Hidden-primary DNS for ~91 zones: CoreDNS + custom rfc2136 plugin for self-hosted ACME DNS-01. Source of truth for zones/, Corefile, deploy configs.
Ryan Malloy
3720cd2885
Wires the custom CoreDNS image (built via coredns/Dockerfile, source
includes git.supported.systems/rsp2k/coredns-rfc2136) into production:
- docker-compose.yml: switch coredns service from upstream image pin
to a build target. New `image: coredns-rfc2136:${COREDNS_IMAGE_TAG}`
is locally-built; `up -d coredns` triggers the build.
- .env: COREDNS_IMAGE_TAG=2026.05.21 (CalVer). Old COREDNS_IMAGE kept
as a comment for emergency rollback to upstream 1.11.3.
- Corefile: new rfc2136 directive inside (common) snippet enumerating
all 84 zones currently in zones/. Plugin is now in the chain for
every server block (plain DNS, DoT, DoH). UPDATE opcode lands in
the plugin handler; auto-commit on, CalVer SOA serial bumping on,
zones-dir /zones matches the existing bind-mount.
TSIG key is read from ${ACME_TSIG_SECRET} which lives in .env.local
(gitignored). Production deployment needs that file synced to dell01
separately.
This commit DOESN'T trigger the deployment by itself -- the image
must be built on dell01 and the container recreated to apply.
|
||
|---|---|---|
| caddy | ||
| coredns | ||
| scripts | ||
| secondary | ||
| zones | ||
| .env | ||
| .env.local.example | ||
| .gitignore | ||
| CLAUDE.md | ||
| Corefile | ||
| docker-compose.yml | ||
| Makefile | ||