mirror of
https://github.com/casjaysdevdocker/bind
synced 2026-07-31 20:11:38 -04:00
jason
2401603bec
CLAUDE.md .claude/settings.local.json Dockerfile .env.scripts PLAN.md README.md rootfs/root/docker/setup/02-packages.sh rootfs/root/docker/setup/05-custom.sh rootfs/root/docker/setup/07-cleanup.sh rootfs/tmp/etc/bind/named.conf rootfs/usr/local/bin/entrypoint.sh
109 lines
5.4 KiB
Plaintext
109 lines
5.4 KiB
Plaintext
# default options - https://bind9.readthedocs.io/en/latest/chapter3.html
|
|
#####################################################################
|
|
# NOTE on client source IPs:
|
|
#
|
|
# If named's query log only shows the docker bridge gateway (e.g.
|
|
# 172.17.0.1) as the client, that is a Docker NAT artifact - the default
|
|
# userland docker-proxy rewrites the source IP of forwarded UDP/TCP.
|
|
# To see real external client IPs, run the container with EITHER:
|
|
#
|
|
# docker run --network=host ... (skip port publishing)
|
|
#
|
|
# - or configure dockerd with userland-proxy disabled in
|
|
# /etc/docker/daemon.json:
|
|
# { "userland-proxy": false }
|
|
# and restart docker. iptables DNAT then preserves source IPs.
|
|
#
|
|
# bind itself sees whatever the kernel hands it; it can't recover an IP
|
|
# the proxy already discarded.
|
|
#####################################################################
|
|
# rndc keys
|
|
key "dhcp-key" { algorithm hmac-sha512; secret "REPLACE_KEY_DHCP"; };
|
|
key "rndc-key" { algorithm hmac-sha512; secret "REPLACE_KEY_RNDC"; };
|
|
key "certbot." { algorithm hmac-sha512; secret "REPLACE_KEY_CERTBOT"; };
|
|
key "backup-key" { algorithm hmac-sha512; secret "REPLACE_KEY_BACKUP"; };
|
|
#####################################################################
|
|
# access settings
|
|
acl "all" { 0.0.0.0/0; ::/0; };
|
|
acl "secondary" { REPLACE_DNS_SERVER_TRANSFER_IP };
|
|
acl "trusted" { 10.0.0.0/8; 127.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16; };
|
|
acl "updates" { key "dhcp-key"; key "certbot."; };
|
|
acl "transfers" {key "dhcp-key"; key "certbot."; key "backup-key"; secondary; };
|
|
acl "forward" { 1.1.1.1; 8.8.8.8; 4.4.4.4; };
|
|
#####################################################################
|
|
# rndc settings
|
|
controls { inet 127.0.0.1 allow { trusted; } keys { "rndc-key"; }; };
|
|
#####################################################################
|
|
options {
|
|
directory "REPLACE_VAR_DIR";
|
|
pid-file "REPLACE_RUN_DIR/named.pid";
|
|
managed-keys-directory "REPLACE_ETC_DIR/keys";
|
|
dump-file "REPLACE_DATA_DIR/stats/dump.txt";
|
|
statistics-file "REPLACE_DATA_DIR/stats/stats.txt";
|
|
memstatistics-file "REPLACE_DATA_DIR/stats/mem.txt";
|
|
version "9";
|
|
listen-on { any; };
|
|
listen-on-v6 { any; };
|
|
zone-statistics yes;
|
|
max-cache-size 60m;
|
|
interface-interval 60;
|
|
max-ncache-ttl 10800;
|
|
max-udp-size 4096;
|
|
notify yes;
|
|
also-notify { REPLACE_DNS_SERVER_TRANSFER_IP };
|
|
allow-update { updates; };
|
|
allow-update-forwarding { REPLACE_DNS_SERVER_TRANSFER_IP };
|
|
allow-transfer { trusted; };
|
|
transfer-format many-answers;
|
|
allow-query { any; };
|
|
allow-recursion { any; };
|
|
allow-query-cache { any; };
|
|
auth-nxdomain no;
|
|
dnssec-validation auto;
|
|
forwarders { 1.1.1.1; 8.8.8.8; 4.4.4.4; };
|
|
};
|
|
#####################################################################
|
|
# named logging options
|
|
logging {
|
|
channel debug { file "REPLACE_LOG_DIR/debug.run" versions 0 size 5m; severity debug; };
|
|
channel querylog { file "REPLACE_LOG_DIR/querylog.log" versions 0 size 5m; severity info; print-time yes; };
|
|
channel security { file "REPLACE_LOG_DIR/security.log" versions 0 size 5m; severity dynamic; print-severity yes; print-time yes; };
|
|
channel xfer-in { file "REPLACE_LOG_DIR/xfer.log" versions 0 size 5m; severity info; print-category yes; print-severity yes; print-time yes; };
|
|
channel xfer-out { file "REPLACE_LOG_DIR/xfer.log" versions 0 size 5m; severity info; print-category yes; print-severity yes; print-time yes; };
|
|
channel update { file "REPLACE_LOG_DIR/update.log" versions 0 size 5m; severity info; print-category yes; print-severity yes; print-time yes; };
|
|
channel notify { file "REPLACE_LOG_DIR/notify.log" versions 0 size 5m; severity info; print-category yes; print-severity yes; print-time yes; };
|
|
channel client { file "REPLACE_LOG_DIR/client.log" versions 0 size 5m; severity debug; print-category yes; print-severity yes; print-time yes; };
|
|
channel default { file "REPLACE_LOG_DIR/default.log" versions 0 size 5m; severity debug; print-category yes; print-severity yes; print-time yes; };
|
|
channel general { file "REPLACE_LOG_DIR/general.log" versions 0 size 5m; severity info; print-category yes; print-severity yes; print-time yes; };
|
|
channel database { file "REPLACE_LOG_DIR/database.log" versions 0 size 5m; severity info; print-category yes; print-severity yes; print-time yes; };
|
|
category lame-servers { default; debug; };
|
|
category dispatch { default; debug; };
|
|
category queries { querylog; default; debug; };
|
|
category update { update; default; debug; };
|
|
category network { default; debug; };
|
|
category unmatched { default; debug; };
|
|
category client { client; default; debug; };
|
|
category notify { notify; default; debug; };
|
|
category xfer-out { xfer-out; default; debug; };
|
|
category xfer-in { xfer-in; default; debug; };
|
|
category resolver { default; debug; };
|
|
category config { default; debug; };
|
|
category security { security; default; debug; };
|
|
category database { database; default; debug; };
|
|
category general { general; default; debug; };
|
|
category default { default; debug; };
|
|
category dnssec { security; default; debug; };
|
|
};
|
|
#####################################################################
|
|
# ********** begin root info **********
|
|
zone "." {
|
|
type hint;
|
|
file "REPLACE_VAR_DIR/root.cache";
|
|
};
|
|
# ********** end root info **********
|
|
#####################################################################
|
|
# ********** begin imports **********
|
|
include "REPLACE_ETC_DIR/zones.conf";
|
|
# ********** end imports info **********
|
|
#####################################################################
|