search

slackhq / nebula

A scalable overlay networking tool with a focus on performance, simplicity and security
MIT License
14.53k stars 977 forks source link

CNAME entries in nebula DNS service? #651

Open goligo opened 2 years ago

goligo commented 2 years ago

I would like to have additional host names for my hosts attached to the nebula network. I have enabled the DNS service in nebula, which is working as expected, but I would like to be able to add additional entries to the DNS table, so I can have alias names for my hosts. Is there any possibility to already achieve this, which I have missed? Or do I need to install unbound instead (including double maintenance and possibility of inconsistence)?

goligo commented 2 years ago

https://github.com/slackhq/nebula/pull/617

This pull request seems to provide the feature I am asking for.

siepkes commented 1 year ago

I think a project such as unbound is perfectly complements Nebula in this regard. You can setup a stub-zone and point it to the DNS interface of Nebula. And you can use local-zone with local-data for custom CNAME entries.

siepkes commented 1 year ago

Since I see the NeedsDecision tag was added to this so I thought I would add my 2 cents.

I see why people would want custom CNAME support but personally I think the DNS interface in Nebula should be designed to be used with an external DNS service. Not necessarily to serve as a standalone DNS server. That way you have a clear design mandate as to what the DNS interface should (and should not) support.

So for example one could add zone transfer support to Nebula to improve the integration with external DNS services. But custom CNAME support is something an external DNS would handle. Also things such as request throttling, hardening, etc. are then clearly out of scope and something the external DNS server should handle. Also other record types such as service records (SRV), reverse records (PTR), IPv6 records (AAAA), etc. would then all be out of scope and handled by the external DNS.

An external DNS service doesn't have to be "big". For example systemd-resolved can be used on a local system to setup split DNS to delegate all DNS requests for the domain nebula.example.com (see this article). Or one could use a simple small network DNS tool such as DNSMasq.