<!DOCTYPE html><html><head><title></title><style type="text/css">
p.MsoNormal,p.MsoNoSpacing{margin:0}</style></head><body><div>Hi folks<br></div><div><br></div><div>I've been meaning to send an update continuing on from below<br></div><div><br></div><div>* octoDNS patches have been merged, just waiting on a release to happen from the upstream</div><div>* Looked at how to do the CI and I think I now know how to do it<br></div><div>* Implemented a solution for LE certs with DNS challenges for firewalled hosts - see below about quovadis<br></div><div>* Implemented user database caching in zonemake.py and is running on mooneye<br></div><div><br></div><div>Next steps:<br></div><div><br></div><div>* Build development VMs for rebuilding UCC internal DNS server infrastructure (mooneye) - both authoritative and resolver<br></div><div>* Implement CI for UCC DNS<br></div><div><br></div><div>On quovadis,<br></div><div><br></div><div>* Provides an API to update _acme_challenge DNS entries (delegated via a CNAME in the ucc.machines / zonemake.py setup)<br></div><div>* Uses desec.io to host a zone that can be updated via an API for the challenges<br></div><div>* Has an example certbot helper script<br></div><div><br></div><div><a href="https://quovadis.ucc.asn.au/quovadis/">https://quovadis.ucc.asn.au/quovadis/</a><br></div><div><br></div><div>Code is in the UCC gitlab - <a href="https://gitlab.ucc.asn.au/UCC/quovadis/">https://gitlab.ucc.asn.au/UCC/quovadis/</a><br></div><div><br></div><div>[MSH] this should help out with the certs that you wanted for evil.ucc.asn.au<br></div><div><br></div><div>The above is probably a bit of a crappy explanation of what it does, and how it works, poke me in person for a better one.<br></div><div><br></div><div><br></div><div>Cheers,<br></div><div>Mark</div><div><br></div><div id="sig26513633"><div class="signature">--</div><div>
<br></div><div class="signature">Mark Tearle <<a href="mailto:mtearle@ucc.asn.au">mtearle@ucc.asn.au</a>></div></div><div><br></div><div><br></div><div>On Thu, 14 Jan 2021, at 9:38 PM, Mark Tearle wrote:<br></div><blockquote type="cite" id="qt" style=""><div>Hi folks<br></div><div><br></div><div>This evenings update:<br></div><ul><li>ucc.asn.au is now synced from ucc.machines and zonemake.py to Cloudflare<br></li><li>Will need to chat with [MPT] about a couple of things that might need cleaning up<br></li></ul><div>Next steps are:<br></div><ul><li>Ensure octoDNS patches get merged upstream and use upstream version installed under /usr/local/octodns (for LOC and Null SRV records)<br></li><li>Migrate this into some form of CI arrangement based off git<br></li><li>Work out and implement solution for LE certs with DNS challenges<br></li><li>Rebuild UCC internal DNS server infrastructure (mooneye) - both authoritative and resolver<br></li></ul><div>Changes should start becoming easier from now on in :) Let me know if I've broken anything ...<br></div><div><br></div><div>Cheers,<br></div><div>Mark<br></div><div id="qt-sig26513633"><div class="qt-signature">--<br></div><div><br></div><div class="qt-signature">Mark Tearle <<a href="mailto:mtearle@ucc.asn.au">mtearle@ucc.asn.au</a>><br></div></div><div><br></div><div><br></div><div>On Sat, 5 Dec 2020, at 11:54 PM, Mark Tearle wrote:<br></div><blockquote type="cite" id="qt-qt" style=""><div>Hi folks<br></div><div><br></div><div>This evening's update:<br></div><ul><li>Audit ucc.gu.uwa.edu.au and ucc.asn.au for the necessary changes needed in ucc.machines for syncing to Cloudflare<br></li><li>making OctoDNS work under Python 3.9 ( <a href="https://github.com/github/octodns/pull/632">https://github.com/github/octodns/pull/632</a> ) - Pull request has been merged<br></li><li>fix zonemake.py to naturally sort the keys in the octoDNS YAML output<br></li><li>discovered problem with NULL SRV records ( <a href="https://github.com/github/octodns/issues/640">https://github.com/github/octodns/issues/640</a> )<br></li><li>temporarily commented out open.ucc.gu.uwa.edu.au and v.ucc.gu.uwa.edu.au subdomains (will discuss with [MPT] )<br></li><li>Made backups before syncing<br></li><li>Add config under /usr/local/octodns (in the script and config directory) for ucc.gu.uwa.edu.au and ucc.asn.au<br></li><li>Sync'd ucc.gu.uwa.edu.au