modified: README.md
deleted: docs/architecture-overview.drawio deleted: docs/architecture-overview.svg modified: docs/install-systemd-service.md new file: docs/installation-guide.md Documentation cleanup modified: pyproject.toml change old provisioner link to bridge
This commit is contained in:
Sven Luethi committed
1 parent
3fa3cd6a01
commit
5999db72f9
6 files changed
+441
-349
No files matched your search
@@ -1,76 +0,0 @@
|
||||
<mxfile host="Electron" agent="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) draw.io/29.0.3 Chrome/140.0.7339.249 Electron/38.7.0 Safari/537.36" version="29.0.3">
|
||||
<diagram name="Page-1" id="inkmD5hxPkRoHiEHOzAS">
|
||||
<mxGraphModel dx="831" dy="2028" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="850" pageHeight="1100" math="0" shadow="0">
|
||||
<root>
|
||||
<mxCell id="0" />
|
||||
<mxCell id="1" parent="0" />
|
||||
<mxCell id="WlUYMBEI5UY_wtPVGHlU-24" value="" style="whiteSpace=wrap;html=1;aspect=fixed;" parent="1" vertex="1">
|
||||
<mxGeometry x="560" y="457.5" width="80" height="80" as="geometry" />
|
||||
</mxCell>
|
||||
<mxCell id="WlUYMBEI5UY_wtPVGHlU-13" value="" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#f5f5f5;fontColor=#333333;strokeColor=#666666;" parent="1" vertex="1">
|
||||
<mxGeometry x="70" y="210" width="600" height="220" as="geometry" />
|
||||
</mxCell>
|
||||
<mxCell id="WlUYMBEI5UY_wtPVGHlU-12" value="" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#dae8fc;strokeColor=#6c8ebf;" parent="1" vertex="1">
|
||||
<mxGeometry x="430" y="260" width="230" height="150" as="geometry" />
|
||||
</mxCell>
|
||||
<mxCell id="WlUYMBEI5UY_wtPVGHlU-3" value="<font style="font-size: 18px;">Netbox</font>" style="text;html=1;whiteSpace=wrap;strokeColor=none;fillColor=none;align=center;verticalAlign=middle;rounded=0;" parent="1" vertex="1">
|
||||
<mxGeometry x="80" y="220" width="60" height="30" as="geometry" />
|
||||
</mxCell>
|
||||
<mxCell id="WlUYMBEI5UY_wtPVGHlU-4" value="DNS" style="whiteSpace=wrap;html=1;aspect=fixed;fillColor=#dae8fc;strokeColor=#6c8ebf;rounded=1;" parent="1" vertex="1">
|
||||
<mxGeometry x="300" y="260" width="100" height="100" as="geometry" />
|
||||
</mxCell>
|
||||
<mxCell id="WlUYMBEI5UY_wtPVGHlU-6" value="IPAM" style="whiteSpace=wrap;html=1;aspect=fixed;fillColor=#f8cecc;strokeColor=#b85450;gradientColor=none;rounded=1;" parent="1" vertex="1">
|
||||
<mxGeometry x="80" y="260" width="100" height="100" as="geometry" />
|
||||
</mxCell>
|
||||
<mxCell id="WlUYMBEI5UY_wtPVGHlU-7" value="DHCP<br>(WIP)" style="whiteSpace=wrap;html=1;aspect=fixed;fillColor=#fff2cc;strokeColor=#d6b656;rounded=1;" parent="1" vertex="1">
|
||||
<mxGeometry x="190" y="260" width="100" height="100" as="geometry" />
|
||||
</mxCell>
|
||||
<mxCell id="MSiTSJWh-g0ETCA7Z0x5-4" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="1" source="WlUYMBEI5UY_wtPVGHlU-9" target="WlUYMBEI5UY_wtPVGHlU-4">
|
||||
<mxGeometry relative="1" as="geometry" />
|
||||
</mxCell>
|
||||
<mxCell id="WlUYMBEI5UY_wtPVGHlU-9" value="Transfer<br>Endpoint" style="whiteSpace=wrap;html=1;aspect=fixed;fillColor=#d5e8d4;strokeColor=#82b366;rounded=1;" parent="1" vertex="1">
