.yml

@@ -155,7 +155,7 @@ jobs:
             --build-arg BUILDKIT_INLINE_CACHE=1 \
             --build-arg VERSION=dev
 
-  build-bind9:
+  build-pdns_auth:
     runs-on: ubuntu-latest
     needs: [build-tests, run-ssh-test, run-tests]
     steps:
@@ -172,14 +172,14 @@ jobs:
 
       - name: Build docker image
         env:
-          TAG: ghcr.io/${{ env.REPO }}_bind9:dev
+          TAG: ghcr.io/${{ env.REPO }}_pdns_auth:dev
           DOCKER_BUILDKIT: '1'
         run: |
           echo $TAG
           docker build \
             --push \
             --target=runtime \
-            -f .docker/bind9.Dockerfile . \
+            -f .docker/pdns_auth.Dockerfile . \
             -t $TAG \
             --cache-to type=gha,mode=max \
             --cache-from $TAG \

.github/workflows/build-docker-image.yml

@@ -176,7 +176,7 @@ jobs:
             --build-arg BUILDKIT_INLINE_CACHE=1 \
             --build-arg VERSION=latest
 
-  build-bind9:
+  build-pdns_auth:
     runs-on: ubuntu-latest
     needs: [build-tests, run-ssh-test, run-tests]
     steps:
@@ -193,14 +193,14 @@ jobs:
 
       - name: Build docker image
         env:
-          TAG: ghcr.io/${{ env.REPO }}_bind9:latest
+          TAG: ghcr.io/${{ env.REPO }}_pdns_auth:latest
           DOCKER_BUILDKIT: '1'
         run: |
           echo $TAG
           docker build \
             --push \
             --target=runtime \
-            -f .docker/bind9.Dockerfile . \
+            -f .docker/pdns_auth.Dockerfile . \
             -t $TAG \
             --cache-to type=gha,mode=max \
             --cache-from $TAG \

.gitignore

@@ -30,6 +30,7 @@ share/python-wheels/
 .installed.cfg
 *.egg
 MANIFEST
+resolve.conf
 
 # PyInstaller
 #  Usually these files are written by a python script from a template

.package/dnsdist.conf

@@ -0,0 +1,6 @@
+setLocal('0.0.0.0:53')
+controlSocket('0.0.0.0:8084')
+setKey('supersecretapikey')
+addConsoleACL('172.20.0.0/24')
+includeDirectory('/etc/dnsdist/conf.d/')
+setACL('0.0.0.0/0')

.package/docker-compose.yml

@@ -347,27 +347,52 @@ services:
       - traefik.tcp.routers.kpasswd.service=kpasswd
       - traefik.tcp.services.kpasswd.loadbalancer.server.port=464
 
-  bind_dns:
-    image: ghcr.io/multidirectorylab/multidirectory_bind9:${VERSION:-latest}
-    container_name: bind9
-    hostname: bind9
-    restart: unless-stopped
+  pdns_auth:
+    image: ghcr.io/multidirectorylab/multidirectory_pdns_auth:${VERSION:-latest}
+    container_name: pdns_auth
+    networks:
+      default:
+      dns_net:
+        ipv4_address: 172.20.0.4
+    expose:
+      - 8082
+      - 53/udp
+      - 53/tcp
     volumes:
-      - dns_server_file:/opt/
-      - dns_server_config:/etc/bind/
-    tty: true
-    env_file:
-      - .env
-    environment:
-      - USE_CONFIG_FILE_LOGGING=true
-    depends_on:
-      ldap_server:
-        condition: service_healthy
-        restart: true
-    labels:
-      - traefik.enable=true
-      - traefik.udp.routers.bind_dns_udp.entrypoints=bind_dns_udp
-      - traefik.udp.services.bind_dns_udp.loadbalancer.server.port=53
+      - dns_lmdb:/var/lib/pdns-lmdb
+      - dns_config:/etc/powerdns
+
+
+  pdns_recursor:
+    image: powerdns/pdns-recursor-51:5.1.7
+    container_name: pdns_recursor
+    networks:
+      default:
+      dns_net:
+        ipv4_address: 172.20.0.2
+    expose:
+      - 8083
+      - 53/udp
+      - 53/tcp
+    volumes:
+      - ./recursor.conf:/etc/powerdns/recursor.conf
+      - forward_zones:/etc/powerdns/recursor.d/
+
+  pdnsdist:
+    image: powerdns/dnsdist-19:1.9.11
+    container_name: pdnsdist
+    networks:
+      default:
+      dns_net:
+        ipv4_address: 172.20.0.3
+    expose:
+      - 8084
+    ports:
+      - "53:53/tcp"
+      - "53:53/udp"
+    volumes:
+      - ./dnsdist.conf:/etc/dnsdist/dnsdist.conf
+      - dnsdist_confd:/etc/dnsdist/conf.d
 
   kea_dhcp4:
     image: ghcr.io/multidirectorylab/multidirectory_dhcp4:${VERSION:-latest}
@@ -467,6 +492,14 @@ services:
     environment:
       HANDLER_NAME: event_sender-1
 
+networks:
+  dns_net:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 172.20.0.0/24
+          gateway: 172.20.0.1
+
 volumes:
   postgres:
   kdc:
@@ -478,3 +511,7 @@ volumes:
   leases:
   sockets:
   dhcp:
+  dns_lmdb:
+  dns_config:
+  forward_zones:
+  dnsdist_confd:

.package/pdns.conf

@@ -0,0 +1,11 @@
+launch=lmdb
+lmdb-filename=/var/lib/pdns-lmdb/pdns.lmdb
+daemon=no
+local-address=0.0.0.0
+local-port=53
+api=yes
+api-key=supersecretapikey
+webserver-allow-from=0.0.0.0/0
+webserver=yes
+webserver-address=0.0.0.0
+webserver-port=8082

.package/recursor.conf

@@ -0,0 +1,10 @@
+local-address=0.0.0.0
+webserver-allow-from=0.0.0.0/0
+forward-zones-recurse=.=1.1.1.1;8.8.8.8
+forward-zones=
+api-config-dir=/etc/powerdns/recursor.d/
+include-dir=/etc/powerdns/recursor.d/
+webserver=yes
+webserver-address=0.0.0.0
+webserver-port=8083
+api-key=supersecretapikey