bindcar 0.7.0

HTTP REST API for managing BIND9 zones via rndc
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

// named.conf.options — global server options

options {
    // Zone files are stored here; bindcar uses BIND_ZONE_DIR to match this path
    directory "/var/cache/bind";

    // -----------------------------------------------------------------------
    // Listeners
    // -----------------------------------------------------------------------

    // Accept DNS queries on all interfaces, standard port
    listen-on port 53 { 0.0.0.0; };

    // Disable IPv6 listener unless your environment requires it
    listen-on-v6 { none; };

    // -----------------------------------------------------------------------
    // Query access
    // -----------------------------------------------------------------------

    // Allow queries from any client (authoritative server, not a resolver)
    allow-query { any; };

    // Disable zone transfers — add secondary nameserver IPs here when needed
    allow-transfer { none; };

    // -----------------------------------------------------------------------
    // Dynamic updates (nsupdate)
    // -----------------------------------------------------------------------

    // Allow nsupdate from localhost only.
    // Individual zones added via bindcar inherit this default; to restrict
    // further, configure allow-update per zone in the rndc addzone call.
    allow-update { 127.0.0.1; };

    // -----------------------------------------------------------------------
    // Dynamic zone management (required for bindcar rndc addzone / delzone)
    // -----------------------------------------------------------------------

    allow-new-zones yes;

    // -----------------------------------------------------------------------
    // Authoritative-only mode — disable recursive resolution
    // -----------------------------------------------------------------------

    recursion no;
    additional-from-auth no;
    additional-from-cache no;

    // -----------------------------------------------------------------------
    // DNSSEC — disabled for a plain authoritative setup.
    // Enable and configure a dnssec-policy if you need signed zones.
    // -----------------------------------------------------------------------

    dnssec-validation no;
};