|
||||
<mxGeometry x="440" y="300" width="100" height="100" as="geometry" />
|
||||
</mxCell>
|
||||
<mxCell id="WlUYMBEI5UY_wtPVGHlU-10" value="Dynamic Update<br>Endpoint" style="whiteSpace=wrap;html=1;aspect=fixed;fillColor=#d5e8d4;strokeColor=#82b366;rounded=1;" parent="1" vertex="1">
|
||||
<mxGeometry x="550" y="300" width="100" height="100" as="geometry" />
|
||||
</mxCell>
|
||||
<mxCell id="WlUYMBEI5UY_wtPVGHlU-11" value="DNS Bridge" style="text;html=1;whiteSpace=wrap;strokeColor=none;fillColor=none;align=center;verticalAlign=middle;rounded=0;" parent="1" vertex="1">
|
||||
<mxGeometry x="440" y="270" width="90" height="30" as="geometry" />
|
||||
</mxCell>
|
||||
<mxCell id="WlUYMBEI5UY_wtPVGHlU-18" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=none;endFill=0;startArrow=classic;startFill=1;" parent="1" source="WlUYMBEI5UY_wtPVGHlU-16" target="WlUYMBEI5UY_wtPVGHlU-9" edge="1">
|
||||
<mxGeometry relative="1" as="geometry">
|
||||
<Array as="points">
|
||||
<mxPoint x="490" y="450" />
|
||||
<mxPoint x="490" y="450" />
|
||||
</Array>
|
||||
</mxGeometry>
|
||||
</mxCell>
|
||||
<mxCell id="WlUYMBEI5UY_wtPVGHlU-27" value="AXFR" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" parent="WlUYMBEI5UY_wtPVGHlU-18" connectable="0" vertex="1">
|
||||
<mxGeometry x="-0.2264" y="2" relative="1" as="geometry">
|
||||
<mxPoint x="2" y="5" as="offset" />
|
||||
</mxGeometry>
|
||||
</mxCell>
|
||||
<mxCell id="WlUYMBEI5UY_wtPVGHlU-16" value="" style="whiteSpace=wrap;html=1;aspect=fixed;" parent="1" vertex="1">
|
||||
<mxGeometry x="440" y="457.5" width="80" height="80" as="geometry" />
|
||||
</mxCell>
|
||||
<mxCell id="WlUYMBEI5UY_wtPVGHlU-20" value="" style="whiteSpace=wrap;html=1;aspect=fixed;" parent="1" vertex="1">
|
||||
<mxGeometry x="450" y="467.5" width="80" height="80" as="geometry" />
|
||||
</mxCell>
|
||||
<mxCell id="WlUYMBEI5UY_wtPVGHlU-19" value="DNS Server<br>(RFC9432)" style="whiteSpace=wrap;html=1;aspect=fixed;" parent="1" vertex="1">
|
||||
<mxGeometry x="460" y="477.5" width="80" height="80" as="geometry" />
|
||||
</mxCell>
|
||||
<mxCell id="WlUYMBEI5UY_wtPVGHlU-23" value="" style="whiteSpace=wrap;html=1;aspect=fixed;" parent="1" vertex="1">
|
||||
<mxGeometry x="570" y="467.5" width="80" height="80" as="geometry" />
|
||||
</mxCell>
|
||||
<mxCell id="WlUYMBEI5UY_wtPVGHlU-25" value="Client<br>(RFC2136)" style="whiteSpace=wrap;html=1;aspect=fixed;" parent="1" vertex="1">
|
||||
<mxGeometry x="580" y="477.5" width="80" height="80" as="geometry" />
|
||||
</mxCell>
|
||||
<mxCell id="MSiTSJWh-g0ETCA7Z0x5-3" value="Update" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="1" source="WlUYMBEI5UY_wtPVGHlU-24" target="WlUYMBEI5UY_wtPVGHlU-10">
|
||||
<mxGeometry x="-0.3913" relative="1" as="geometry">
|
||||
<mxPoint y="1" as="offset" />
|
||||
</mxGeometry>
|
||||
</mxCell>
|
||||
</root>
|
||||
</mxGraphModel>
|
||||
</diagram>
|
||||
</mxfile>
|
||||
@@ -1,4 +0,0 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!-- Do not edit this file with editors other than draw.io -->
|
||||
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
|
||||
