dns.democrat

Docs

Overview

  • Your namespace is myname. A record myserver becomes myserver.myname.dns.democrat.
  • A record is A (IPv4) or AAAA (IPv6). For both, create two records with the same name.
  • Each record has an ID and a secret key. The key is shown once. Reset it on the dashboard if you lose it. Below they are RECORD_ID and KEY.
  • The server stores the address the update comes from. Run the update on the machine whose address you want to publish. Loopback, link-local, multicast and private addresses are refused.

curl

Send the key in the X-Secret header.

curl -4 -H 'X-Secret: KEY' https://dns.democrat/update/RECORD_ID   # A record
curl -6 -H 'X-Secret: KEY' https://dns.democrat/update/RECORD_ID   # AAAA record

Reply on success:

OK 203.0.113.7
401
Missing or wrong key.
400
Wrong IP family (use -4 for A, -6 for AAAA) or the address is not allowed.
429
Too many requests. Slow down.

Key in a file

Keeps the key out of shell history and the process list.

printf 'X-Secret: %s\n' 'KEY' > ~/.dns-democrat-myserver
chmod 600 ~/.dns-democrat-myserver
curl -4 -H @"$HOME/.dns-democrat-myserver" https://dns.democrat/update/RECORD_ID

dyndns2 (ddclient, routers)

For ddclient, routers and other clients that speak the Dyn update protocol. Log in with the record ID as username and the key as password. hostname is the record's full name. One request updates one record.

curl -4 -u RECORD_ID:KEY 'https://dns.democrat/nic/update?hostname=myserver.myname.dns.democrat'

ddclient.conf:

protocol=dyndns2
ssl=yes
server=dns.democrat
login=RECORD_ID
password='KEY'
myserver.myname.dns.democrat

Router URL, if the router asks for one. Put the record ID and key in its username and password fields.

https://dns.democrat/nic/update?hostname=myserver.myname.dns.democrat

The server stores the address the request comes from. myip is only checked against it; if it differs, the reply is nohost.

good IP
Address changed.
nochg IP
Address already set.
badauth
Wrong record ID or key (HTTP 401).
nohost
Wrong hostname, wrong IP family, myip differs, or the address is not allowed.
notfqdn
No hostname.
numhost
More than one hostname.
911
Server error. Try again later.

nsupdate

Each record also has a TSIG key named RECORD_ID.dns.democrat.. The dashboard shows it with the HTTP key. Save the key file:

key "RECORD_ID.dns.democrat." {
	algorithm hmac-sha256;
	secret "TSIG_SECRET";
};

Send the update over TCP (-v):

$ nsupdate -v -k myserver.myname.dns.democrat.key
server ns1.dns.democrat.
zone dns.democrat.
update delete myserver.myname.dns.democrat. A
update add myserver.myname.dns.democrat. 60 A 203.0.113.7
send
  • The zone is always dns.democrat., not your namespace.
  • UDP updates are refused. An add replaces the old address.

systemd timer

Runs curl every hour.

1. Store the key

The file holds one line: X-Secret: KEY.

sudo install -d -m 700 /etc/dns-democrat
sudo install -m 600 /dev/null /etc/dns-democrat/myserver.header
sudoedit /etc/dns-democrat/myserver.header

2. Service

/etc/systemd/system/dns-democrat-myserver.service

[Unit]
Description=Update myserver.myname.dns.democrat
Wants=network-online.target
After=network-online.target

[Service]
Type=oneshot
DynamicUser=yes
LoadCredential=secret:/etc/dns-democrat/myserver.header
ExecStart=/usr/bin/curl -4 --silent --show-error --max-time 30 --retry 3 -H @${CREDENTIALS_DIRECTORY}/secret https://dns.democrat/update/RECORD_ID

For AAAA, make a second service and timer with -6 and that record's ID and key.

3. Timer

/etc/systemd/system/dns-democrat-myserver.timer

[Unit]
Description=Update myserver.myname.dns.democrat every hour

[Timer]
OnCalendar=hourly
RandomizedDelaySec=5m
Persistent=true

[Install]
WantedBy=timers.target

4. Enable

sudo systemctl daemon-reload
sudo systemctl enable --now dns-democrat-myserver.timer
sudo systemctl start dns-democrat-myserver.service   # update once now
systemctl list-timers dns-democrat-myserver.timer
journalctl -u dns-democrat-myserver.service

The journal shows OK and the address.