added bind

apache/vars-vars

@@ -1,7 +1,3 @@
-DHCP_TSIG_KEY_NAME
-DHCP_TSIG_KEY_ALGO
-DHCP_TSIG_KEY_SECRET
-
 DHCP_DNS_MASTER
 DHCP_DNS_SERVER
 DHCP_TFTP_SERVER
@@ -17,3 +13,7 @@ DHCP_NETMASK
 DHCP_IP_FIRST
 DHCP_IP_LAST
 DHCP_BROADCAST
+
+DNS_TSIG_KEY_INTERNAL_SECRET
+DNS_TSIG_KEY_EXTERNAL_SECRET
+DNS_TSIG_KEY_RNDC_SECRET

bind/Dockerfile

@@ -0,0 +1,29 @@
+FROM robinthoni/debian-multiarch:jessie
+
+MAINTAINER Robin Thoni <robin@rthoni.com>
+
+ARG CONFIG_DIR=/etc/default/config-files/
+
+RUN apt-get update && apt-get -y install\
+        bind9\
+        dnsutils\
+        bind9utils &&\
+        apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+RUN rm -rf /var/log/*
+
+COPY ./vars-vars /etc/vars-vars
+
+COPY ./vars-files /etc/vars-files
+
+COPY ./common.sh /common.sh
+
+COPY ./run.sh /run.sh
+
+RUN mkdir "${CONFIG_DIR}"
+
+COPY ./config "${CONFIG_DIR}"
+
+EXPOSE 53/udp 53/tcp
+
+CMD ["/run.sh"]

bind/common.sh

@@ -0,0 +1,41 @@
+export CONFIG_DIR="/etc/default/config-files/"
+
+resolv_host()
+{
+  hostname="${1}"
+  ip=$(getent hosts "${hostname}" | cut -d' ' -f1)
+  echo "${ip}"
+}
+
+replace_var()
+{
+  file="${1}"
+  var="${2}"
+  sed -e "s?${var}?${!var}?g" -i "${file}"
+}
+
+replace_vars()
+{
+  file="${1}"
+  for var in $(cat /etc/vars-vars)
+  do
+    replace_var "${file}" "${var}"
+  done
+}
+
+replace_files()
+{
+  cat /etc/vars-files | while read line
+  do
+    filesrc="${CONFIG_DIR}$(echo "${line}" | awk '{print $1}')"
+    filedst=$(echo "${line}" | awk '{print $2}')
+    if [ -f "${filesrc}" ]
+    then
+      echo "Expanding file ${filesrc} to ${filedst}"
+      cp "${filesrc}" "${filedst}"
+      replace_vars "${filedst}"
+    else
+      echo "File ${filesrc} does not exist. Skipping."
+    fi
+  done
+}

bind/config/named.conf

@@ -0,0 +1,64 @@
+logging {
+  category default {
+    default_stderr;
+  };
+};
+
+key "key-internal" {
+    algorithm HMAC-MD5;
+    secret "DNS_TSIG_KEY_INTERNAL_SECRET";
+};
+
+key "key-external" {
+    algorithm HMAC-MD5;
+    secret "DNS_TSIG_KEY_EXTERNAL_SECRET";
+};
+
+key "key-rndc" {
+    algorithm HMAC-MD5;
+    secret "DNS_TSIG_KEY_RNDC_SECRET";
+};
+
+acl "acl-internal" {
+  !key "key-external";
+  key "key-internal";
+  192.168.0.0/16;
+  172.16.0.0/12;
+  10.0.0.0/8;
+  localhost;
+};
+
+acl "acl-external" {
+  !key "key-internal";
+  key "key-external";
+  any;
+};
+
+masters "masters-example.com-internal" {
+  10.10.0.1 key "key-internal";
+};
+
+masters "masters-example.com-external" {
+  10.10.0.1 key "key-external";
+};
+
+options {
+  directory "/var/cache/bind";
+  dnssec-validation auto;
+  auth-nxdomain no;
+  listen-on-v6 {
+    none;
+  };
+  masterfile-format text;
+  notify explicit;
+};
+
+controls {
+  inet 127.0.0.1 allow {
+    localhost;
+  } keys {
+    "key-rndc";
+  };
+};
+
+include "/etc/bind/named.conf.local";