<svg xmlns="http://www.w3.org/2000/svg" style="background: #ffffff; background-color: light-dark(#ffffff, var(--ge-dark-color, #121212)); color-scheme: light dark;" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" width="601px" height="349px" viewBox="0 0 601 349" content="<mxfile host="Electron" agent="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) draw.io/29.0.3 Chrome/140.0.7339.249 Electron/38.7.0 Safari/537.36" version="29.0.3" scale="1" border="0"> <diagram name="Page-1" id="inkmD5hxPkRoHiEHOzAS"> <mxGraphModel dx="706" dy="1724" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="850" pageHeight="1100" math="0" shadow="0"> <root> <mxCell id="0" /> <mxCell id="1" parent="0" /> <mxCell id="WlUYMBEI5UY_wtPVGHlU-24" value="" style="whiteSpace=wrap;html=1;aspect=fixed;" parent="1" vertex="1"> <mxGeometry x="560" y="457.5" width="80" height="80" as="geometry" /> </mxCell> <mxCell id="WlUYMBEI5UY_wtPVGHlU-13" value="" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#f5f5f5;fontColor=#333333;strokeColor=#666666;" parent="1" vertex="1"> <mxGeometry x="70" y="210" width="600" height="220" as="geometry" /> </mxCell> <mxCell id="WlUYMBEI5UY_wtPVGHlU-12" value="" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#dae8fc;strokeColor=#6c8ebf;" parent="1" vertex="1"> <mxGeometry x="430" y="260" width="230" height="150" as="geometry" /> </mxCell> <mxCell id="WlUYMBEI5UY_wtPVGHlU-3" value="&lt;font style=&quot;font-size: 18px;&quot;&gt;Netbox&lt;/font&gt;" style="text;html=1;whiteSpace=wrap;strokeColor=none;fillColor=none;align=center;verticalAlign=middle;rounded=0;" parent="1" vertex="1"> <mxGeometry x="80" y="220" width="60" height="30" as="geometry" /> </mxCell> <mxCell id="WlUYMBEI5UY_wtPVGHlU-4" value="DNS" style="whiteSpace=wrap;html=1;aspect=fixed;fillColor=#dae8fc;strokeColor=#6c8ebf;rounded=1;" parent="1" vertex="1"> <mxGeometry x="300" y="260" width="100" height="100" as="geometry" /> </mxCell> <mxCell id="WlUYMBEI5UY_wtPVGHlU-6" value="IPAM" style="whiteSpace=wrap;html=1;aspect=fixed;fillColor=#f8cecc;strokeColor=#b85450;gradientColor=none;rounded=1;" parent="1" vertex="1"> <mxGeometry x="80" y="260" width="100" height="100" as="geometry" /> </mxCell> <mxCell id="WlUYMBEI5UY_wtPVGHlU-7" value="DHCP&lt;br&gt;(WIP)" style="whiteSpace=wrap;html=1;aspect=fixed;fillColor=#fff2cc;strokeColor=#d6b656;rounded=1;" parent="1" vertex="1"> <mxGeometry x="190" y="260" width="100" height="100" as="geometry" /> </mxCell> <mxCell id="MSiTSJWh-g0ETCA7Z0x5-4" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" parent="1" source="WlUYMBEI5UY_wtPVGHlU-9" target="WlUYMBEI5UY_wtPVGHlU-4" edge="1"> <mxGeometry relative="1" as="geometry" /> </mxCell> <mxCell id="WlUYMBEI5UY_wtPVGHlU-9" value="Transfer&lt;br&gt;Endpoint" style="whiteSpace=wrap;html=1;aspect=fixed;fillColor=#d5e8d4;strokeColor=#82b366;rounded=1;" parent="1" vertex="1"> <mxGeometry x="440" y="300" width="100" height="100" as="geometry" /> </mxCell> <mxCell id="WlUYMBEI5UY_wtPVGHlU-10" value="Dynamic Update&lt;br&gt;Endpoint" style="whiteSpace=wrap;html=1;aspect=fixedLine truncated
|
||||
|
Before Width: | Height: | Size: 112 KiB |
@@ -1,4 +1,6 @@
