DNS-as-Code на базе dnscontrol

dev1           A      1.2.3.4
dev1-serviceA  CNAME  dev1
dev1-serviceB  CNMAE  dev1
...
dev2           A      1.2.3.4
dev2-serviceA  CNAME  dev2
dev2-serviceB  CNMAE  dev2
...

---
providers:
  config:
    class: octodns.provider.yaml.YamlProvider
    directory: ./config
    default_ttl: 300
    enforce_order: True
  digitalocean:
    class: octodns.provider.digitalocean.DigitalOceanProvider
    token: your-digitalocean-oauth-token

zones:
  your-domain.:
    sources:
      - config
    targets:
      - digitalocean

---
'':
  - type: A
    value: 1.2.3.4

www:
  type: A
  value: 5.6.7.8

// define dummy-registar and Bind-provider
REG_NONE = NewRegistrar('none', 'NONE');
DNS_BIND = NewDnsProvider('bind', 'BIND', {
    // default SOA-records for all domains
    'default_soa': {
        'master': 'ns3-l2.nic.ru.',
        'mbox': 'dns.nic.ru.',
        'refresh': 9999,
        'retry': 9999,
        'expire': 9999000,
        'minttl': 999,
    },
    // default NS-records for all domains
    'default_ns': [
        'ns8-cloud.nic.ru.',
        'ns3-l2.nic.ru.',
        'ns4-l2.nic.ru.',
        'ns8-l2.nic.ru.',
        'ns4-cloud.nic.ru.'
    ]
});

function myzone_ru(REG, PROVIDER){
    return D('myzone.ru', REG, DnsProvider(PROVIDER),
        DefaultTTL('5m')
        ,A('@', '1.2.3.4')
        ,MX('@', 10, 'mx.myzone.ru.', TTL('6h'))
        ,A('www', '1.2.3.4')
        ,CNAME('portal', 'www')
    )
}

function generate_DEV_records (REG, PROVIDER){
    DEV_CNAME_RECORDS = [
        'serviceA'
        ,'serviceB'
    ]
	  dev_stand_count = 5
    dev_public_ip = '1.2.3.4'
    RECORDS = []
    for (var i = 1; i <= dev_stand_count; i++){
        RECORDS.push(
            A('dev' + i, dev_public_ip)
        )
        for (var j = 0; j < DEV_CNAME_RECORDS.length; j++){
            RECORDS.push(
                CNAME('dev' + i + '-' + DEV_CNAME_RECORDS[j], 'dev' + i)
            )
        }
    }

	  return D('myzone.ru', REG, DnsProvider(PROVIDER),
        RECORDS)
}

❯ dnscontrol push
******************** Domain: myzone.ru
----- Getting nameservers from: bind
----- DNS Provider: bind...File does not yet exist: "zones/myzone.ru"
1 correction
#1: GENERATE_ZONEFILE: 'myzone.ru' (new file with 21 records)

WRITING ZONEFILE: zones/myzone.ru
SUCCESS!
----- Registrar: none...0 corrections
Done. 1 corrections.

$TTL 300
; generated with dnscontrol 2021-03-24T23:15:09+03:00
@                IN SOA   ns3-l2.nic.ru. dns.nic.ru. 2021032400 1440 3600 2592000 600
                 IN NS    ns3-l2.nic.ru.
                 IN NS    ns4-cloud.nic.ru.
                 IN NS    ns4-l2.nic.ru.
                 IN NS    ns8-cloud.nic.ru.
                 IN NS    ns8-l2.nic.ru.
dev1             IN A     1.2.3.4
dev1-servicea    IN CNAME dev1.myzone.ru.
dev1-serviceb    IN CNAME dev1.myzone.ru.
dev2             IN A     1.2.3.4
dev2-servicea    IN CNAME dev2.myzone.ru.
dev2-serviceb    IN CNAME dev2.myzone.ru.
dev3             IN A     1.2.3.4
dev3-servicea    IN CNAME dev3.myzone.ru.
dev3-serviceb    IN CNAME dev3.myzone.ru.
dev4             IN A     1.2.3.4
dev4-servicea    IN CNAME dev4.myzone.ru.
dev4-serviceb    IN CNAME dev4.myzone.ru.
dev5             IN A     1.2.3.4
dev5-servicea    IN CNAME dev5.myzone.ru.
dev5-serviceb    IN CNAME dev5.myzone.ru.