bind/config/named.conf.local

@@ -0,0 +1,43 @@
+view "view-internal" {
+  match-clients {
+    "acl-internal";
+  };
+  allow-recursion {
+    any;
+  };
+  also-notify {
+    "masters-example.com-internal";
+  };
+  allow-transfer {
+    key "key-internal";
+  };
+  allow-update {
+    key "key-internal";
+  };
+
+  include "/etc/bind/named.conf.default-zones";
+  include "/etc/bind/zones.rfc1918";
+  include "/etc/bind/zones/named.conf.local.common";
+  include "/etc/bind/zones/named.conf.local.internal";
+};
+
+view "view-external" {
+  match-clients {
+    "acl-external";
+  };
+  allow-recursion {
+    none;
+  };
+  also-notify {
+    "masters-example.com-external";
+  };
+  allow-transfer {
+    key "key-external";
+  };
+  allow-update {
+    key "key-external";
+  };
+
+  include "/etc/bind/zones/named.conf.local.common";
+  include "/etc/bind/zones/named.conf.local.external";
+};

bind/config/rndc.conf

@@ -0,0 +1,10 @@
+key "rndc-key" {
+        algorithm hmac-md5;
+        secret "DNS_TSIG_KEY_RNDC_SECRET";
+};
+
+options {
+        default-key "rndc-key";
+        default-server 127.0.0.1;
+        default-port 953;
+};

bind/run.sh

@@ -0,0 +1,8 @@
+#! /usr/bin/env bash
+
+. /common.sh
+
+replace_files
+
+exec named -f -d 10 -4
+#exec cat /etc/bind/named.conf; named-checkconf -z; named -f -d 10 -4

bind/vars-files

@@ -0,0 +1,3 @@
+named.conf /etc/bind/named.conf
+named.conf.local /etc/bind/named.conf.local
+rndc.conf /etc/bind/rndc.conf

bind/vars-vars

@@ -0,0 +1,19 @@
+DHCP_DNS_MASTER
+DHCP_DNS_SERVER
+DHCP_TFTP_SERVER
+DHCP_ROUTERS
+
+DHCP_DOMAIN
+DHCP_SITE_DOMAIN
+DHCP_DYN_IPS_DOMAIN
+DHCP_REV_DOMAIN
+
+DHCP_SUBNET
+DHCP_NETMASK
+DHCP_IP_FIRST
+DHCP_IP_LAST
+DHCP_BROADCAST
+
+DNS_TSIG_KEY_INTERNAL_SECRET
+DNS_TSIG_KEY_EXTERNAL_SECRET
+DNS_TSIG_KEY_RNDC_SECRET

data/bind/zones/common/db.example.com

@@ -0,0 +1,21 @@
+$ORIGIN .
+$TTL 86400	; 1 day
+example.com		IN SOA	ns1.example.com. hostmaster.example.com. (
+				2002022402 ; serial
+				10800      ; refresh (3 hours)
+				15         ; retry (15 seconds)
+				604800     ; expire (1 week)
+				10800      ; minimum (3 hours)
+				)
+$TTL 600	; 10 minutes
+			NS	ns1.example.com.
+			NS	ns2.example.com.
+			MX	10 mail.example.com.
+$ORIGIN example.com.
+mail			A	24.24.24.24
+ns1			A	24.24.24.24
+ns2			A	24.24.24.42
+serv1			CNAME	serv1.site1
+serv2			CNAME	serv2.site1
+$TTL 300	; 5 minutes
+test			A	42.42.42.42

data/bind/zones/external/db.site1.example.com

@@ -0,0 +1,17 @@
+$ORIGIN .
+$TTL 86400	; 1 day
+site1.example.com	IN SOA	ns1.example.com. hostmaster.example.com. (
+				2002022402 ; serial
+				10800      ; refresh (3 hours)
+				15         ; retry (15 seconds)
+				604800     ; expire (1 week)
+				10800      ; minimum (3 hours)
+				)
+$TTL 600	; 10 minutes
+			NS	ns1.example.com.
+			NS	ns2.example.com.
+$ORIGIN site1.example.com.
+$TTL 600	; 10 minutes
+serv1			CNAME	site1
+serv2			CNAME	site1
+site1			A	42.42.42.43

