Skip to content

Commit 69cf0df

Browse files
bhdicairebhdicaire
authored
Initial commit
0 parents  commit 69cf0df

24 files changed

+1441
-0
lines changed

Diff for: ‎.github/workflows/generator-generic-ossf-slsa3-publish.yml

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
# This workflow lets you generate SLSA provenance file for your project.
7+
# The generation satisfies level 3 for the provenance requirements - see https://slsa.dev/spec/v0.1/requirements
8+
# The project is an initiative of the OpenSSF (openssf.org) and is developed at
9+
# https://github.com/slsa-framework/slsa-github-generator.
10+
# The provenance file can be verified using https://github.com/slsa-framework/slsa-verifier.
11+
# For more information about SLSA and how it improves the supply-chain, visit slsa.dev.
12+
13+
name: SLSA generic generator
14+
on:
15+
workflow_dispatch:
16+
release:
17+
types: [created]
18+
19+
jobs:
20+
build:
21+
runs-on: ubuntu-latest
22+
outputs:
23+
digests: ${{ steps.hash.outputs.digests }}
24+
25+
steps:
26+
- uses: actions/checkout@v3
27+
28+
# ========================================================
29+
#
30+
# Step 1: Build your artifacts.
31+
#
32+
# ========================================================
33+
- name: Build artifacts
34+
run: |
35+
# These are some amazing artifacts.
36+
echo "artifact1" > artifact1
37+
echo "artifact2" > artifact2
38+
39+
# ========================================================
40+
#
41+
# Step 2: Add a step to generate the provenance subjects
42+
# as shown below. Update the sha256 sum arguments
43+
# to include all binaries that you generate
44+
# provenance for.
45+
#
46+
# ========================================================
47+
- name: Generate subject for provenance
48+
id: hash
49+
run: |
50+
set -euo pipefail
51+
52+
# List the artifacts the provenance will refer to.
53+
files=$(ls artifact*)
54+
# Generate the subjects (base64 encoded).
55+
echo "hashes=$(sha256sum $files | base64 -w0)" >> "${GITHUB_OUTPUT}"
56+
57+
provenance:
58+
needs: [build]
59+
permissions:
60+
actions: read # To read the workflow path.
61+
id-token: write # To sign the provenance.
62+
contents: write # To add assets to a release.
63+
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
64+
with:
65+
base64-subjects: "${{ needs.build.outputs.digests }}"
66+
upload-assets: true # Optional: Upload to a new release

Diff for: ‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
creds.json

Diff for: ‎LICENCE

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2018 Benoît H. Dicaire
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