image: $CI_REGISTRY_IMAGE/dnscontrol

variables:
  CA_CERT_FILE: /etc/gitlab-runner/certs/ca.crt
  ZONES_OUT_DIR: $CI_PROJECT_DIR/zones
  NIC_API_URL: https://api.nic.ru
  NIC_SERVICE: MYSERVICE

cache:
  key: dns-nic-ru
  paths:
    - .nic_token

stages:
  - validate
  - prepare
  - plan
  - build
  - test
  - deploy

check:
  stage: validate
  script:
    - dnscontrol -v check

prepare:
  stage: prepare
  script:
    - mkdir -p $ZONES_OUT_DIR
    - dnscontrol push
    - ls -la $ZONES_OUT_DIR
    # проверяем токен NIC.RU (при необходимости перевыпускаем)
    - . ci/scripts/nic_auth.sh
    # загружаем текущие файлы зон из NIC.RU
    - ci/scripts/nic_download.sh
    - ls -la $ZONES_OUT_DIR
  artifacts:
    public: false
    paths: [ zones/ ]
    expire_in: 5 mins

plan:
  stage: plan
  script:
    # сохраняем полученный план изменений в артефакты
    - dnscontrol preview | tee plan.txt
  artifacts:
    # отображаем артефакт в Merge Request, чтоб ревьюверы могли быстро посмотреть
    expose_as: plan
    paths: [ plan.txt ]
    public: false
    expire_in: 3 mos

build:
  stage: build
  script:
    - dnscontrol -v push
  artifacts:
    name: zones
    expose_as: zones
    paths: [ zones/ ]

test:
  stage: test
  image: $CI_REGISTRY_IMAGE/bind9
  variables:
    BIND_MAIN_CONFIG: /etc/bind/named.conf
    BIND_ZONES_DIR: /var/lib/bind/
    BIND_TESTS_DIR: $CI_PROJECT_DIR/tests
  script:
    - cat ci/bind9/named.conf > $BIND_MAIN_CONFIG
    - cp $ZONES_OUT_DIR/* $BIND_ZONES_DIR/
    # генерируем кофиг bind на основе имеющихся зон
    - ci/scripts/zones.conf.sh >> $BIND_MAIN_CONFIG
    - cat $BIND_MAIN_CONFIG
    # проверяем валидность конфига
    - /usr/sbin/named-checkconf /etc/bind/named.conf
    # запускаем bind с полученным конфигом
    - /usr/sbin/named -g -c /etc/bind/named.conf -u bind &
    # ждем пока поднимется bind
    - while ! (ss -4tulnp | grep 53 > /dev/null); do echo "Waiting for a socket to go up"; sleep 1; done
    - ps aux
    # прогоняем автотесты (проверяем, что записи резолвятся как надо)
    - ci/scripts/bind_test.sh

deploy:
  stage: deploy
  script:
    # снова на всякий случай проверяем токен
    - . ci/scripts/nic_auth.sh
    # выгружаем зоны в NIC.RU
    - ci/scripts/nic_upload.sh
  dependencies:
    - build
  rules:
    - if: '$CI_COMMIT_BRANCH == "master"'
      when: manual

#!/bin/bash

NIC_TOKEN_FILE='.nic_token'
NIC_CHECK_ACCESS_URL="$NIC_API_URL/dns-master/services/$NIC_SERVICE/zones/test.com/revisions"
NIC_TOKEN_URL="$NIC_API_URL/oauth/token"

# clear file with token if variable is defined
if [[ "$NIC_CLEAR_TOKEN_FILE" == "true" ]]; then
    rm $NIC_TOKEN_FILE
fi

# if file exists set token from it
if [ -f $NIC_TOKEN_FILE ]; then
    echo "Token file exists: $NIC_TOKEN_FILE. Use access token from file"
    export NIC_ACCESS_TOKEN=$(cat $NIC_TOKEN_FILE | jq -r '.access_token')
else
    echo "Token file does not exists"
fi

if [[ "$NIC_REFRESH_TOKEN" != "" ]]; then
    echo "Variable NIC_REFRESH_TOKEN is defined, use it as refresh token"
    echo "Refresh token: $NIC_REFRESH_TOKEN"
elif [ -f $NIC_TOKEN_FILE ]; then
    echo "Variable NIC_REFRESH_TOKEN is not defined, use refresh token from file"
    export NIC_REFRESH_TOKEN=$(cat $NIC_TOKEN_FILE | jq -r '.refresh_token')
    echo "Refresh token: $NIC_REFRESH_TOKEN"
fi


function refresh_token() {
    CURL_OUTPUT=$(curl -X POST -LSs $NIC_TOKEN_URL -H "Authorization: Basic $NIC_AUTH_BASE64" \
        -d "grant_type=refresh_token&refresh_token=$NIC_REFRESH_TOKEN" -w "\n%{http_code}"
    )
    CURL_STATUS_CODE=$(echo "$CURL_OUTPUT" | tail -n1)
    CURL_OUTPUT=$(echo "$CURL_OUTPUT" | sed \$d)

    if [[ "$CURL_STATUS_CODE" == "200" ]]; then
        echo "Access token has been refreshed and written to file $NIC_TOKEN_FILE"
        echo "$CURL_OUTPUT" > $NIC_TOKEN_FILE
        export NIC_ACCESS_TOKEN=$(echo "$CURL_OUTPUT" | jq -r '.access_token')
        export NIC_REFRESH_TOKEN=$(echo "$CURL_OUTPUT" | jq -r '.refresh_token')
        echo "New refresh token: $NIC_REFRESH_TOKEN"
    else
        echo "Error while refresh token:"
        echo "$CURL_OUTPUT"
        return 1
    fi
}


