<p>I’ve been using <ahref="https://doc.powerdns.com/md/">PowerDNS</a> with a SQL backend as a hidden master DNS server for a few years now.</p>
<p>I’ve been wanting to write a quick shell script to version my DNS zones for a while, and since I’ve finally taken the time to do so today, I figured I’d share it here.</p>
<p>The script uses PowerDNS API to list the configured zones. It then exports them to a file in an AXFR-like format, commits and finally pushes them on a git repository</p>
<h1id="configuration">Configuration</h1>
<h2id="powerdns">PowerDNS</h2>
<p>For the script to work, we have to activate PowerDNS’ API.</p>
<p>To do so, let’s create a <code>/etc/powerdns/pdns.d/api.conf</code> file with the following content :</p>
<pre><code>api=yes
api-key=mysupersecretapikey
webserver=yes
webserver-address=10.0.0.10
webserver-allow-from=10.0.0.0/8
webserver-port=8081
</code></pre>
<p>You should change <em>mysupersecretapikey</em> to an actual secret.</p>
<p>You should also adapt the <code>webserver-address</code> and <code>webserver-allow-from</code> to reflect your network configuration.</p>
<p>Once the file is created, we have to restart pdnsd :</p>
<pre><code>systemctl restart pdns.service
</code></pre>
<p><strong>N.B. :</strong> As with all my other articles, I’m assuming here you’re running Debian. The path of the configuration file you have to create or edit might not be the same if you’re running another distribution or if you’ve installed PowerDNS from source.</p>
<h2id="jq">jq</h2>
<p><ahref="https://stedolan.github.io/jq/">jq</a> is required for the script to work, so let’s install it !</p>
<pre><code>apt install jq
</code></pre>
<h2id="git">Git</h2>
<p>We now have to create a git repository to host our zone files.</p>
<p>To do so, you can follow my <ahref="https://www.captainark.net/2016/01/31/private-git-repo/">previous tutorial</a> on the subject if you want.</p>
<p>I’ve personnaly migrated my git repos to a self-hosted <ahref="https://gogs.io/">Gogs</a> installation a while back.</p>
<p>If you don’t care about your zones content being public (it already is, technically), you could create a GitHub repo for that use (or on any other available git hosting).</p>
<p>Once you’ve created your repo, you should clone it on the machine that will run the script. For me, the path to the repo will be <code>/home/captainark/backup/dnsexport</code>.</p>
<p>It’s nothing fancy, but it does the job.</p>
<p>You’ll have to adapt the <code>ApiKey</code>, <code>PdnsUrl</code> and <code>ExportFolder</code> variables to your configuration.</p>
<p>Once that’s done, let’s fix the permissions on the script :</p>
<pre><code>chmod 700 ~/bin/dnsexport
</code></pre>
<p>You should run the script manually once to make sure everything is working OK. If it is, you should see a new commit on the repo for each zone you have configured in PowerDNS.</p>
<p>Once the script has executed once without issue, you can schedule it regularly. I have it running every 10 minutes in my user’s crontab :</p>
<pre><code>crontab -e
# DNSEXPORT
*/10 * * * * /home/captainark/bin/dnsexport
</code></pre>
<h1id="conclusion">Conclusion</h1>
<p>That’s all !</p>
<p>As always, if you’ve found this article useful, please feel free to make use of the comments section below !</p>
<p>Hopefully it won’t take as long before I write another article here next time !</p>
<sectionclass="poweredby">Proudly generated by <aclass="icon-hugo"href="http://gohugo.io">HUGO</a>, with <aclass="icon-theme"href="https://github.com/vjeantet/hugo-theme-casper">Casper</a> theme</section>
