update wireguard DNS

Vagrantfile

@@ -3,7 +3,7 @@ Vagrant.configure('2') do |config|
     config.cache.scope = 'machine'
   end
   config.vm.provider :libvirt do |libvirt|
-    libvirt.management_network_domain = "ducamps-dev.win"
+    libvirt.management_network_domain = "ducamps-dev.eu"
 
   end
   config.vm.define "oscar-dev" do |c|

ansible/group_vars/DNS

@@ -0,0 +1,20 @@
+pdns_config:
+  local-address: "127.0.0.1"
+  local-port: "5300"
+  api: yes
+  api-key: 
+
+pdns_backends:
+  gsqlite3:
+    dnssec: yes
+    database: "/var/lib/powerdns/powerdns.sqlite"
+pdns_sqlite_databases_locations: 
+  - "/var/lib/powerdns/powerdns.sqlite"
+
+pdns_rec_config:
+  forward-zones:
+    - "consul=127.0.0.1:8600"
+    - "ducamps.win=192.168.1.10"
+    - "ducamps.eu=192.168.1.10"
+  local-address: "{{ ansible_default_ipv4.address }}"
+  dnssec: "off"

ansible/group_vars/dhcp

@@ -3,7 +3,7 @@ dhcpd_lease_time: '72'
 dhcpd_domain_name: "lan.{{ domain.name }}"
 dhcpd_nameservers:
   - '192.168.1.4'
-  - '192.168.1.10'
+  - '192.168.1.41'
 dhcpd_keys: 
   - key: dhcp
     algorithm: HMAC-MD5

ansible/host_vars/corwin

@@ -11,7 +11,7 @@ wireguard_postup:
   - iptables -A FORWARD -i %i -j ACCEPT
   - iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
   - sysctl -w net.ipv4.ip_forward=1
-  - resolvectl dns %i 192.168.1.4 192.168.1.10; resolvectl domain %i '~ducamps.win' '~consul'
+  - resolvectl dns %i 192.168.1.4 192.168.1.41; resolvectl domain %i '~ducamps.win' '~ducamps.eu' '~consul'
 
 wireguard_postdown:
   - iptables -D FORWARD -i %i -j ACCEPT
@@ -28,7 +28,7 @@ wireguard_unmanaged_peers:
     public_key: rYYljQw8InmM95pxCP9KyZ8R+kcicgnjr6E9qtkI1Ag=
     allowed_ips: 10.0.0.5/32
     persistent_keepalive: 0
-wireguard_dns: "192.168.1.4,192.168.1.10"
+wireguard_dns: "192.168.1.4,192.168.1.41"
 consul_client_addr: "127.0.0.1 10.0.0.1"
 consul_bind_address: "10.0.0.1"
 consul_ui: True

ansible/host_vars/merlin

@@ -25,7 +25,7 @@ wireguard_unmanaged_peers:
     public_key: rYYljQw8InmM95pxCP9KyZ8R+kcicgnjr6E9qtkI1Ag=
     allowed_ips: 10.0.0.5/32
     persistent_keepalive: 0
-wireguard_dns: "192.168.1.40,192.168.1.10"
+wireguard_dns: "192.168.1.41,192.168.1.4"
 consul_client_addr: "127.0.0.1 10.0.0.4"
 consul_bind_address: "10.0.0.4"
 consul_ui: True

ansible/playbooks/dns.yml

@@ -0,0 +1,6 @@
+---
+- name: DNS playbook
+  hosts: DNS
+  roles:
+    - role: pdns_recursor-ansible
+      become: true

ansible/production

@@ -7,6 +7,8 @@ gerard
 corwin
 merlin
 
+[DNS]
+gerard
 
 [dhcp]
 gerard

ansible/roles/requirements.yml

@@ -39,3 +39,5 @@
   scm: git
 - src: git@github.com:vincentDcmps/ansible-role-nfs.git
   scm: git
+- src: https://github.com/PowerDNS/pdns-ansible.git
+- src: https://github.com/PowerDNS/pdns_recursor-ansible.git

ansible/staging

@@ -5,6 +5,9 @@ gerard-dev
 [VPS]
 merlin-dev
 
+[DNS]
+oscar-dev
+
 [database]
 oscar-dev
 

docs/ADR/004-DNS.md

@@ -0,0 +1,31 @@
+# 004 DNS
+
+## Status
+
+In progress
+
+## Context
+
+curently main local domain DNS is located on NAS.
+
+goal:
+
+- avoid DNS outtage in case of NAS reboot (my synology have 10 years and is a litle long to reboot) morever during NAS reboot we lost the adblock DNS in the nomad cluster because nomad depend of the NFS share.
+- remove the direct redirection to service.consul DNS and the IPTABLE rule use to redirect port 53 on consul on gerard instead new DNS could be forward directly to an active consul node on port 8300
+
+### DNS software
+
+need DHCP Dynamic update
+could redirect domain on other port than port 53
+
+## Decision
+
+we will migrate Main Domain DNS from NAS to gerard  (powerDNS)
+powerDNS provide two disting binaries one for authority server one other for recursor
+goal is to first migrate the recursice part from synology to a physical service
+and in second time migrate authority server in nmad cluster
+
+## Consequences
+
+before to move authority server need to remove DB dns dependance (create db consul services)
+need to delete the iptable rule on gerard before deploy