From 3a4646c4caecb68de553d285896036a767a71fa0 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Dec 02 2025 18:18:56 +0000 Subject: Update the dns SOP Signed-off-by: Kevin Fenzi --- diff --git a/modules/sysadmin_guide/pages/dns.adoc b/modules/sysadmin_guide/pages/dns.adoc index dae3d87..f60092c 100644 --- a/modules/sysadmin_guide/pages/dns.adoc +++ b/modules/sysadmin_guide/pages/dns.adoc @@ -11,16 +11,14 @@ are allowed. We have 5 DNS servers: +ns01.rdu3.fedoraproject.org:: + in rdu3, internal to rdu3. (ipv6 enabled) ns02.fedoraproject.org:: hosted at ibiblio (ipv6 enabled) ns05.fedoraproject.org:: hosted at internetx (ipv6 enabled) -ns13.rdu2.fedoraproject.org:: - in rdu2, internal to rdu2. -ns01.rdu3.fedoraproject.org:: - in rdu3, internal to rdu3. -ns02.rdu3.fedoraproject.org:: - in rdu3, internal to rdu3. +ns03.rdu3.fedoraproject.org:: + in rdu3, internal to rdu3. (ipv6 enabled) == Contents @@ -41,13 +39,13 @@ ns02.rdu3.fedoraproject.org:: Owner::: Fedora Infrastructure Team Contact::: - #fedora-admin, sysadmin-main, sysadmin-dns + #fedora-admin:fedoraproject.org, sysadmin-main, sysadmin-dns Location::: - ServerBeach and ibiblio and internetx and phx2. + ibiblio and internetx and rdu3. Servers::: - ns02, ns05, ns13.rdu2, ns01.rdu3, ns02.rdu3 + ns02, ns05, ns01.rdu3, ns03.rdu3 Purpose::: - Provides DNS to our users + Provides DNS to our users and ourselves == Troubleshooting, Resolution and Maintenance @@ -61,6 +59,14 @@ $ git clone /srv/git/dns NOTE: Only members of the group `sysadmin-dns` may push changes to this repo. +You can also checkout a copy remotely: + +.... +$ git clone https://infrastructure.fedoraproject.org/infra/dns +.... + +This is the same copy/view that the nameservers themselves have. + === Adding a new Host Adding a new host requires to add it to DNS and to ansible, see @@ -111,12 +117,14 @@ fedoraproject.org: When complete run: .... -git add . git commit -a -m 'description of your change here' +git add . ; git commit -a -m 'description of your change here' .... It is important to commit this before running the do-domains script as it makes it easier to track the changes. +The `./do-domains` script signs our zones for dnssec and checks them. + In all cases then run: * `./do-domains` @@ -161,7 +169,7 @@ name server. === DNS update -DNS config files are ansible managed on batcave01. +DNS config files are ansible managed From your local machine run: @@ -186,13 +194,13 @@ First name the zone and generate new set of keys for it. Run this on ns01. Note it could take SEVERAL minutes to run: .... -/usr/sbin/dnssec-keygen -a RSASHA1 -b 1024 -n ZONE c.fedoraproject.org -/usr/sbin/dnssec-keygen -a RSASHA1 -b 2048 -n ZONE -f KSK c.fedoraproject.org +/usr/sbin/dnssec-keygen -a ECDSAP384SHA384 -n ZONE c.fedoraproject.org +/usr/sbin/dnssec-keygen -a ECDSAP384SHA384 -n ZONE -f KSK c.fedoraproject.org .... Then copy the created .key and .private files to the private git repo (You need to be sysadmin-main to do this). The directory is -`private/private/dnssec`. +`/srv/privatekeys/dnssec`. * add the zone in zones.conf in `ansible/roles/dns/files/zones.conf` * save and commit - but do not push @@ -203,8 +211,8 @@ Then copy the created .key and .private files to the private git repo ** create a new key: + .... -/usr/sbin/dnssec-keygen -a RSASHA1 -b 1024 -n ZONE $domain.org -/usr/sbin/dnssec-keygen -a RSASHA1 -b 2048 -n ZONE -f KSK $domain.org +/usr/sbin/dnssec-keygen -a ECDSAP384SHA384 -n ZONE $domain.org +/usr/sbin/dnssec-keygen -a ECDSAP384SHA384 -n ZONE -f KSK $domain.org - put the files this generates into /srv/privatekeys/dnssec on batcave01 - edit the do-domains file in this dir and your domain to the @@ -248,26 +256,15 @@ sending users to proxy servers that are near them. The current list of available 'zone areas' are: * DEFAULT -* EU * NA +* EU +* APAC +* AFR +* SA DEFAULT contains all the zones. So someone who does not seem to be in or -near the EU, or NA would get directed to any random set. (South Africa -for example doesn't get directed to any particular server). +near the EU, or NA would get directed to any random set. -[IMPORTANT] -==== -Don't forget to increase the serial number in the fedoraproject.org zone -file. Even if you're making a change to one of the geodns IPs. There is -only one serial number for all setups and that serial number is in the -fedoraproject.org zone. -==== -[NOTE] -==== -Non geodns fedoraproject.org IPs If you're adding as server that is just -in one location, and isn't going to get geodns balanced. Just add that -host to the fedoraproject.org zone. -==== === Adding and removing countries Our setup actually requires us to specify which countries go to which