# 🌀 从 Slave 节点恢复 PowerDNS Authoritative 主节点（5.0.0 + PostgreSQL） > 本文记录如何从 PowerDNS 从节点完整恢复主节点，包括数据库重建、Zone 导入、TSIG 同步与 DNSSEC 校验。 > 适用于 **PowerDNS Authoritative 5.0.0** + **PostgreSQL gpgsql backend** 环境。 --- ## 一、系统角色 |节点|地址|角色|说明| |---|---|---|---| |主节点|154.36.174.161|primary|新建| |从节点|202.91.35.141|secondary|当前持有所有 zone| |数据库|PostgreSQL 15|backend|gpgsql| |TSIG|mykey (hmac-sha512)|用于 AXFR 验证|| --- ## 二、从 Slave 导出数据 ### 1️⃣ 列出所有 zone ```bash sudo pdnsutil zone list-all ``` ### 2️⃣ 导出 zone 文件（PowerDNS 5.0 无 dump-zone） ```bash sudo pdnsutil zone list windy.me > /var/tmp/windy.me.zone sudo pdnsutil zone list wsvc.info > /var/tmp/wsvc.info.zone sudo pdnsutil zone list chans.xyz > /var/tmp/chans.xyz.zone ``` ### 3️⃣ 导出 TSIG 密钥 ```bash sudo pdnsutil tsigkey list ``` 示例： ``` mykey. hmac-sha512. 4es15ROFVNZh76mqbn7sVu1kodAdULYKp8I/jGAWvmH/uyxeyDwqoBiYYBKPro5M+TRkKYn7ulxZKskfKIBKNg== ``` --- ## 三、部署主节点环境 ### 1️⃣ 目录结构 ``` /opt/pdns-primary/ ├── docker-compose.yml ├── pdns.conf └── db-init/ └── 01-init.sql ``` ### 2️⃣ docker-compose.yml ```yaml version: "3.8" services: pdns-db: image: postgres:15 environment: POSTGRES_USER: pdns POSTGRES_PASSWORD: windyboy2006 POSTGRES_DB: pdns volumes: - ./db-init:/docker-entrypoint-initdb.d - pdns-db-data:/var/lib/postgresql/data restart: unless-stopped auth: image: powerdns/pdns-auth-50:latest depends_on: - pdns-db volumes: - ./pdns.conf:/etc/powerdns/pdns.conf:ro - ./import:/import:ro ports: - "53:53/tcp" - "53:53/udp" - "8081:8081" restart: unless-stopped volumes: pdns-db-data: ``` ### 3️⃣ 初始化数据库 `db-init/01-init.sql`： ```sql CREATE USER pdns WITH PASSWORD 'windyboy2006'; CREATE DATABASE pdns OWNER pdns ENCODING 'UTF8'; ``` 启动数据库： ```bash docker compose up -d pdns-db sleep 10 ``` --- ## 四、主节点配置（pdns.conf） ```ini primary=yes secondary=no launch=gpgsql gpgsql-host=pdns-db gpgsql-port=5432 gpgsql-dbname=pdns gpgsql-user=pdns gpgsql-password=windyboy2006 gpgsql-dnssec=yes local-address=0.0.0.0 local-port=53 setuid=pdns setgid=pdns loglevel=4 version-string=anonymous api=yes api-key=SuperSecretKey webserver=yes webserver-address=0.0.0.0 webserver-port=8081 default-soa-edit=INCEPTION-INCREMENT default-soa-edit-signed=INCEPTION-INCREMENT disable-axfr=no ``` ✅ 所有字段均为 **5.0.0 有效选项**，无 `default-soa-edit-api`。 --- ## 五、导入 Zone 数据 ### 1️⃣ 创建空 zone 并设为 master ```bash docker compose exec auth pdnsutil zone create windy.me docker compose exec auth pdnsutil zone set-kind windy.me master docker compose exec auth pdnsutil zone create wsvc.info docker compose exec auth pdnsutil zone set-kind wsvc.info master docker compose exec auth pdnsutil zone create chans.xyz docker compose exec auth pdnsutil zone set-kind chans.xyz master ``` ### 2️⃣ 导入 zone 文件 ```bash docker compose exec auth pdnsutil zone load windy.me /import/windy.me.zone docker compose exec auth pdnsutil zone load wsvc.info /import/wsvc.info.zone docker compose exec auth pdnsutil zone load chans.xyz /import/chans.xyz.zone ``` ### 3️⃣ 如 zone 含有 RRSIG/DNSKEY，设为 presigned ```bash docker