Debian 12 / Ubuntu 24.04 安装 PowerDNS 和 PowerDNS-Admin 自建权威 DNS 教程

apt update
apt upgrade -y

cat >> /etc/apt/preferences.d/pdns << EOF
Package: pdns-*
Pin: origin repo.powerdns.com
Pin-Priority: 600
EOF

curl -sSL https://mariadb.org/mariadb_release_signing_key.asc | gpg --dearmor > /usr/share/keyrings/mariadb.gpg

apt update
apt install pdns-server pdns-backend-mysql mariadb-server

mkdir /var/lib/mysql-bin
chown mysql:mysql /var/lib/mysql-bin

cat > /etc/mysql/mariadb.conf.d/61-master.cnf <<EOF
[mysqld]
skip-host-cache
skip-name-resolve
bind-address = 0.0.0.0

server-id = $SRANDOM
log-bin = /var/lib/mysql-bin/binlog
expire_logs_days = 7
EOF

apt install nftables
cat > /etc/nftables.conf <<EOF
#!/usr/sbin/nft -f

flush ruleset

table inet filter {
        chain input {
                type filter hook input priority filter; policy accept;
                ip saddr 127.0.0.1 accept
                ip saddr 198.51.100.53 accept
                tcp dport 3306 drop
        }

        chain forward {
                type filter hook forward priority filter; policy accept;
        }

        chain output {
                type filter hook output priority filter; policy accept;
        }
}
EOF

mariadb -e "GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* to 'backup'@'%' identified by 'backup_pass';"

systemctl enable nftables --now
systemctl restart mariadb

mkdir /var/lib/mysql-bin
chown mysql:mysql /var/lib/mysql-bin

cat > /etc/mysql/mariadb.conf.d/61-slave.cnf <<EOF
[mysqld]
skip-host-cache
skip-name-resolve

server-id = $SRANDOM
relay-log = /var/lib/mysql-bin/relaylog
expire_logs_days = 7
EOF

sed -i 's/expire_logs_days/#expire_logs_days/g' /etc/mysql/mariadb.conf.d/50-server.cnf

apt install nftables
cat > /etc/nftables.conf <<EOF
#!/usr/sbin/nft -f

flush ruleset

table inet filter {
        chain input {
                type filter hook input priority filter; policy accept;
                ip saddr 127.0.0.1 accept
                tcp dport 3306 drop
        }

        chain forward {
                type filter hook forward priority filter; policy accept;
        }

        chain output {
                type filter hook output priority filter; policy accept;
        }
}
EOF

systemctl enable nftables --now
systemctl restart mariadb

mariadb -e "show binary logs;\G"

mariadb -e "CHANGE MASTER TO MASTER_HOST='192.0.2.53', MASTER_USER='backup', MASTER_PASSWORD='backup_pass', MASTER_PORT=3306, MASTER_LOG_FILE='binlog.000001', MASTER_LOG_POS=325; START SLAVE; SHOW SLAVE STATUS\G"

mariadb -u root
CREATE DATABASE pdns_database DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci; 
GRANT ALL ON pdns_database.* TO 'pdns_user'@'%' IDENTIFIED BY 'pdns_password';
FLUSH PRIVILEGES; 
EXIT;

cd /usr/share/pdns-backend-mysql/schema
mariadb -u pdns_user --default-character-set=utf8mb4 -p pdns_database < schema.mysql.sql
mariadb -u pdns_user --default-character-set=utf8mb4 -p pdns_database < enable-foreign-keys.mysql.sql

mariadb -e "show databases;\G" 

rm -rf /etc/powerdns/pdns.d/bind.conf

cat >> /etc/powerdns/pdns.d/dns.conf << EOF
launch=gmysql
gmysql-host=localhost
gmysql-user=pdns_user
gmysql-dbname=pdns_database
gmysql-password=pdns_password
gmysql-dnssec=yes
default-soa-content=ns1.example.com hostmaster.example.com 0 3600 14400 604800 3600
api=yes
api-key=random_api_key
local-address=0.0.0.0 ::
local-port=53
webserver-address=0.0.0.0
webserver-allow-from=127.0.0.1, ::1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
webserver-port=8081
EOF

gmysql-host=localhost
gmysql-user=pdns_user
gmysql-dbname=pdns_database
gmysql-password=pdns_password
gmysql-dnssec=yes

default-soa-content=ns1.example.com hostmaster.example.com 0 3600 14400 604800 3600

api=yes
api-key=random_api_key
local-address=0.0.0.0 ::
local-port=53
webserver-address=0.0.0.0
webserver-allow-from=127.0.0.1, ::1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
webserver-port=8081

local-address=0.0.0.0 ::
local-port=53

systemctl restart pdns

cat > /opt/docker-compose.yaml <<EOF
version: '3.9'

services:
  powerdns-admin:
    image: powerdnsadmin/pda-legacy:latest
    container_name: powerdns-admin
    ports:
      - "127.0.0.1:8080:80"
    environment:
      - SECRET_KEY=random_secret_key
      - SQLALCHEMY_DATABASE_URI=mysql://powerdns-admin-user:powerdns-admin-password@powerdns-admin-mariadb/powerdns-admin-database
      - GUNICORN_TIMEOUT=60
      - GUNICORN_WORKERS=4
      - GUNICORN_LOGLEVEL=DEBUG
      - OFFLINE_MODE=False
    restart: unless-stopped
    volumes:
      - ./data/powerdns-admin:/data
    depends_on:
      - powerdns-admin-mariadb

  powerdns-admin-mariadb:
    image: mariadb:11.4
    container_name: powerdns-admin-mariadb
    ports:
      - '127.0.0.1:3306:3306'
    environment:
      - MYSQL_ROOT_PASSWORD=mysql_root_password
      - MYSQL_DATABASE=powerdns-admin-database
      - MYSQL_USER=powerdns-admin-user
      - MYSQL_PASSWORD=powerdns-admin-password
    restart: unless-stopped
    volumes:
      - ./data/mysql:/var/lib/mysql
EOF

cd /opt
docker compose pull
docker compose up -d

location / {
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $host;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "";
    proxy_redirect off;
    proxy_set_header        X-Forwarded-Proto $scheme;
    proxy_connect_timeout       300;
    proxy_send_timeout          300;
    proxy_read_timeout          300;
    end_timeout                300;
    proxy_pass http://127.0.0.1:8080;
}

apt install dnsutils -y

root@debian ~ # host example.com
example.com has address 203.0.113.2
example.com has IPv6 address 2001:db8::2

root@ns1 ~ # dig A example.com @localhost +short
203.0.113.2

root@ns2 ~ # dig A example.com @localhost +short
203.0.113.2

root@ns1 ~ # dig NS example.com +short
ns1.example.com.
ns2.example.com.

root@ns1 ~ # dig NS example.com @1.1.1.1 +short
ns1.example.com.
ns2.example.com.

apt install whois

root@ns2 ~ # whois example.com | grep 'Name\ Server'
   Name Server: NS1.EXAMPLE.COM
   Name Server: NS2.EXAMPLE.COM

root@ns2 ~ # dig DS example.com +short