vault backup: 2026-01-05 13:03:55
This commit is contained in:
windyboy
@@ -0,0 +1,305 @@
|
||||
|
||||
# 🌀 从 Slave 节点恢复 PowerDNS Authoritative 主节点（5.0.0 + PostgreSQL）
|
||||
|
||||
> 本文记录如何从 PowerDNS 从节点完整恢复主节点，包括数据库重建、Zone 导入、TSIG 同步与 DNSSEC 校验。
|
||||
> 适用于 **PowerDNS Authoritative 5.0.0** + **PostgreSQL gpgsql backend** 环境。
|
||||
|
||||
---
|
||||
|
||||
## 一、系统角色
|
||||
|
||||
|节点|地址|角色|说明|
|
||||
|---|---|---|---|
|
||||
|主节点|154.36.174.161|primary|新建|
|
||||
|从节点|202.91.35.141|secondary|当前持有所有 zone|
|
||||
|数据库|PostgreSQL 15|backend|gpgsql|
|
||||
|TSIG|mykey (hmac-sha512)|用于 AXFR 验证||
|
||||
|
||||
---
|
||||
|
||||
## 二、从 Slave 导出数据
|
||||
|
||||
### 1️⃣ 列出所有 zone
|
||||
|
||||
```bash
|
||||
sudo pdnsutil zone list-all
|
||||
```
|
||||
|
||||
### 2️⃣ 导出 zone 文件（PowerDNS 5.0 无 dump-zone）
|
||||
|
||||
```bash
|
||||
sudo pdnsutil zone list windy.me > /var/tmp/windy.me.zone
|
||||
sudo pdnsutil zone list wsvc.info > /var/tmp/wsvc.info.zone
|
||||
sudo pdnsutil zone list chans.xyz > /var/tmp/chans.xyz.zone
|
||||
```
|
||||
|
||||
### 3️⃣ 导出 TSIG 密钥
|
||||
|
||||
```bash
|
||||
sudo pdnsutil tsigkey list
|
||||
```
|
||||
|
||||
示例：
|
||||
|
||||
```
|
||||
mykey. hmac-sha512. 4es15ROFVNZh76mqbn7sVu1kodAdULYKp8I/jGAWvmH/uyxeyDwqoBiYYBKPro5M+TRkKYn7ulxZKskfKIBKNg==
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 三、部署主节点环境
|
||||
|
||||
### 1️⃣ 目录结构
|
||||
|
||||
```
|
||||
/opt/pdns-primary/
|
||||
├── docker-compose.yml
|
||||
├── pdns.conf
|
||||
└── db-init/
|
||||
└── 01-init.sql
|
||||
```
|
||||
|
||||
### 2️⃣ docker-compose.yml
|
||||
|
||||
```yaml
|
||||
version: "3.8"
|
||||
services:
|
||||
pdns-db:
|
||||
image: postgres:15
|
||||
environment:
|
||||
POSTGRES_USER: pdns
|
||||
POSTGRES_PASSWORD: windyboy2006
|
||||
POSTGRES_DB: pdns
|
||||
volumes:
|
||||
- ./db-init:/docker-entrypoint-initdb.d
|
||||
- pdns-db-data:/var/lib/postgresql/data
|
||||
restart: unless-stopped
|
||||
|
||||
auth:
|
||||
image: powerdns/pdns-auth-50:latest
|
||||
depends_on:
|
||||
- pdns-db
|
||||
volumes:
|
||||
- ./pdns.conf:/etc/powerdns/pdns.conf:ro
|
||||
- ./import:/import:ro
|
||||
ports:
|
||||
- "53:53/tcp"
|
||||
- "53:53/udp"
|
||||
- "8081:8081"
|
||||
restart: unless-stopped
|
||||
|
||||
volumes:
|
||||
pdns-db-data:
|
||||
```
|
||||
|
||||
### 3️⃣ 初始化数据库
|
||||
|
||||
`db-init/01-init.sql`：
|
||||
|
||||
```sql
|
||||
CREATE USER pdns WITH PASSWORD 'windyboy2006';
|
||||
CREATE DATABASE pdns OWNER pdns ENCODING 'UTF8';
|
||||
```
|
||||
|
||||
启动数据库：
|
||||
|
||||
```bash
|
||||
docker compose up -d pdns-db
|
||||
sleep 10
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 四、主节点配置（pdns.conf）