compose exec auth pdnsutil zone set-presigned windy.me docker compose exec auth pdnsutil zone set-presigned wsvc.info docker compose exec auth pdnsutil zone set-presigned chans.xyz ``` --- ## 六、导入 TSIG 密钥并授权从节点 ### 1️⃣ 导入 TSIG key ```bash docker compose exec auth pdnsutil tsigkey import "mykey." hmac-sha512 "4es15ROFVNZh76mqbn7sVu1kodAdULYKp8I/jGAWvmH/uyxeyDwqoBiYYBKPro5M+TRkKYn7ulxZKskfKIBKNg==" ``` ### 2️⃣ 授权从节点（202.91.35.141） ```bash docker compose exec auth pdnsutil metadata set windy.me TSIG-ALLOW-AXFR "mykey." docker compose exec auth pdnsutil metadata set windy.me ALLOW-AXFR-FROM "202.91.35.141" docker compose exec auth pdnsutil metadata set windy.me ALSO-NOTIFY "202.91.35.141" docker compose exec auth pdnsutil metadata set wsvc.info TSIG-ALLOW-AXFR "mykey." docker compose exec auth pdnsutil metadata set wsvc.info ALLOW-AXFR-FROM "202.91.35.141" docker compose exec auth pdnsutil metadata set wsvc.info ALSO-NOTIFY "202.91.35.141" docker compose exec auth pdnsutil metadata set chans.xyz TSIG-ALLOW-AXFR "mykey." docker compose exec auth pdnsutil metadata set chans.xyz ALLOW-AXFR-FROM "202.91.35.141" docker compose exec auth pdnsutil metadata set chans.xyz ALSO-NOTIFY "202.91.35.141" ``` > ⚠️ 不带 `@mykey.`，因为已全局指定 TSIG key。 --- ## 七、在从节点配置新的主节点 ```bash sudo pdnsutil zone create-secondary windy.me 154.36.174.161 sudo pdnsutil metadata set windy.me AXFR-MASTER-TSIG "mykey." sudo pdnsutil zone create-secondary wsvc.info 154.36.174.161 sudo pdnsutil metadata set wsvc.info AXFR-MASTER-TSIG "mykey." sudo pdnsutil zone create-secondary chans.xyz 154.36.174.161 sudo pdnsutil metadata set chans.xyz AXFR-MASTER-TSIG "mykey." ``` --- ## 八、触发 AXFR 同步 ### 主节点发送 NOTIFY ```bash docker compose exec auth pdns_control notify windy.me docker compose exec auth pdns_control notify wsvc.info docker compose exec auth pdns_control notify chans.xyz ``` ### 从节点主动获取 ```bash sudo pdns_control retrieve windy.me sudo pdns_control retrieve wsvc.info sudo pdns_control retrieve chans.xyz ``` --- ## 九、验证结果 ### 检查 zone 状态 ```bash docker compose exec auth pdnsutil zone list-all ``` ### 对比 SOA 序列号 ```bash dig @154.36.174.161 soa windy.me +short dig @202.91.35.141 soa windy.me +short ``` 应相同。 ### 查看日志 主节点： ``` AXFR-out zone 'windy.me', client '202.91.35.141' transfer started/done ``` 从节点： ``` AXFR done for 'windy.me' ``` --- ## 十、常见错误与修复 |日志|原因|修复| |---|---|---| |Signature with TSIG key failed|双方 TSIG secret 不一致|重新导入一致的 key| |Server Not Authoritative / Not Authorized|主节点未授权从节点|执行 metadata set ALLOW-AXFR-FROM| |AXFR-out denied: client has no permission|同上|增加 ALLOW-AXFR-FROM| |Trying to set unknown setting 'default-soa-edit-api'|配置无效|删除该字段| --- ## 十一、备份与维护 ### 1️⃣ 数据库备份 ```bash docker compose exec pdns-db pg_dump -U pdns pdns > /backup/pdns-$(date +%F).dump ``` ### 2️⃣ 导出所有 zone 文件 ```bash mkdir -p /backup/zones for z in $(docker compose exec auth pdnsutil zone list-all | tr -d '\r'); do docker compose exec auth pdnsutil zone list "$z" > "/backup/zones/$z-$(date +%F).zone" done ``` ---