---
apiVersion: v1
kind: ConfigMap
metadata:
  name: bind-master-config
  namespace: {{ .Release.Namespace }}
data:
  named.conf: |
    include "/etc/bind/externaldns-key.conf";

    options {
        directory "/var/cache/bind";

        recursion yes;
        allow-query { any; };

        listen-on port 53 { any; };
        listen-on-v6 port 53 { any; };

        forwarders {
            10.40.0.254;
        };

        dnssec-validation auto;
    };

    zone "." IN {
        type hint;
        file "/usr/share/dns/root.hints";
    };

    zone "hxme.net." IN {
      type master;
      file "/etc/bind/db.hxme.net";
      allow-update { key "externaldns-key"; };
    };
  db.hxme.net: |
    $TTL    3600
    @       IN      SOA     ns1.hxme.net. admin.hxme.net. (
                            1         ; Serial
                            7200      ; Refresh
                            1800      ; Retry
                            1209600   ; Expire
                            86400 )   ; Negative Cache TTL
    ;
    @       IN      NS      ns1.hxme.net.
    ns1     IN      A       10.40.0.110
    @       IN      A       10.40.0.110
    www     IN      A       10.40.0.110
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: bind-master
  namespace: {{ .Release.Namespace }}
spec:
  selector:
    matchLabels:
      app: bind-master
  template:
    metadata:
      labels:
        app: bind-master
    spec:
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      securityContext:
        fsGroup: 999
      initContainers:
        - name: fetch-root-hints
          image: debian:12
          command:
            - sh
            - -c
            - |
              apt update && apt -y install curl
              curl -sfSL https://www.internic.net/domain/named.cache -o /usr/share/dns/root.hints
          volumeMounts:
            - mountPath: /usr/share/dns
              name: root-hints
      containers:
        - name: bind-master
          image: internetsystemsconsortium/bind9:9.18
          command: ["named", "-g", "-c", "/etc/bind/named.conf"]
          ports:
            - containerPort: 53
              protocol: UDP
            - containerPort: 53
              protocol: TCP
          volumeMounts:
            - name: config
              mountPath: /etc/bind/named.conf
              subPath: named.conf
            - name: config
              mountPath: /etc/bind/db.hxme.net
              subPath: db.hxme.net
            - name: dns-secrets
              mountPath: /etc/bind/externaldns-key.conf
              subPath: externaldns-key.conf
            - name: bind-cache
              mountPath: /var/cache/bind
            - name: bind-rundir
              mountPath: /var/run/named
            - name: root-hints
              mountPath: /usr/share/dns
      volumes:
        - name: dns-secrets
          secret:
            secretName: dns-secrets
        - name: config
          configMap:
            name: bind-master-config
        - name: bind-cache
          emptyDir: {}
        - name: bind-rundir
          emptyDir: {}
        - name: root-hints
          emptyDir: {}

---
apiVersion: v1
kind: Service
metadata:
  name: bind-master
  namespace: {{ .Release.Namespace }}
spec:
  selector:
    app: bind-master
  ports:
    - name: dns-udp
      port: 53
      protocol: UDP
      targetPort: 53
    - name: dns-tcp
      port: 53
      protocol: TCP
      targetPort: 53