up to Cloudflare<br></li><li>Reviewed changes with audit script afterwards<br></li></ul><div>Next steps are:<br></div><ul><li>Repeat above similary for ucc.asn.au once NULL SRV bug is tracked down<br></li><li>Ensure octoDNS patches get merged upstream and use upstream version installed under /usr/local/octodns<br></li><li>Migrate this into some form of CI arrangement based off git<br></li><li>Work out solution for LE certs with DNS challenges<br></li><li>Rebuild UCC internal DNS server infrastructure (mooneye) - both authoritative and resolver<br></li></ul><div><br></div><div>Cheers<br></div><div>Mark<br></div><div id="qt-qt-sig26411581"><div class="qt-qt-signature">--<br></div><div class="qt-qt-signature">Mark Tearle <mtearle@tearle.com><br></div><div class="qt-qt-signature"><br></div></div><div><br></div><div><br></div><div>On Tue, 1 Dec 2020, at 9:39 PM, Mark Tearle wrote:<br></div><blockquote type="cite" id="qt-qt-qt" style=""><div>Hi folks<br></div><div><br></div><div>I've been working on providing the ability to sync from our local DNS config with appropriate changes up to Cloudflare.<br></div><div><br></div><div>To date this has involved the following:<br></div><ul><li>hacking zonemake.py to output a YAML file for each zone, adding tags, and config to reflect proxying scenarios<br></li><li>writing a quick audit script to work out what changes would be needed to ucc.machines in advance of the sync<br></li><li>hacking zonemake.py to output a YAML file in the form OctoDNS requires<br></li><li>making OctoDNS work under Python 3.9 ( <a href="https://github.com/github/octodns/pull/632">https://github.com/github/octodns/pull/632</a> )<br></li><li>making OctoDNS support LOC records ( <a href="https://github.com/github/octodns/pull/635">https://github.com/github/octodns/pull/635</a> )<br></li><li>writing a quick script on mooneye - /usr/local/octodns/update-ucc-cloudflare.sh - to run the necessary octoDNS commands to do the sync<br></li></ul><div>Currently only ucc.guild.uwa.edu.au is being synced. /usr/local/octodns/update-ucc-cloudflare.sh currently points at my local development installation of octoDNS<br></div><div><br></div><div>Next steps are:<br></div><ul><li>Audit ucc.gu.uwa.edu.au and ucc.asn.au for the necessary changes needed in ucc.machines for syncing to Cloudflare<br></li><li>Make liberal backups before syncing<br></li><li>Add config under /usr/local/octodns (in the script and config directory) for ucc.gu.uwa.edu.au and ucc.asn.au<br></li><li>Sync these up to Cloudflare<br></li><li>Review changes with audit script afterwards<br></li><li>Ensure octoDNS patches get merged upstream and use upstream version installed under /usr/local/octodns<br></li><li>Migrate this into some form of CI arrangement based off git<br></li><li>Work out solution for LE certs with DNS challenges<br></li><li>Rebuild UCC internal DNS server infrastructure (mooneye) - both authoritative and resolver<br></li></ul><div><br></div><div>Happy to explain in more detail over a video chat, or IRC, or over pizza when I'm in Perth<br></div><div><br></div><div>Cheers,<br></div><div>Mark<br></div><div id="qt-qt-qt-sig26513633"><div class="qt-qt-qt-signature">--<br></div><div class="qt-qt-qt-signature">Mark Tearle <<a href="mailto:mtearle@ucc.asn.au">mtearle@ucc.asn.au</a>><br></div></div><div><br></div><div>_______________________________________________<br></div><div>List Archives: <a href="http://lists.ucc.asn.au/pipermail/tech">http://lists.ucc.asn.au/pipermail/tech</a><br></div><div><br></div><div>Unsubscribe here: <a href="https://lists.ucc.gu.uwa.edu.au/mailman/options/tech/mtearle%40ucc.gu.uwa.edu.au">https://lists.ucc.gu.uwa.edu.au/mailman/options/tech/mtearle%40ucc.gu.uwa.edu.au</a><br></div><div><br></div></blockquote><div><br></div></blockquote><div><br></div><div>_______________________________________________<br></div><div>List Archives: <a href="http://lists.ucc.asn.au/pipermail/tech">http://lists.ucc.asn.au/pipermail/tech</a><br></div><div><br></div><div>Unsubscribe here: <a href="https://lists.ucc.gu.uwa.edu.au/mailman/options/tech/mtearle%40ucc.gu.uwa.edu.au">https://lists.ucc.gu.uwa.edu.au/mailman/options/tech/mtearle%40ucc.gu.uwa.edu.au</a><br></div><div><br></div></blockquote><div><br></div></body></html>