data/bind/zones/internal/db.100.15.10.in-addr.arpa

@@ -0,0 +1,15 @@
+$ORIGIN .
+$TTL 86400	; 1 day
+100.15.10.in-addr.arpa	IN SOA	ns1.example.com. hostmaster.example.com. (
+				2002022406 ; serial
+				10800      ; refresh (3 hours)
+				15         ; retry (15 seconds)
+				604800     ; expire (1 week)
+				10800      ; minimum (3 hours)
+				)
+$TTL 600	; 10 minutes
+			NS	ns1.example.com.
+$ORIGIN 100.15.10.in-addr.arpa.
+50			PTR	user1-lt1.dhcp.site1.example.com.
+$TTL 300	; 5 minutes
+55			PTR	betaclean-lt1.dhcp.site1.example.com.

data/bind/zones/internal/db.dhcp.site1.example.com

@@ -0,0 +1,15 @@
+$ORIGIN .
+$TTL 86400	; 1 day
+dhcp.site1.example.com	IN SOA	ns1.example.com. hostmaster.example.com. (
+				2002022408 ; serial
+				10800      ; refresh (3 hours)
+				15         ; retry (15 seconds)
+				604800     ; expire (1 week)
+				10800      ; minimum (3 hours)
+				)
+$TTL 600	; 10 minutes
+			NS	ns1.example.com.
+$ORIGIN dhcp.site1.example.com.
+$TTL 300	; 5 minutes
+betaclean-lt1		A	10.15.100.55
+			TXT	"31b93fc9347fc03ee8b440163a6886baf2"

data/bind/zones/internal/db.site1.example.com

@@ -0,0 +1,13 @@
+$TTL  10m
+;$ORIGIN site1.example.com.
+@  1D  IN  SOA ns1.example.com. hostmaster.example.com. (
+            2002022401 ; serial
+            3H ; refresh
+            15 ; retry
+            1w ; expire
+            3h ; nxdomain ttl
+           )
+        IN  NS     ns1.example.com.
+site1   IN  A      42.42.42.42
+serv1   IN  A      10.15.0.1
+serv2   IN  A      10.15.0.2

data/bind/zones/named.conf.local.common

@@ -0,0 +1,4 @@
+zone "example.com" {
+  type master;
+  file "/etc/bind/zones/common/db.example.com";
+};

data/bind/zones/named.conf.local.external

@@ -0,0 +1,4 @@
+zone "site1.example.com" {
+  type master;
+  file "/etc/bind/zones/external/db.site1.example.com";
+};

data/bind/zones/named.conf.local.internal

@@ -0,0 +1,12 @@
+zone "site1.example.com" {
+  type master;
+  file "/etc/bind/zones/internal/db.site1.example.com";
+};
+zone "dhcp.site1.example.com" {
+  type master;
+  file "/etc/bind/zones/internal/db.dhcp.site1.example.com";
+};
+zone "100.15.10.in-addr.arpa" {
+  type master;
+  file "/etc/bind/zones/internal/db.100.15.10.in-addr.arpa";
+};

docker-compose.yml

@@ -1,6 +1,18 @@
 version: '2'
 
 services:
+    bind:
+        build: ./bind
+        container_name: dhcp-bind
+#        restart: unless-stopped
+        volumes:
+            - ./data/bind/zones:/etc/bind/zones
+        ports:
+            - "0.0.0.0:53:53/udp"
+            - "0.0.0.0:53:53/tcp"
+        env_file:
+            - env
+
     isc-dhcp:
         build: ./isc-dhcp
         container_name: dhcp-isc-dhcp

env

@@ -1,15 +1,11 @@
-DHCP_TSIG_KEY_NAME=dhcpupdate
-DHCP_TSIG_KEY_ALGO=hmac-md5
-DHCP_TSIG_KEY_SECRET=change_it
-
-DHCP_DNS_MASTER=10.15.100.1
-DHCP_DNS_SERVER=10.15.100.1
-DHCP_TFTP_SERVER=10.15.100.1
-DHCP_ROUTERS=10.15.100.1
+DHCP_DNS_MASTER=10.15.100.3
+DHCP_DNS_SERVER=10.15.100.3
+DHCP_TFTP_SERVER=10.15.100.3
+DHCP_ROUTERS=10.15.100.2
 
 DHCP_DOMAIN=example.com
-DHCP_SITE_DOMAIN=site.example.com
-DHCP_DYN_IPS_DOMAIN=dhcp.site.example.com
+DHCP_SITE_DOMAIN=site1.example.com
+DHCP_DYN_IPS_DOMAIN=dhcp.site1.example.com
 DHCP_REV_DOMAIN=100.15.10.in-addr.arpa.
 
