DNS Infrastructure SOP

From FedoraProject

(Difference between revisions)
Jump to: navigation, search
(redirect page to new infra-docs)
 
(4 intermediate revisions by 3 users not shown)
Line 2: Line 2:
 
{{shortcut|ISOP:DNS}}
 
{{shortcut|ISOP:DNS}}
  
We have two DNS server, the primary is at ns1.fedoraproject.org and is hosted at ServerBeach, from there it replicates to dns1.j2solutions.net.
 
  
== Contact Information ==
+
This SOP has moved to the fedora Infrastructure SOP git repo. Please see the current document at: http://infrastructure.fedoraproject.org/infra/docs/dns.txt
Owner: Fedora Infrastructure Team
+
  
Contact: #fedora-admin, sysadmin-main
+
For changes, questions or comments, please contact anyone in the Fedora Infrastructure team.
  
Location: ServerBeach and ibiblio
 
 
Servers: ns1.fedoraproject.org, ns2.fedorparoject.org
 
 
Purpose: Provides DNS to our users
 
 
== Troubleshooting, Resolution and Maintenance ==
 
 
=== DNS update ===
 
DNS config files are puppet managed on puppet1.  The update is standard to the puppet configs at http://fedoraproject.org/wiki/Infrastructure/Puppet/QuickStart
 
 
From puppet1:
 
<pre>
 
git clone /git/puppet
 
cd puppet/modules/bind/files/master
 
vi fedoraproject.org # Don't forget to increment the serial!
 
cd ../..
 
git commit -m "What you did"
 
git push
 
</pre>
 
 
It should update within a half hour.  You can test the new configs with dig:
 
 
<pre>
 
dig @ns1.fedoraproject.org fedoraproject.org
 
dig @ns2.fedorpaorject.org cvs.fedoraproject.org
 
</pre>
 
 
=== Adding a new zone ===
 
 
First name the zone and generate new set of keys for it.  Run this on ns1.  Note it could take SEVERAL minutes to run:
 
 
<pre>
 
/usr/sbin/dnssec-keygen -a RSASHA1 -b 1024 -n ZONE c.fedoraproject.org ; /usr/sbin/dnssec-keygen -a RSASHA1 -b 2048 -n ZONE -f KSK c.fedoraproject.org
 
</pre>
 
 
Then copy the created .key and .private files to the private git repo (You need to be sysadmin-main to do this).  The directory is private/private/dnssec.
 
 
Once that is done you can add the new zone to the puppet/modules/bind/files/master/ directory.  Then add the new zone to puppet/modules/bind/files/zones.conf.  Note: If you're adding a new geodns zone, you need to do that directly in the named.conf file, not zones.conf.
 
 
== resolv.conf ==
 
 
In order to make the network more transparent to the admins we do a lot of search based relative names.  Below is a list of what a resolv.conf should look like.
 
 
{{Admon/important | Any machine that is not on our vpn or has not yet joined the vpn should _NOT_ have the vpn.fedoraproject.org search until after it has been added to the vpn (if it ever does)}}
 
 
=== Phoenix ===
 
<pre>
 
search fedora.phx.redhat.com vpn.fedoraproject.org fedoraproject.org
 
</pre>
 
 
=== Non-Phoenix ===
 
<pre>
 
search vpn.fedoraproject.org fedoraproject.org
 
</pre>
 
 
The idea here is that we can, when need be, setup local domains to contact instead of having to go over the VPN directly but still have sane configs.  For example if we tell the proxy server to hit "app1" and that box is in PHX, it will go directly to app1, if its not, it will go over the vpn to app1.
 
  
 
[[Category:Infrastructure SOPs]]
 
[[Category:Infrastructure SOPs]]

Latest revision as of 03:35, 19 December 2011

Infrastructure InfrastructureTeamN1.png
Shortcut:
ISOP:DNS


This SOP has moved to the fedora Infrastructure SOP git repo. Please see the current document at: http://infrastructure.fedoraproject.org/infra/docs/dns.txt

For changes, questions or comments, please contact anyone in the Fedora Infrastructure team.