|
||||
|
||||
```ini
|
||||
primary=yes
|
||||
secondary=no
|
||||
launch=gpgsql
|
||||
gpgsql-host=pdns-db
|
||||
gpgsql-port=5432
|
||||
gpgsql-dbname=pdns
|
||||
gpgsql-user=pdns
|
||||
gpgsql-password=windyboy2006
|
||||
gpgsql-dnssec=yes
|
||||
|
||||
local-address=0.0.0.0
|
||||
local-port=53
|
||||
setuid=pdns
|
||||
setgid=pdns
|
||||
loglevel=4
|
||||
version-string=anonymous
|
||||
|
||||
api=yes
|
||||
api-key=SuperSecretKey
|
||||
webserver=yes
|
||||
webserver-address=0.0.0.0
|
||||
webserver-port=8081
|
||||
|
||||
default-soa-edit=INCEPTION-INCREMENT
|
||||
default-soa-edit-signed=INCEPTION-INCREMENT
|
||||
disable-axfr=no
|
||||
```
|
||||
|
||||
✅ 所有字段均为 **5.0.0 有效选项**，无 `default-soa-edit-api`。
|
||||
|
||||
---
|
||||
|
||||
## 五、导入 Zone 数据
|
||||
|
||||
### 1️⃣ 创建空 zone 并设为 master
|
||||
|
||||
```bash
|
||||
docker compose exec auth pdnsutil zone create windy.me
|
||||
docker compose exec auth pdnsutil zone set-kind windy.me master
|
||||
|
||||
docker compose exec auth pdnsutil zone create wsvc.info
|
||||
docker compose exec auth pdnsutil zone set-kind wsvc.info master
|
||||
|
||||
docker compose exec auth pdnsutil zone create chans.xyz
|
||||
docker compose exec auth pdnsutil zone set-kind chans.xyz master
|
||||
```
|
||||
|
||||
### 2️⃣ 导入 zone 文件
|
||||
|
||||
```bash
|
||||
docker compose exec auth pdnsutil zone load windy.me /import/windy.me.zone
|
||||
docker compose exec auth pdnsutil zone load wsvc.info /import/wsvc.info.zone
|
||||
docker compose exec auth pdnsutil zone load chans.xyz /import/chans.xyz.zone
|
||||
```
|
||||
|
||||
### 3️⃣ 如 zone 含有 RRSIG/DNSKEY，设为 presigned
|
||||
|
||||
```bash
|
||||
docker compose exec auth pdnsutil zone set-presigned windy.me
|
||||
docker compose exec auth pdnsutil zone set-presigned wsvc.info
|
||||
docker compose exec auth pdnsutil zone set-presigned chans.xyz
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 六、导入 TSIG 密钥并授权从节点
|
||||
|
||||
### 1️⃣ 导入 TSIG key
|
||||
|
||||
```bash
|
||||
docker compose exec auth pdnsutil tsigkey import "mykey." hmac-sha512 "4es15ROFVNZh76mqbn7sVu1kodAdULYKp8I/jGAWvmH/uyxeyDwqoBiYYBKPro5M+TRkKYn7ulxZKskfKIBKNg=="
|
||||
```
|
||||
|
||||
### 2️⃣ 授权从节点（202.91.35.141）
|
||||
|
||||
```bash
|
||||
docker compose exec auth pdnsutil metadata set windy.me TSIG-ALLOW-AXFR "mykey."
|
||||
docker compose exec auth pdnsutil metadata set windy.me ALLOW-AXFR-FROM "202.91.35.141"
|
||||
docker compose exec auth pdnsutil metadata set windy.me ALSO-NOTIFY "202.91.35.141"
|
||||
|
||||
docker compose exec auth pdnsutil metadata set wsvc.info TSIG-ALLOW-AXFR "mykey."