 DHCP_SUBNET=10.15.100.0
@@ -17,3 +13,7 @@ DHCP_NETMASK=255.255.255.0
 DHCP_IP_FIRST=10.15.100.50
 DHCP_IP_LAST=10.15.100.250
 DHCP_BROADCAST=10.15.100.255
+
+DNS_TSIG_KEY_INTERNAL_SECRET=change_it
+DNS_TSIG_KEY_EXTERNAL_SECRET=change_it
+DNS_TSIG_KEY_RNDC_SECRET=change_it

isc-dhcp/dhcpd.conf

@@ -1,22 +1,22 @@
 #Dynamic DNS security settings
-key DHCP_TSIG_KEY_NAME {
-        algorithm DHCP_TSIG_KEY_ALGO;
-        secret "DHCP_TSIG_KEY_SECRET";
+key "key-internal" {
+        algorithm HMAC-MD5;
+        secret "DNS_TSIG_KEY_INTERNAL_SECRET";
 };
 
 zone DHCP_DYN_IPS_DOMAIN {
     primary DHCP_DNS_MASTER;
-    key DHCP_TSIG_KEY_NAME;
+    key "key-internal";
 }
 
 zone DHCP_SITE_DOMAIN {
     primary DHCP_DNS_MASTER;
-    key DHCP_TSIG_KEY_NAME;
+    key "key-internal";
 }
 
 zone DHCP_REV_DOMAIN {
     primary DHCP_DNS_MASTER;
-    key DHCP_TSIG_KEY_NAME;
+    key "key-internal";
 }
 
 
@@ -33,7 +33,6 @@ ddns-updates on;
 ddns-update-style interim;
 update-static-leases on;
 #allow client-updates;
-ddns-rev-domainname "in-addr.arpa.";
 
 # Misc settings
 use-host-decl-names on;

isc-dhcp/vars-vars

@@ -1,7 +1,3 @@
-DHCP_TSIG_KEY_NAME
-DHCP_TSIG_KEY_ALGO
-DHCP_TSIG_KEY_SECRET
-
 DHCP_DNS_MASTER
 DHCP_DNS_SERVER
 DHCP_TFTP_SERVER
@@ -17,3 +13,7 @@ DHCP_NETMASK
 DHCP_IP_FIRST
 DHCP_IP_LAST
 DHCP_BROADCAST
+
+DNS_TSIG_KEY_INTERNAL_SECRET
+DNS_TSIG_KEY_EXTERNAL_SECRET
+DNS_TSIG_KEY_RNDC_SECRET

tftpd/vars-vars

@@ -1,7 +1,3 @@
-DHCP_TSIG_KEY_NAME
-DHCP_TSIG_KEY_ALGO
-DHCP_TSIG_KEY_SECRET
-
 DHCP_DNS_MASTER
 DHCP_DNS_SERVER
 DHCP_TFTP_SERVER
@@ -17,3 +13,7 @@ DHCP_NETMASK
 DHCP_IP_FIRST
 DHCP_IP_LAST
 DHCP_BROADCAST
+
+DNS_TSIG_KEY_INTERNAL_SECRET
+DNS_TSIG_KEY_EXTERNAL_SECRET
+DNS_TSIG_KEY_RNDC_SECRET

update_vars.sh

@@ -1,7 +1,7 @@
 #! /usr/bin/env sh
 
 vars=$(cat env | cut -d= -f1)
-for docker in isc-dhcp tftpd apache
+for docker in isc-dhcp tftpd apache bind
 do
   echo "${vars}" > "./${docker}/vars-vars"
 done