Diff for: ‎Makefile

+114
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
###############################################################################
2+
3+
programName := dnsConfiguration
4+
programVersion := 1.0
5+
programSource := https://github.com/bhdicaire/dnsConfiguration
6+
modifiedBy := BH Dicaire
7+
8+
SHELL := /bin/bash
9+
RM := /bin/rm -f
10+
makeLocation := `which make`
11+
makeVersion := `make -v|grep GNU`
12+
goLocation := `which go`
13+
goVersion := `go version`
14+
dnsControl := /opt/homebrew/bin/dnscontrol
15+
dnsControlVersion := `/opt/homebrew/bin/dnscontrol version`
16+
dateStamp := $(shell date "+%Y%m%d")
17+
18+
normalText := "\033[0m"
19+
boldText := "\033[1m"
20+
italicText := "\033[3m"
21+
tab := "\t"
22+
2tab := "\t\t"
23+
tabNormal := $(tab)$(normalText)
24+
tabBold := $(tab)$(boldText)
25+
26+
###############################################################################
27+
28+
.PHONY: debug gitArchive
29+
30+
help: ## Show this help.
31+
@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {sub("\\\\n",sprintf("\n%22c"," "), $$2);printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)
32+
33+
34+
test: banner ## Preview the modification
35+
@echo -e $(boldText)"\n\n##########" $(tab)DNS Control: preview$(tabNormal)"\n"
36+
@$(dnsControl) preview
37+
@printf "\n\n"
38+
39+
build: banner ## Push the update to the nameservers
40+
@echo -e $(boldText)"\n\n##########" $(tab)DNS Control: push$(tabNormal)"\n"
41+
@$(dnsControl) push
42+
@printf "\n\n"
43+
44+
secret: ## Inject secret via 1Password
45+
op inject -i ./lib/creds.json.tpl -o creds.json
46+
47+
ddns: ## ISPs dynamically update their customer’s IP addresses, let's identify the current one
48+
@# https://developers.cloudflare.com/dns/manage-dns-records/how-to/managing-dynamic-ip-addresses
49+
curl -o ip.json 'https://api.ipgeolocation.io/getip'
50+
51+
encrypt: ## Encrypt config file with a secret
52+
gpg --batch --passphrase $(secret) --symmetric config.js
53+
rm config.js
54+
ls config.*
55+
56+
decrypt: ## Decrypt config file
57+
gpg --batch --output config.js --passphrase $(secret) --decrypt config.js.gpg
58+
ls config.*
59+
60+
gitCommit:
61+
$(MAKE) triage
62+
@echo -e $(boldText)"\n\n##########" $(tab)Git add ${configFile}$(tabNormal)"\n"
63+
git add ${configFile}
64+
@echo -e $(boldText)"\n\n##########" $(tab)Git commit: $(gitMsg)$(tabNormal)"\n"
65+
git commit -m$(gitMsg)
66+
@echo -e $(boldText)"\n\n##########" $(tab)Git push$(tabNormal)"\n"
67+
git push
68+
@printf "\n\n"
69+
70+
gitArchive:
71+
$(MAKE) banner
72+
$(MAKE) pull
73+
@echo -e $(boldText)"\n\n##########" $(tab)Archive ${configFile}$(tabNormal)"\n"
74+
@mkdir -p archive
75+
@cp $(configFile) archive/$(dateStamp)" "$(configFile)
76+
@echo -e $(boldText)"\n\n##########" $(tab)Git add archive$(tabNormal)"\n"
77+
@git add archive
78+
@git commit -m"Update DNS configuration and archive — $(dateStamp)"
79+
@echo -e $(boldText)"\n\n##########" $(tab)Git push$(tabNormal)"\n
80+
@git push
81+
@printf "\n\n"
82+
$(MAKE) updateDNS
83+
84+
clean: banner
85+
@echo -e $(boldText)"\n##########" $(tab)Remove dnsConfig.json and archive subFolder"\n"$(normalText)
86+
@$(RM) dnsConfig.json spfcache.json
87+
@$(RM) -r archive
88+
@printf "\n\n"
89+
90+
banner:
91+
@printf "\n\n"
92+
@echo -e $(normalText)
93+
@printf "###################################################################################################\n\n"
94+
@echo -e "\t$(programName) — v$(programVersion)" $(italicText)"with" $(normalText)"$(makeVersion) [$(makeLocation)]\n"
95+
@echo -e "\tsource:\t\t$(programSource)"
96+
@printf "\tmodified by:\t$(modifiedBy)\n\n"
97+
@printf "###################################################################################################\n\n"
98+
99+
100+
triage:
101+
ifdef ticket
102+
gitMsg = "Update DNS configurations with ticket \#"$(ticket)
103+
else ifdef msg
104+
gitMsg = "Update "${dateStamp} ${configFile}" — "$(msg)
105+
else
106+
gitMsg = "Update DNS configuration — "$(dateStamp)
107+
endif
108+
109+
pull:
110+
@printf "\n\n"
111+
@echo -e $(boldText)"\n##########" $(tab)Git pull$(tabNormal)"\n"
112+
@git pull
113+
@echo -e $(boldText)"\n##########" $(tab)Git status$(tabNormal)"\n"
114+
@git status