|
||||
1. Create System Unit file
|
||||
# NetBox DNS transfer endpoint systemd service
|
||||
|
||||
1. Create a systemd unit file
|
||||
```
|
||||
cat <<EOF > /etc/systemd/system/netbox-dns-endpoint.service
|
||||
[Unit]
|
||||
@@ -6,21 +8,21 @@
|
||||
Documentation=https://github.com/Suraxius/netbox-plugin-dns-bridge
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
|
||||
|
||||
User=netbox
|
||||
Group=netbox
|
||||
PIDFile=/var/tmp/netbox.pid
|
||||
WorkingDirectory=/opt/netbox
|
||||
|
||||
|
||||
ExecStart=/opt/netbox/venv/bin/python3 /opt/netbox/netbox/manage.py dns-transfer-endpoint --address 0.0.0.0 --port 5354
|
||||
|
||||
|
||||
Restart=on-failure
|
||||
RestartSec=30
|
||||
PrivateTmp=true
|
||||
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
|
||||
@@ -0,0 +1,192 @@
|
||||
# Installation guide
|
||||
|
||||
This setup provisions a BIND9 server directly with DNS data from NetBox. BIND9 can optionally run on
|
||||
a separate server. If so, any reference to 127.0.0.1 in step 6 must be replaced with the IP address
|
||||
of the NetBox host. TCP and UDP traffic from the BIND9 server to the NetBox host must be allowed on
|
||||
port 5354 (or the port you have configured).
|
||||
|
||||
This guide assumes:
|
||||
- NetBox has been installed under /opt/netbox
|
||||
- BIND9 is installed on the same host as NetBox
|
||||
- The NetBox DNS plugin netbox-plugin-dns is installed
|
||||
- The following DNS views exist in NetBox DNS:
|
||||
- `public` (the default)
|
||||
- `private`
|
||||
|
||||
## 1. Preliminaries
|
||||
|
||||
- Install BIND9 on the same host that NetBox is on.
|
||||
- Generate a TSIG key for the `public` and `private` DNS views respectively.
|
||||
|
||||
## 2. Adding required package
|
||||
|
||||
```
|
||||
cd netbox
|
||||
echo netbox-plugin-dns-bridge >> local_requirements.txt
|
||||
. venv/bin/activate
|
||||
pip install -r local_requirements.txt
|
||||
```
|
||||
|
||||
## 3. Updating netbox plugin configuration (configuration.py)
|
||||
|
||||
Change the following line from
|
||||
|
||||
```
|
||||
PLUGINS = ['netbox_dns']
|
||||
```
|
||||
|
||||
to
|
||||
|
||||
```
|
||||
PLUGINS = ['netbox_dns', 'netbox_dns_bridge']
|
||||
```
|
||||
|
||||
Configure the DNS Bridge plugin using the `PLUGINS_CONFIG` dictionary. Change
|
||||
|
||||
```
|
||||
PLUGINS_CONFIG = {}
|
||||
```
|
||||
|
||||
to
|
||||
|
||||
```
|
||||
PLUGINS_CONFIG = {
|
||||
"netbox_dns_bridge": {
|
||||
"tsig_keys": {
|
||||
"public": {
|
||||
"keyname": "public_view_key",
|
||||
"algorithm": "hmac-sha256",
|
||||
"secret": "base64-encoded-secret"
|
||||
},
|
||||
"private": {
|
||||
"keyname": "private_view_key",
|
||||
"algorithm": "hmac-sha256",
|
||||
"secret": "base64-encoded-secret"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Note that the tsig-key attributes keyname, algorithm and secret form a dictionary in the following
|
||||
Python structure path:
|
||||
|
||||
```
|
||||
PLUGINS_CONFIG.netbox_dns_bridge.tsig_keys.<dns_view_name>
|
||||
```
|
||||
|
||||
This allows the plugin to map requests to the right DNS view using the TSIG signature from each
|
||||
request.
