# Project Clearwater - IMS in the Cloud # Copyright (C) 2015 Metaswitch Networks Ltd # # This program is free software: you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by the # Free Software Foundation, either version 3 of the License, or (at your # option) any later version, along with the "Special Exception" for use of # the program along with SSL, set forth below. This program is distributed # in the hope that it will be useful, but WITHOUT ANY WARRANTY; # without even the implied warranty of MERCHANTABILITY or FITNESS FOR # A PARTICULAR PURPOSE. See the GNU General Public License for more # details. You should have received a copy of the GNU General Public # License along with this program. If not, see # <http://www.gnu.org/licenses/>. # # The author can be reached by email at clearwater@metaswitch.com or by # post at Metaswitch Networks Ltd, 100 Church St, Enfield EN2 6BQ, UK # # Special Exception # Metaswitch Networks Ltd grants you permission to copy, modify, # propagate, and distribute a work formed by combining OpenSSL with The # Software, or a work derivative of such a combination, even if such # copying, modification, propagation, or distribution would otherwise # violate the terms of the GPL. You must comply with the GPL in all # respects for all of the code used other than OpenSSL. # "OpenSSL" means OpenSSL toolkit software distributed by the OpenSSL # Project and licensed under the OpenSSL Licenses, or a work based on such # software and licensed under the OpenSSL Licenses. # "OpenSSL Licenses" means the OpenSSL License and Original SSLeay License # under which the OpenSSL Project distributes the OpenSSL toolkit software, # as those licenses appear in the file LICENSE-OPENSSL. heat_template_version: 2013-05-23 description: > DNS server exposing dynamic DNS using DNSSEC parameters: vnf_id: type: string label: VNF ID description: The VNF ID provided by ONAP vf_module_id: type: string label: VNF module ID description: The VNF module ID provided by ONAP public_net_id: type: string description: ID of public network constraints: - custom_constraint: neutron.network description: Must be a valid network ID dns_flavor_name: type: string description: Flavor to use constraints: - custom_constraint: nova.flavor description: Must be a valid flavor name dns_image_name: type: string description: Name of image to use key_name: type: string description: Name of keypair to assign constraints: - custom_constraint: nova.keypair description: Must be a valid keypair name # dns_security_group: # type: string # description: ID of security group for DNS nodes zone: type: string description: DNS zone default: example.com dnssec_key: type: string description: DNSSEC private key (Base64-encoded) resources: server: type: OS::Nova::Server properties: name: { str_replace: { params: { __zone__: { get_param: zone } }, template: ns.__zone__ } } image: { get_param: dns_image_name } flavor: { get_param: dns_flavor_name } key_name: { get_param: key_name } networks: - network: { get_param: public_net_id } metadata: {vnf_id: { get_param: vnf_id }, vf_module_id: { get_param: vf_module_id }} user_data_format: RAW user_data: str_replace: params: __zone__: { get_param: zone } __dnssec_key__: { get_param: dnssec_key } template: | #!/bin/bash # Log all output to file. exec > >(tee -a /var/log/clearwater-heat-dns.log) 2>&1 set -x # Install BIND. apt-get update DEBIAN_FRONTEND=noninteractive apt-get install bind9 --yes # Get the public IP address from eth0 sudo apt-get install ipcalc ADDR=`ip addr show eth0 | awk '/inet /{print $2}'` PUBLIC_ADDR=`ipcalc -n -b $ADDR | awk '/Address:/{print $2}'` # Update BIND configuration with the specified zone and key. cat >> /etc/bind/named.conf.local << EOF key __zone__. { algorithm "HMAC-MD5"; secret "__dnssec_key__"; }; zone "__zone__" IN { type master; file "/var/lib/bind/db.__zone__"; allow-update { key __zone__.; }; }; EOF # Function to give DNS record type and IP address for specified IP address ip2rr() { if echo $1 | grep -q -e '[^0-9.]' ; then echo AAAA $1 else echo A $1 fi } # Create basic zone configuration. cat > /var/lib/bind/db.__zone__ << EOF \$ORIGIN __zone__. \$TTL 1h @ IN SOA ns admin\@__zone__. ( $(date +%Y%m%d%H) 1d 2h 1w 30s ) @ NS ns ns $(ip2rr $PUBLIC_ADDR) EOF chown root:bind /var/lib/bind/db.__zone__ # Now that BIND configuration is correct, kick it to reload. service bind9 reload outputs: dns_ip: description: IP address of DNS server value: { get_attr: [ server, accessIPv4 ] } zone: description: DNS zone value: { get_param: zone } dnssec_key: description: DNSSEC private key (Base64-encoded) value: { get_param: dnssec_key }