From cd833bc2852ec204fbaecde7ada56798eba005da Mon Sep 17 00:00:00 2001
From: Mike Crute <mike@crute.us>
Date: Mon, 18 Jan 2021 06:24:42 +0000
Subject: bind: new hosting config update

---
 bind/Dockerfile      |  8 +++--
 bind/conf/named.conf | 82 ++++++++++++++++++++++++++++++----------------------
 bind/entrypoint.sh   | 23 +++++++++++++++
 3 files changed, 76 insertions(+), 37 deletions(-)
 create mode 100755 bind/entrypoint.sh

diff --git a/bind/Dockerfile b/bind/Dockerfile
index 677eaf4..bb23637 100644
--- a/bind/Dockerfile
+++ b/bind/Dockerfile
@@ -14,11 +14,13 @@ RUN set -euxo pipefail; \
     curl -o /etc/bind/db.root https://www.internic.net/domain/named.cache;
 
 ADD conf/ /etc/bind/
-ADD bind_bootstrap /
-ADD zones.yaml /etc/bind/zones.yaml
+ADD entrypoint.sh /
+#ADD bind_bootstrap /
+#ADD zones.yaml /etc/bind/zones.yaml
 
 RUN set -euxo pipefail; \
     chown -R named:named /etc/bind;
 
-ENTRYPOINT [ "/bind_bootstrap" ]
+#ENTRYPOINT [ "/bind_bootstrap" ]
+ENTRYPOINT [ "/entrypoint.sh" ]
 CMD [ "/usr/sbin/named", "-u", "named", "-g" ]
diff --git a/bind/conf/named.conf b/bind/conf/named.conf
index dcf0cf3..b7d563d 100644
--- a/bind/conf/named.conf
+++ b/bind/conf/named.conf
@@ -2,41 +2,47 @@
 
 include "/etc/bind/rndc.key";
 
-options {
-	directory "/etc/bind/local/cache";
-	bindkeys-file "/etc/bind/bind.keys";
-
-	//========================================================================
-	// If BIND logs error messages about the root key being expired,
-	// you will need to update your keys.  See https://www.isc.org/bind-keys
-	//========================================================================
+//========================================================================
+// If BIND logs error messages about the root key being expired,
+// you will need to update your keys.  See https://www.isc.org/bind-keys
+//========================================================================
 
-	// mcrute: disable dnssec because the AWS resolvers return invalid zone
-	// signatures
-	dnssec-validation no;
-
-	zone-statistics full;
+options {
+	directory "/etc/bind/local/zones";
+	managed-keys-directory "/etc/bind/local/managed-keys";
+	bindkeys-file "/etc/bind/bind.keys"; // Default is /etc/bind.keys :-(
 
-	auth-nxdomain no;    # conform to RFC1035
-	notify master-only;  # don't send NOTIFY from secondaries
+	dnssec-validation no; // AWS resolvers return invalid zone signatures
+	zone-statistics full; // Track full stats for prometheus export
+	masterfile-format text; // Write zonefiles in text even for secondary zones
+	auth-nxdomain no; // conform to RFC1035
+	notify master-only; // don't send NOTIFY from secondaries
 
 	version none;
 	hostname none;
 
-	listen-on {
-		any;
-	};
+	// Force TCP if response would be larger than IPv6 fragment size
+	// see: https://blog.apnic.net/2020/09/17/dns-flag-day-2020-what-you-need-to-know/
+	max-udp-size 1220;
+	edns-udp-size 1220;
 
-	listen-on-v6 {
-		any;
-	};
+	// Allow more transfers at once to improve secondary convergence
+	transfers-in 50;
+	transfers-out 50;
+
+	listen-on { any; };
+	listen-on-v6 { any; };
+	allow-update-forwarding { any; };
 
-	allow-update-forwarding {
-		any;
+	// Typically this ACL is empty but exists so that it can be populated
+	// during an attack to block bad clients.
+	blackhole {
+		blackhole-clients;
 	};
 
 	allow-notify {
-		all-dns-servers;
+		internal-keys;
+		external-keys;
 	};
 
 	allow-recursion {
@@ -48,15 +54,6 @@ options {
 		internal-nets;
 		localhost;
 	};
-
-	// Force TCP if response would be larger than IPv6 fragment size
-	// see: https://blog.apnic.net/2020/09/17/dns-flag-day-2020-what-you-need-to-know/
-	max-udp-size 1220;
-	edns-udp-size 1220;
-
-	// Allow more transfers at once to improve secondary convergence
-	transfers-in 50;
-	transfers-out 50;
 };
 
 statistics-channels {
@@ -69,4 +66,21 @@ controls {
 	inet ::1 allow { localhost; } keys { "rndc-key"; };
 };
 
-include "/etc/bind/named_local.conf";
+acl internal-nets {
+	// Internal RFC1918
+	172.16.0.0/12;
+
+	// Unknown? Maybe Docker bridge?
+	192.168.255.0/24;
+
+	// Pomona ARIN
+	23.149.16.0/24;
+	2602:0803:4000::/40;
+
+	// AWS
+	2600:1f14:f39:e000::/56;
+	2600:1f16:33:500::/56;
+	2a05:d01c:7ba:b800::/56;
+};
+
+include "/etc/bind/local/named.conf";
diff --git a/bind/entrypoint.sh b/bind/entrypoint.sh
new file mode 100755
index 0000000..b8b5a9c
--- /dev/null
+++ b/bind/entrypoint.sh
@@ -0,0 +1,23 @@
+#!/bin/sh
+
+set -e
+
+RNDC_KEY_FILE="/etc/bind/rndc.key"
+
+# Generate an rndc key fresh for every server startup. This is only used for
+# internal management with the rndc command so there's no need to persist it.
+touch $RNDC_KEY_FILE
+chown named:named $RNDC_KEY_FILE
+chmod 0660 $RNDC_KEY_FILE
+/usr/sbin/ddns-confgen -q -k rndc-key > $RNDC_KEY_FILE
+
+# Create directories for secondaries
+for i in $(grep ^view /etc/bind/local/named.conf | cut -d' ' -f2); do
+	mkdir -p /etc/bind/local/zones/$i
+done
+mkdir -p /etc/bind/local/managed-keys
+
+# Make sure BIND can write everything
+chown -R named:named /etc/bind/local
+
+exec "$@"
-- 
cgit v1.2.3