|
||||
|
||||
## 4. Run migrations
|
||||
|
||||
```
|
||||
manage.py migrate
|
||||
```
|
||||
|
||||
## 5. Start listener
|
||||
|
||||
This step runs the DNS endpoint used by BIND to configure itself. You may want to write a service
|
||||
wrapper that runs this in the background. A guide for setting up a systemd service on Ubuntu is
|
||||
provided in [install-systemd-service.md](install-systemd-service.md). Don't forget to activate the
|
||||
venv if you do decide to run this service in the background.
|
||||
|
||||
Note that `--port 5354` is optional. The listener will bind this port by default.
|
||||
|
||||
```
|
||||
manage.py dns-transfer-endpoint --port 5354
|
||||
```
|
||||
|
||||
## 6. Configuring BIND9
|
||||
|
||||
Configure BIND9 to interact with NetBox via the dns-transfer-endpoint endpoint. Note that it is
|
||||
not possible to give all the correct details of the `options` block as it is heavily dependent on
|
||||
the operating system used. Please don't forget to adjust it as required.
|
||||
|
||||
> **Note:** Since BIND 9.18, `type slave` is deprecated in favor of `type secondary` and
|
||||
> `masters` in favor of `primaries`. Both still work, but newer deployments may prefer the new
|
||||
> keywords.
|
||||
|
||||
```
|
||||
########## OPTIONS ##########
|
||||
|
||||
options {
|
||||
allow-update { none; };
|
||||
allow-query { any; };
|
||||
allow-recursion { none; };
|
||||
notify yes;
|
||||
min-refresh-time 60;
|
||||
};
|
||||
|
||||
########## ACLs ##########
|
||||
|
||||
acl public {
|
||||
!10.0.0.0/8;
|
||||
!172.16.0.0/12;
|
||||
!192.168.0.0/16;
|
||||
any;
|
||||
};
|
||||
|
||||
acl private {
|
||||
10.0.0.0/8;
|
||||
172.16.0.0/12;
|
||||
192.168.0.0/16;
|
||||
};
|
||||
|
||||
######## TSIG Keys ########
|
||||
|
||||
key "public_view_key" {
|
||||
algorithm hmac-sha256;
|
||||
secret "base64-encoded-secret";
|
||||
};
|
||||
|
||||
key "private_view_key" {
|
||||
algorithm hmac-sha256;
|
||||
secret "base64-encoded-secret";
|
||||
};
|
||||
|
||||
########## VIEWS & ZONES ##########
|
||||
|
||||
view "public" {
|
||||
match-clients { public; };
|
||||
allow-notify { key "public_view_key"; };
|
||||
|
||||
catalog-zones {
|
||||
zone "catz"
|
||||
default-masters { 127.0.0.1 port 5354 key "public_view_key"; }
|
||||
zone-directory "/var/lib/bind/zones"
|
||||
min-update-interval 1;
|
||||
};
|
||||
|
||||
zone "catz" {
|
||||
type slave;
|
||||
file "/var/lib/bind/zones/catz_public";
|
||||
masters { 127.0.0.1 port 5354 key "public_view_key"; };
|
||||
notify no;
|
||||
};
|
||||
};
|
||||
|
||||
view "private" {
|
||||
match-clients { private; };
|
||||
allow-notify { key "private_view_key"; };
|
||||
|
||||
catalog-zones {
|
||||
zone "catz"
|
||||
default-masters { 127.0.0.1 port 5354 key "private_view_key"; }
|
||||
zone-directory "/var/lib/bind/zones"
|
||||
min-update-interval 1;
|
||||
};
|
||||
|
||||
zone "catz" {
|
||||
type slave;
|
||||
file "/var/lib/bind/zones/catz_private";
|
||||
masters { 127.0.0.1 port 5354 key "private_view_key"; };
|
||||
notify no;
|
||||
};
|
||||
};
|
||||
```
|
||||
|
||||
## 7. Restart BIND9
|
||||
|
||||
Restart BIND9 — done. The server will now discover zones in its views through the catalog zone and
|
||||
transfer them from NetBox.
|
||||
Reference in new issue
Block a user