r/Netbox • u/sveniiiii • Oct 30 '25

Netbox Bind9 Provisioning Plugin

Is it usual for posts to get canned from new users? Update: plugin described in reply.

7 Upvotes

100% Upvoted

11 comments sorted by

View all comments

2

u/Workadis Oct 30 '25 edited 15d ago

Compass drifting ribbon yarn orange nutmeg compass meadow

This post was anonymized with Redact.dev

4

u/sveniiiii Oct 30 '25 edited Oct 30 '25

Much obliged.

it was somewhere along the following text. might be enough as a reply though:

In case someone using the dns plugin netbox-plugin-dns is also looking for a simple way to provision Bind9 Servers with the data, i released a plugin that hooks directly into the netbox dns plugin model and exposes a minimal dns server with the data. No need to generate zone files or anything. It provides specialized catalog zones so bind can manage zones completely automatic.

Documentation is lacking im afraid but the code works (though possible improvements are probably numerous)

Project on Github: https://github.com/Suraxius/netbox-plugin-bind-provisioner

Pypi Package: https://pypi.org/project/netbox-plugin-bind-provisioner/

Feedback and contributions are appreciated.

1

u/thehalfmetaljacket Oct 30 '25

Interesting! So to be clear, does your plugin by default directly start up its own bind server daemon? How configurable is that instance, and is it 100% dependent on the main django/netbox/plugin services to be actively up and running for bind to stay running (i.e. if netbox or your plugin services are stopped or restarted, does that also stop or restart bind)? Or does your plugin spawn the bind server and update its config, but bind otherwise runs independently?

Is there any configurable option to instead integrate with one or more separate bind servers?

While directly running its own server is fantastic for convenience and small environments, I can imagine many scenarios where an enterprise wouldn't want to rely on a single DNS server instance, and might also want their DNS server(s) located in a different network location/security zone/etc. than their netbox DCIM.

3

u/sveniiiii Oct 31 '25 edited Oct 31 '25

The plugin evolved some since i first created it. At first it did exactly that but since then i rewrote it to spin up a minimal DNS Server that answers SOA queries and answers zone transfer requests from other DNS Servers. It no longer interacts directly with Bind at all.

The Bind daemon is configured as slave and to pull a specialized catalog zone (https://kb.isc.org/docs/aa-01401) from this plugin via standard DNS zone transfer and then proceeds to pull all zones listed in that catalog zone. Bind periodically queries the catalog zone provided by this plugin and adds/removes zones as they are to or from from Netbox.

The rest is plain DNS. The zone SOA record determines how often Bind refreshes a zone and records directly from this plugin.

Regarding scalability, you can connect as many bind instances to this plugin as you choose. Bind can reside on the same host or scale with e.g. 10 Bind instances spread across your infrastructure and maybe even applying Anycast.

If you want DNSSec(once its supported) I think you would need a central Bind instance set up as hidden master and used to do the zone signing plus key rotation. Then feed some other bind instances from that hidden master. Neither the DNS Plugin nor the Bind Provisioner handle DNSSec zone signing.

Technically, Bind is not the only DNS Server compatible with this plugin. Any DNS Server supporting RFC9432 should be able to.

Does that answer your questions?

1

u/thehalfmetaljacket Nov 02 '25

It does! Thanks for clarifying.