|
||||
docker compose exec auth pdnsutil metadata set wsvc.info ALLOW-AXFR-FROM "202.91.35.141"
|
||||
docker compose exec auth pdnsutil metadata set wsvc.info ALSO-NOTIFY "202.91.35.141"
|
||||
|
||||
docker compose exec auth pdnsutil metadata set chans.xyz TSIG-ALLOW-AXFR "mykey."
|
||||
docker compose exec auth pdnsutil metadata set chans.xyz ALLOW-AXFR-FROM "202.91.35.141"
|
||||
docker compose exec auth pdnsutil metadata set chans.xyz ALSO-NOTIFY "202.91.35.141"
|
||||
```
|
||||
|
||||
> ⚠️ 不带 `@mykey.`，因为已全局指定 TSIG key。
|
||||
|
||||
---
|
||||
|
||||
## 七、在从节点配置新的主节点
|
||||
|
||||
```bash
|
||||
sudo pdnsutil zone create-secondary windy.me 154.36.174.161
|
||||
sudo pdnsutil metadata set windy.me AXFR-MASTER-TSIG "mykey."
|
||||
|
||||
sudo pdnsutil zone create-secondary wsvc.info 154.36.174.161
|
||||
sudo pdnsutil metadata set wsvc.info AXFR-MASTER-TSIG "mykey."
|
||||
|
||||
sudo pdnsutil zone create-secondary chans.xyz 154.36.174.161
|
||||
sudo pdnsutil metadata set chans.xyz AXFR-MASTER-TSIG "mykey."
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 八、触发 AXFR 同步
|
||||
|
||||
### 主节点发送 NOTIFY
|
||||
|
||||
```bash
|
||||
docker compose exec auth pdns_control notify windy.me
|
||||
docker compose exec auth pdns_control notify wsvc.info
|
||||
docker compose exec auth pdns_control notify chans.xyz
|
||||
```
|
||||
|
||||
### 从节点主动获取
|
||||
|
||||
```bash
|
||||
sudo pdns_control retrieve windy.me
|
||||
sudo pdns_control retrieve wsvc.info
|
||||
sudo pdns_control retrieve chans.xyz
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 九、验证结果
|
||||
|
||||
### 检查 zone 状态
|
||||
|
||||
```bash
|
||||
docker compose exec auth pdnsutil zone list-all
|
||||
```
|
||||
|
||||
### 对比 SOA 序列号
|
||||
|
||||
```bash
|
||||
dig @154.36.174.161 soa windy.me +short
|
||||
dig @202.91.35.141 soa windy.me +short
|
||||
```
|
||||
|
||||
应相同。
|
||||
|
||||
### 查看日志
|
||||
|
||||
主节点：
|
||||
|
||||
```
|
||||
AXFR-out zone 'windy.me', client '202.91.35.141' transfer started/done
|
||||
```
|
||||
|
||||
从节点：
|
||||
|
||||
```
|
||||
AXFR done for 'windy.me'
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 十、常见错误与修复
|
||||
|
||||
|日志|原因|修复|
|
||||
|---|---|---|
|
||||
|Signature with TSIG key failed|双方 TSIG secret 不一致|重新导入一致的 key|
|
||||
|Server Not Authoritative / Not Authorized|主节点未授权从节点|执行 metadata set ALLOW-AXFR-FROM|
|
||||
|AXFR-out denied: client has no permission|同上|增加 ALLOW-AXFR-FROM|
|
||||
|Trying to set unknown setting 'default-soa-edit-api'|配置无效|删除该字段|
|
||||
|
||||
---
|
||||
|
||||
## 十一、备份与维护
|
||||
|
||||
### 1️⃣ 数据库备份
|
||||
|
||||
```bash
|
||||
docker compose exec pdns-db pg_dump -U pdns pdns > /backup/pdns-$(date +%F).dump
|
||||
```
|
||||
|
||||
### 2️⃣ 导出所有 zone 文件
|
||||
|
||||
```bash
|
||||
mkdir -p /backup/zones
|
||||
for z in $(docker compose exec auth pdnsutil zone list-all | tr -d '\r'); do
|
||||
docker compose exec auth pdnsutil zone list "$z" > "/backup/zones/$z-$(date +%F).zone"
|
||||
done
|
||||
```
|
||||
|
||||
---
|
||||
Reference in New Issue
Block a user