home-server/deployments/dns/bind.yaml

---
apiVersion: v1
kind: Namespace
metadata:
  name: dns
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: bind-master-config
  namespace: dns
data:
  named.conf: |
    acl "slaves" {
      10.42.0.0/16;
    };

    include "/etc/bind/externaldns-key.conf";
    include "/etc/bind/tsig-key.conf";

    options {
        directory "/var/cache/bind";

        recursion yes;
        allow-query { any; };

        listen-on port 53 { any; };
        listen-on-v6 port 53 { any; };

        forwarders {
            10.40.0.254;
        };

        allow-transfer { "slaves"; };

        dnssec-validation auto;
    };

    zone "." IN {
        type hint;
        file "/usr/share/dns/root.hints";
    };

    zone "hxme.net." IN {
      type master;
      file "/etc/bind/db.hxme.net";
      allow-update { key "externaldns-key"; };
      allow-transfer { key "bind-slave-key"; };
    };
  db.hxme.net: |
    $TTL    3600
    @       IN      SOA     ns1.hxme.net. admin.hxme.net. (
                            1         ; Serial
                            7200      ; Refresh
                            1800      ; Retry
                            1209600   ; Expire
                            86400 )   ; Negative Cache TTL
    ;
    @       IN      NS      ns1.hxme.net.
    ns1     IN      A       10.40.0.110
    @       IN      A       10.40.0.110
    www     IN      A       10.40.0.110
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: bind-slave-config
  namespace: dns
data:
  named.conf: |
    options {
        directory "/var/cache/bind";
        recursion yes;
        allow-query { any; };
        listen-on port 53 { any; };
        listen-on-v6 port 53 { any; };
        dnssec-validation auto;
    };

    include "/etc/bind/tsig-key.conf";

    masters "hxme-master" {
      bind-master.dns.svc.cluster.local key "bind-slave-key";
    };
    
    zone "hxme.net" {
        type slave;
        masters { "hxme-master"; };
        file "slaves/db.hxme.net";
    };
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: bind-master
  namespace: dns
spec:
  replicas: 1
  selector:
    matchLabels:
      app: bind-master
  template:
    metadata:
      labels:
        app: bind-master
    spec:
      securityContext:
        fsGroup: 999              # allow group access to volumes for named user
      initContainers:
        - name: fetch-root-hints
          image: debian:12
          command:
            - sh
            - -c
            - |
              apt update && apt -y install curl
              curl -sfSL https://www.internic.net/domain/named.cache -o /usr/share/dns/root.hints
              # Uncomment below to hold the container open for debugging:
              # tail -f /dev/null
          volumeMounts:
            - mountPath: /usr/share/dns
              name: root-hints
      containers:
        - name: bind-master
          image: internetsystemsconsortium/bind9:9.18
          command: ["named", "-g", "-c", "/etc/bind/named.conf"]
          ports:
          - containerPort: 53
            protocol: UDP
          - containerPort: 53
            protocol: TCP
          volumeMounts:
          - name: config
            mountPath: /etc/bind/named.conf
            subPath: named.conf
          - name: config
            mountPath: /etc/bind/db.hxme.net
            subPath: db.hxme.net
          - name: dns-secrets
            mountPath: /etc/bind/externaldns-key.conf
            subPath: externaldns-key.conf
          - name: dns-secrets
            subPath: tsig-key.conf
            mountPath: /etc/bind/tsig-key.conf
          - name: bind-cache
            mountPath: /var/cache/bind
          - name: bind-rundir
            mountPath: /var/run/named
          - name: root-hints
            mountPath: /usr/share/dns
      volumes:
        - name: dns-secrets
          secret:
            secretName: dns-secrets
        - name: config
          configMap:
            name: bind-master-config
        - name: bind-cache
          emptyDir: {}
        - name: bind-rundir
          emptyDir: {}
        - name: root-hints
          emptyDir: {}
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: bind-slave
  namespace: dns
spec:
  selector:
    matchLabels:
      app: bind-slave
  template:
    metadata:
      labels:
        app: bind-slave
    spec:
      securityContext:
        fsGroup: 999
      containers:
      - name: bind9
        image: internetsystemsconsortium/bind9:9.18
        command: ["named", "-g", "-c", "/etc/bind/named.conf"]
        ports:
        - containerPort: 53
          protocol: UDP
        - containerPort: 53
          protocol: TCP
        volumeMounts:
        - name: config
          mountPath: /etc/bind/named.conf
          subPath: named.conf
        - name: dns-secrets
          subPath: tsig-key.conf
          mountPath: /etc/bind/tsig-key.conf
        - name: bind-cache
          mountPath: /var/cache/bind
        - name: bind-rundir
          mountPath: /var/run/named
      volumes:
      - name: config
        configMap:
          name: bind-slave-config
      - name: dns-secrets
        secret:
          secretName: dns-secrets
      - name: bind-cache
        emptyDir: {}
      - name: bind-rundir
        emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: bind9
  namespace: dns
spec:
  type: LoadBalancer
  selector:
    app: bind-slave
  ports:
    - name: dns-udp
      port: 53
      targetPort: 53
      protocol: UDP
    - name: dns-tcp
      port: 53
      targetPort: 53
      protocol: TCP

---
apiVersion: v1
kind: Service
metadata:
  name: bind-master
  namespace: dns
spec:
  type: ClusterIP
  selector:
    app: bind-master
  ports:
    - name: dns-udp
      port: 53
      protocol: UDP
    - name: dns-tcp
      port: 53
      protocol: TCP