Use Knot Nameserver

[nils-wisiol]

No description provided.

[nils-wisiol]

Integration of knot and replicator is ready for review. What's still missing is proper configuration of the public interfaces of knot (including bootstrapping zones).

[peterthomassen]

Planning to deploy at ns2.desec.org. While support for draft-ietf-dnsop-dnssec-bootstrapping is missing in Knot DNS, _signal.ns2.desec.org will be handled by ns1.desec.io. To prepare, the following commands are needed on each ns1 POP:

docker-compose exec --env DESEC_NS_NAME=ns2.desec.org ns su pdns -s /bin/bash -c /usr/bin/local/signaling_domain_zone.sh \
    && docker-compose exec ns pdnsutil replace-rrset _signal.ns2.desec.org "@" NS 3600 "ns1.desec.io" \
    && docker-compose stop ns && docker-compose up -d

Also, on each ns2 POP (to prevent ns2 from answering with its DNSKEY):

docker-compose exec ns pdnsutil delete-zone _signal.ns2.desec.org \
    && sed -i 's/^DESEC_NS_SIGNALING_DOMAIN_ZONE_PRIVATE_KEY_B64=.*/DESEC_NS_SIGNALING_DOMAIN_ZONE_PRIVATE_KEY_B64=/g' .env
    && docker-compose stop ns && docker-compose up -d

[peterthomassen]

Migration from PowerDNS (assuming that the _data dir of an existing Knot volume is in ~/data.tar.bz2):

# Clean up old installation
cd desec-ns && docker-compose down && docker ps -aq | xargs docker rm -f && docker volume rm desec-ns_ns && docker network ls && docker volume ls

# Build, run & sync
git pull && git checkout 20231228_knot && docker-compose build && docker-compose up -d ns && docker-compose down
cd /var/lib/docker/volumes/desec-ns_ns && rm -rf _data && tar xvjf ~/data.tar.bz2 && ls -l
cd ~/desec-ns && docker-compose up -d && tail -f /var/log/syslog

# If all works, clean up
rm ~/data.tar.bz2 && exit

[peterthomassen]

@nils-wisiol These commits are Kraut und Rüben, but may be useful individually for understanding why any specific line is there. Let me know if you prefer it squashed.

[nils-wisiol]

yay, looks good to me! Formal approval is required by @peterthomassen