# check access to API
echo "Checking access to NIC.RU Rest API by GET-request to $NIC_CHECK_ACCESS_URL"
AUTH_CURL_OUTPUT=$(curl -LSs $NIC_CHECK_ACCESS_URL -H "Authorization: Bearer $NIC_ACCESS_TOKEN" -w "\n%{http_code}")
AUTH_CURL_STATUS_CODE=$(echo "$AUTH_CURL_OUTPUT" | tail -n1)
AUTH_CURL_OUTPUT=$(echo "$AUTH_CURL_OUTPUT" | sed \$d)

if [[ "$AUTH_CURL_STATUS_CODE" == "200" ]]; then
    echo "Access token is valid"
    return 0
# if access denied then try to refresh token
elif [[ "$AUTH_CURL_STATUS_CODE" == "401" ]]; then
    echo "Access denied. Output:"
    echo "$AUTH_CURL_OUTPUT"
    if [[ "$NIC_REFRESH_TOKEN" != "" ]]; then
        echo "Trying to refresh access token by refresh_token"
        refresh_token
    else
        echo "Refresh token is not defined. Can not refresh access token"
        return 3
    fi
else
    echo "Error on API request."
    echo "$AUTH_CURL_OUTPUT"
    return 2
fi

#!/bin/bash

NIC_API_ZONES_URL="$NIC_API_URL/dns-master/services/$NIC_SERVICE/zones/"

for FILENAME in $ZONES_OUT_DIR/*
do
    ZONE_NAME=$(basename -- "$FILENAME")
    ZONE_URL="$NIC_API_ZONES_URL/$ZONE_NAME"
    echo "Download file $ZONE_URL to $FILENAME"
    curl -X GET -fL $ZONE_URL -H "Authorization: Bearer $NIC_ACCESS_TOKEN" > $FILENAME
    if [[ $? != 0 ]]; then
        echo "Error occured while downloading zone $ZONE_NAME"
        exit 1
    fi
done

#!/bin/bash

NIC_API_ZONES_URL="$NIC_API_URL/dns-master/services/$NIC_SERVICE/zones"

for FILENAME in $ZONES_OUT_DIR/*
do
    ZONE_NAME=$(basename -- "$FILENAME")
    ZONE_URL="$NIC_API_ZONES_URL/$ZONE_NAME"
    echo "Upload file $FILENAME to $ZONE_URL"
    curl -X POST -fL $ZONE_URL -H "Authorization: Bearer $NIC_ACCESS_TOKEN" --data-binary @$FILENAME
    if [[ $? != 0 ]]; then
        echo "Error occured while uploading zone $ZONE_NAME"
        exit 1
    fi
    echo "Commit zone $ZONE_NAME"
    curl -X POST -fL $ZONE_URL/commit -H "Authorization: Bearer $NIC_ACCESS_TOKEN"
    if [[ $? != 0 ]]; then
        echo "Error occured while committing $ZONE_NAME"
        exit 1
    fi
    echo "List revisions of zone ZONE_NAME"
    curl -fL $ZONE_URL/revisions -H "Authorization: Bearer $NIC_ACCESS_TOKEN" | head -n 7
done

#!/bin/bash
for FILENAME in $ZONES_OUT_DIR/*
do
ZONE_NAME=$(basename -- "$FILENAME")
cat <<EOF
zone "$ZONE_NAME." IN {
    type master;
    file "$BIND_ZONES_DIR/$ZONE_NAME";
};
EOF
done

#!/bin/bash
shopt -s nocasematch

DNS_SERVER=${1:-"localhost"}
TEST_EXIT_CODE=0

for FILENAME in $BIND_TESTS_DIR/*
do
    # ignore files with .example extenstions
    if [[ $FILENAME != *.example ]]; then
        ZONE_NAME=$(basename -- "$FILENAME")
        while IFS="" read -r line || [ -n "$line" ]; do
            # skip commented lines
            commented_lines_regex="^[[:space:]]*#"
            if [[ $line =~ $commented_lines_regex ]]; then continue; fi

            # convert space-separated string to array
            IFS=' ' read -r -a strarr <<< "$line"

            record="${strarr[0]}"
            # if record is not absolute
            if [[ $record != *. ]]; then record="$record.$ZONE_NAME."; fi
            
            type="${strarr[1]}"

            address="${strarr[2]}"
            # if address is not absolute and is not IP-address
            if [[ $address != *. && ! $address =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then 
                address="$address.$ZONE_NAME."; 
            fi

            dig_comand="dig $type $record @$DNS_SERVER +short +nosearch"
            echo "$ZONE_NAME: Test: $dig_comand"
            echo "$ZONE_NAME: Expected: $address"

            dig_output=$($dig_comand)
            echo "$ZONE_NAME: dig output: $dig_output"

            if [[ "$dig_output" != "$address" ]]; then
                echo "$ZONE_NAME: Test failed: '$dig_output' != '$address'"
                TEST_EXIT_CODE=1
            else
                echo "$ZONE_NAME: Test success!"
            fi
            echo "---------------------------"
        done < $FILENAME
    fi
done

exit $TEST_EXIT_CODE