robonuka/nsd repository overview

⁠NSD on Kubernetes

⁠What is this software

NSD⁠ is an authoritative only, high performance, simple and open source name server released under the BSD licence. This work is originally based on hardware/nsd-dnssec⁠.

⁠Features

• Lightweight & secure image (based on Alpine & multi-stage build: 4MB, no root process)
• Latest NSD version with hardening compilation options
• Helper scripts for generating ZSK and KSK keys, DS-Records management and zone signature
• Optimized to be run on Kubernetes with ConfigMap

⁠Run on Kubernetes

See docs/KUBERNETES.md⁠

⁠Run with Docker-compose

version: '3.7'

services:
  nsd:
    container_name: nsd
    restart: always
    image: ghcr.io/the-kube-way/nsd:latest  # or nsd:vX.X.X
    read_only: true
    tmpfs:
      - /tmp
      - /var/db/nsd
    volumes:
      - /mnt/nsd/conf:/etc/nsd:ro
      - /mnt/nsd/zones:/zones
      - /mnt/nsd/keys:/keys:ro
    ports:
      - 53:53
      - 53:53/udp

Ensure mount points match UID/GID (991 by default) used by nsd.

/etc/nsd should be mounted read-only.
/zones can be mounted read-only if helper scripts (e.g. for dnssec) are not used.
/keys should be mounted read-only if keygen helper script is not used.

⁠Configuration example

Put your dns zone file in /mnt/nsd/zones/domain.tld.

$ORIGIN domain.tld.
$TTL 3600

; SOA
; SOA record should be on one line to use provided helper scripts
@   IN   SOA   ns1.domain.tld. hostmaster.domain.tld. 2016020202 7200 1800 1209600 86400

; NAMESERVERS
@                   IN                NS                   ns1.domain.tld.
@                   IN                NS                   ns2.domain.tld.

; A RECORDS
@                   IN                A                    1.2.3.4
www                 IN                A                    5.6.7.8

...

Put the nsd config in /mnt/nsd/conf/nsd.conf.

server:
  server-count: 1
  verbosity: 1
  hide-version: yes
  zonesdir: "/zones"

zone:
  name: domain.tld
  #zonefile: domain.tld  # if not signed
  zonefile: domain.tld.signed

Check the documentation⁠ to see all options.

⁠Check the configuration

Check your zone and nsd configuration:

cd /mnt/nsd
docker run -it --rm -v $(pwd)/zones:/zones selfhostingtools/nsd nsd-checkzone domain.tld /zones/domain.tld
docker run -it --rm -v $(pwd)/conf:/etc/nsd selfhostingtools/nsd nsd-checkconf /etc/nsd/nsd.conf

⁠Environment variables

You may want to change the running user:

⁠Generating DNSSEC keys and signed zone

Generate ZSK and KSK keys with ECDSAP384SHA384 algorithm:

docker-compose exec nsd keygen domain.tld

Keys will be stored in /keys/Kdomain.tld.{zsk,ksk}.{key,private}

Then sign your dns zone (default expiration date is 1 month):

docker-compose exec nsd signzone domain.tld

# or set custom RRSIG RR expiration date:
docker-compose exec nsd signzone domain.tld [YYYYMMDDhhmmss]

:warning: Do not forget to add a cron task to sign your zone periodically to avoid the expiration of RRSIG RR records!

This can be done using systemd timer on the host:

/etc/systemd/system/nsd_update_signature.service

[Unit]
Description=NSD update signature

[Service]
Type=oneshot
ExecStart=docker exec nsd signzone domain.tld

/etc/systemd/system/nsd_update_signature.timer

[Timer]
OnCalendar=weekly

[Install]
WantedBy=multi-user.target

Don't forget to enable and start the timer!

Show your DS-Records (Delegation Signer):

docker-compose exec nsd ds-records domain.tld

Ensure zonefile parameter is correctly set (e.g. domain.tld.signed) in nsd.conf.

Restart nsd to take the changes into account:

docker-compose restart nsd

⁠Build the image

Build-time variables:

• NSD_VERSION : version of NSD
• GPG_FINGERPRINT : fingerprint of signing key
• SHA256_HASH : SHA256 hash of NSD archive