gitops/homelab-v
1
0
Fork 0
mirror of https://github.com/outbackdingo/homelab-v.git synced 2026-09-01 17:19:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(network): Conflicting port-names in DNS-deployment

Browse Source
This commit is contained in:
Vegard Hagen
2023-08-02 11:16:52 +02:00
parent b033608da1
commit 563c2edc5b
5 changed files with 134 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/net-aux/config/unbound/unbound.conf
+5 -3
View File
@@ -1,6 +1,6 @@
server:
# See https://github.com/MatthewVance/unbound-docker/blob/master/unbound.conf for details
interface: 127.0.0.1
interface: 0.0.0.0
port: 5335
cache-max-ttl: 86400
@@ -21,10 +21,10 @@ server:
log-local-actions: no
log-queries: no
log-replies: no
log-servfail: no
log-servfail: yes
#logfile: /opt/unbound/etc/unbound/unbound.log
verbosity: 1
verbosity: 2
infra-cache-slabs: 4
incoming-num-tcp: 10
@@ -107,7 +107,9 @@ server:
use-caps-for-id: no
val-clean-additional: yes
include: /opt/unbound/etc/unbound/a-records.conf
include: /opt/unbound/etc/unbound/srv-records.conf
remote-control:
control-enable: no
infra/net-aux/deployment.yaml
+3 -3
View File
@@ -29,10 +29,10 @@ spec:
image: mvance/unbound:1.17.1
imagePullPolicy: IfNotPresent
ports:
- name: dns-tcp
- name: unbound-dns-tcp
containerPort: 5335
protocol: TCP
- name: dns-udp
- name: unbound-dns-udp
containerPort: 5335
protocol: UDP
startupProbe:
@@ -52,7 +52,7 @@ spec:
subPath: unbound.conf
- name: pi-hole
image: pihole/pihole:2023.05.2
imagePullPolicy: IfNotPresent
imagePullPolicy: Always
envFrom:
- configMapRef:
name: pi-hole-env
infra/net-aux/service.yaml
+27 -6
View File
@@ -3,12 +3,12 @@ kind: Service
apiVersion: v1
metadata:
name: pi-hole-dns-udp
namespace: pi-hole
namespace: net-aux
annotations:
metallb.universe.tf/allow-shared-ip: net-aux
spec:
selector:
app: pi-hole
app: net-aux
ports:
- name: dns-udp
port: 53
@@ -20,12 +20,12 @@ kind: Service
apiVersion: v1
metadata:
name: pi-hole-dns-tcp
namespace: pi-hole
namespace: net-aux
annotations:
metallb.universe.tf/allow-shared-ip: net-aux
spec:
selector:
app: pi-hole
app: net-aux
ports:
- name: dns-tcp
port: 53
@@ -37,12 +37,12 @@ kind: Service
apiVersion: v1
metadata:
name: pi-hole-web
namespace: pi-hole
namespace: net-aux
annotations:
metallb.universe.tf/allow-shared-ip: net-aux
spec:
selector:
app: pi-hole
app: net-aux
ports:
- name: http
port: 80
@@ -51,3 +51,24 @@ spec:
port: 443
targetPort: https
type: LoadBalancer
---
kind: Service
apiVersion: v1
metadata:
name: unbound-dns
namespace: net-aux
annotations:
metallb.universe.tf/allow-shared-ip: net-aux
spec:
selector:
app: net-aux
ports:
- name: unbound-dns-tcp
port: 5335
protocol: TCP
targetPort: unbound-dns-tcp
- name: unbound-dns-udp
port: 5335
protocol: UDP
targetPort: unbound-dns-udp
type: LoadBalancer
infra/pi-hole/config/unbound/unbound.conf
+96 -49
View File
@@ -1,69 +1,116 @@
server:
