DNS Infrastructure SOP
We have two DNS server, the primary is at ns1.fedoraproject.org and is hosted at ServerBeach, from there it replicates to dns1.j2solutions.net.
Owner: Fedora Infrastructure Team
Contact: #fedora-admin, sysadmin-main
Location: ServerBeach and ibiblio
Servers: ns1.fedoraproject.org, ns2.fedorparoject.org
Purpose: Provides DNS to our users
Troubleshooting, Resolution and Maintenance
DNS config files are puppet managed on puppet1. The update is standard to the puppet configs at http://fedoraproject.org/wiki/Infrastructure/Puppet/QuickStart
git clone /git/puppet cd puppet/modules/bind/files/master vi fedoraproject.org # Don't forget to increment the serial! cd ../.. git commit -m "What you did" git push
It should update within a half hour. You can test the new configs with dig:
dig @ns1.fedoraproject.org fedoraproject.org dig @ns2.fedorpaorject.org cvs.fedoraproject.org
Adding a new zone
First name the zone and generate new set of keys for it. Run this on ns1. Note it could take SEVERAL minutes to run:
/usr/sbin/dnssec-keygen -a RSASHA1 -b 1024 -n ZONE c.fedoraproject.org ; /usr/sbin/dnssec-keygen -a RSASHA1 -b 2048 -n ZONE -f KSK c.fedoraproject.org
Then copy the created .key and .private files to the private git repo (You need to be sysadmin-main to do this). The directory is private/private/dnssec.
Once that is done you can add the new zone to the puppet/modules/bind/files/master/ directory. Then add the new zone to puppet/modules/bind/files/zones.conf. Note: If you're adding a new geodns zone, you need to do that directly in the named.conf file, not zones.conf.
The last thing you need to do is make sure to put the .key file contents at the bottom of your zone file. See other zone files for an example. The .key file you generated earlier.
If you add a new child zone, such as c.fedoraproject.org or vpn.fedoraproject.org you will also need to add the contents of dsset-childzone.fedoraproject.org (for example), to the main fedoraproject.org zonefile, so that DNSSEC has a valid trust path to that zone.
In order to make the network more transparent to the admins we do a lot of search based relative names. Below is a list of what a resolv.conf should look like.
search fedora.phx.redhat.com vpn.fedoraproject.org fedoraproject.org
search vpn.fedoraproject.org fedoraproject.org
The idea here is that we can, when need be, setup local domains to contact instead of having to go over the VPN directly but still have sane configs. For example if we tell the proxy server to hit "app1" and that box is in PHX, it will go directly to app1, if its not, it will go over the vpn to app1.