# If no logfile is specified, syslog is used
# logfile: "/var/log/unbound/unbound.log"
verbosity: 0
interface: 127.0.0.1
# See https://github.com/MatthewVance/unbound-docker/blob/master/unbound.conf for details
interface: 0.0.0.0
port: 5335
do-ip4: yes
do-udp: yes
do-tcp: yes
# May be set to yes if you have IPv6 connectivity
do-ip6: no
cache-max-ttl: 86400
cache-min-ttl: 300
# You want to leave this to no unless you have *native* IPv6. With 6to4 and
# Terredo tunnels your web browser should favor IPv4 for the same reasons
prefer-ip6: no
# Use this only when you downloaded the list of primary root servers!
# If you use the default dns-root-data package, unbound will find it automatically
directory: "/opt/unbound/etc/unbound"
root-hints: "/opt/unbound/etc/unbound/root.hints"
# Trust glue only if it is within the server's authority
harden-glue: yes
do-ip4: yes
do-ip6: yes
prefer-ip6: no
do-tcp: yes
do-udp: yes
# Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
harden-dnssec-stripped: yes
# Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
# see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
use-caps-for-id: no
# Reduce EDNS reassembly buffer size.
# IP fragmentation is unreliable on the Internet today, and can cause
# transmission failures when large DNS messages are sent via UDP. Even
# when fragmentation does work, it may not be secure; it is theoretically
# possible to spoof parts of a fragmented DNS message, without easy
# detection at the receiving end. Recently, there was an excellent study
# >>> Defragmenting DNS - Determining the optimal maximum UDP response size for DNS <<<
# by Axel Koolhaas, and Tjeerd Slokker (https://indico.dns-oarc.net/event/36/contributions/776/)
# in collaboration with NLnet Labs explored DNS using real world data from the
# the RIPE Atlas probes and the researchers suggested different values for
# IPv4 and IPv6 and in different scenarios. They advise that servers should
# be configured to limit DNS messages sent over UDP to a size that will not
# trigger fragmentation on typical network links. DNS servers can switch
# from UDP to TCP when a DNS response is too big to fit in this limited
# buffer size. This value has also been suggested in DNS Flag Day 2020.
edns-buffer-size: 1232
rrset-roundrobin: yes
username: "_unbound"
log-local-actions: no
log-queries: no
log-replies: no
log-servfail: yes
#logfile: /opt/unbound/etc/unbound/unbound.log
verbosity: 2
infra-cache-slabs: 4
incoming-num-tcp: 10
key-cache-slabs: 4
msg-cache-size: 142768128
msg-cache-slabs: 4
num-queries-per-thread: 4096
num-threads: 3
outgoing-range: 8192
rrset-cache-size: 285536256
rrset-cache-slabs: 4
minimal-responses: yes
# Perform prefetching of close to expired message cache entries
# This only applies to domains that have been frequently queried
prefetch: yes
prefetch-key: yes
# One thread should be sufficient, can be increased on beefy machines. In reality for most users running on small networks or on a single machine, it should be unnecessary to seek performance enhancement by increasing num-threads above 1.
num-threads: 2
serve-expired: yes
# Ensure kernel buffer is large enough to not lose messages in traffic spikes
so-rcvbuf: 1m
so-reuseport: yes
# Ensure privacy of local IP ranges
aggressive-nsec: yes
delay-close: 10000
do-daemonize: no
do-not-query-localhost: no
neg-cache-size: 4M
qname-minimisation: yes
access-control: 127.0.0.1/32 allow
access-control: 192.168.0.0/16 allow
access-control: 172.16.0.0/12 allow
access-control: 10.0.0.0/8 allow
access-control: fc00::/7 allow
access-control: ::1/128 allow
auto-trust-anchor-file: "var/root.key"
chroot: "/opt/unbound/etc/unbound"
deny-any: yes
harden-algo-downgrade: yes
harden-below-nxdomain: yes
harden-dnssec-stripped: yes
harden-glue: yes
harden-large-queries: yes
harden-referral-path: no
harden-short-bufsize: yes
hide-http-user-agent: no
hide-identity: yes
hide-version: yes
http-user-agent: "DNS"
identity: "DNS"
private-address: 10.0.0.0/8
private-address: 172.16.0.0/12
private-address: 192.168.0.0/16
private-address: 169.254.0.0/16
private-address: 172.16.0.0/12
private-address: 10.0.0.0/8
private-address: fd00::/8
private-address: fe80::/10
private-address: ::ffff:0:0/96
ratelimit: 1000
tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
unwanted-reply-threshold: 10000
use-caps-for-id: no
val-clean-additional: yes
include: /opt/unbound/etc/unbound/a-records.conf
include: /opt/unbound/etc/unbound/srv-records.conf
remote-control:
control-enable: no
infra/pi-hole/deployment.yaml
+3 -3
View File
@@ -29,10 +29,10 @@ spec:
image: mvance/unbound:1.17.1
imagePullPolicy: IfNotPresent
ports:
- name: dns-tcp
- name: unbound-dns-tcp
containerPort: 5335
protocol: TCP
- name: dns-udp
- name: unbound-dns-udp
containerPort: 5335
protocol: UDP
startupProbe:
@@ -55,7 +55,7 @@ spec:
subPath: root.hints
- name: pi-hole
image: pihole/pihole:2023.05.2
imagePullPolicy: IfNotPresent
imagePullPolicy: Always
envFrom:
- configMapRef:
name: pi-hole-env