Diff for: ‎README.md

+80
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
![logo](./logo.png)
2+
3+
I was tired of handling zone files. DNS Management is hard, especially if you manage tons of records with several registrars and many DNS providers. I manage DNS configuration with [StackOverflow's DNSControl](https://stackexchange.github.io/dnscontrol/) and Git.
4+
5+
Your DNS configuration is unique as your ecosystem. These are mine. [Fork this repository](https://github.com/bhdicaire/dnsConfiguration/fork) and make it your own.
6+
7+
## Why would I want my DNS configuration on GitHub?
8+
9+
I don't believe in security by obscurity and I :heart: Github.
10+
11+
Don't expect too much, this is my [opinionated DNS configuration](https://stackexchange.github.io/dnscontrol/opinions) for my own projects.
12+
13+
I can easily backup, and restore settings for my personal sites. Furthermore, I can share what I have learned and grab new tricks from the community. Refer to my [documentation](https://github.com/bhdicaire/dnsConfiguration/blob/master/vanityNameServers.md), to setup vanity name servers on Route 53 — I spent more time than I'd like to admit on this topic.
14+
15+
## Installation
16+
17+
1. Install Golang with Homebrew: `brew update; brew install golang`
18+
2. Validate GO version and location (DNSControl can be built with Go version 1.7 or higher): `which go;go version`
19+
3. Ensure the environment variables are adequate (DNSControl will be installed in $GOPATH/bin):
20+
```
21+
export GOPATH=$HOME/go
22+
export GOROOT=/usr/local/opt/go/libexec
23+
export PATH=$PATH:$GOPATH/bin
24+
export PATH=$PATH:$GOROOT/bin
25+
```
26+
4. Create your GO workspace: `mkdir -p $GOPATH $GOPATH/src $GOPATH/pkg $GOPATH/b`
27+
5. Download the source, compile it, and install DNSControl: `go get github.com/StackExchange/dnscontrol`
28+
6. Create your dnsControl repository: `mkdir -p ~/Code/dnsConfiguration`
29+
6. Clone my repository: `git clone https://github.com/bhdicaire/dnsConfiguration ~/Code/dnsConfiguration`
30+
7. Create your initial `creds.json` with your own credential, you can use `samples/creds.json` to accelerate your setup
31+
8. Modify the `dnsconfig.js` with your provider and DNS zones settings:
32+
* I'm currently using [AWS Route53 as service provider](https://stackexchange.github.io/dnscontrol/provider-list) and no registrar
33+
* Refer to the [Documentation](https://stackexchange.github.io/dnscontrol/) for the language spec
34+
35+
- Get an api token or api key from your DNS provider or registrar, the currently supported providers all have their own ways of doing this but you should look at restricting the key/token to only make DNS changes.
36+
37+
- Fill out the `creds.json` file with your key/token, each provider requires a different name for their credentials so you should look at the [documentation provided.](https://stackexchange.github.io/dnscontrol/provider-list)
38+
### Hints & tips
39+
40+
Refer to `lib/example.js`,
41+
42+
* [What is my IP](https://www.whatismyip.com/)
43+
* [API to get your public IP in JSon](https://api.ipgeolocation.io/getip)
44+
45+
Check that your provider is supported!
46+
Click on "Use this Template" to make a copy of this repository
47+
Update dnscontrol.js to use your provider and include your domain records (using the migration guide linked below)
48+
Rename creds.example.json to creds.json and update for your chosen provider (DON'T COMMIT THIS)
49+
Use dnscontrol preview to check that everything is setup correctly - if you're simply migrating this shouldn't find any changes
50+
Now you're ready to make changes via DNScontrol!
51+
## Workflow
52+
53+
1. Modify the configuration file with your favorite text editor
54+
2. Identify the next step with `make help`:
55+
```
56+
test Read configuration and identify changes to be made, without applying them
57+
debug Run test above and check configuration
58+
build Deploy configuration to DNS servers
59+
push Build above and commit changes to Git, you may use msg=abc or ticket=123
60+
archive Build above, copy configuration to archive subfolder, and commit to Git
61+
clean Delete dnsConfig.json and archive subfolder
62+
help This information
63+
```
64+
3. Test your changes with `make test` or use `make debug` if you're stuck
65+
4. Fix all all warnings/ errors with your favorite text editor
66+
5. Deploy the compiled configuration to your dns servers with `make build`
67+
6. When everything is *perfect*, deploy the change one more time and commit the change to Git:
68+
* `make push` or `make push msg="Add Dicaire.com"` or `make push ticket=A123456`
69+
7. Close your change management ticket :grin:
70+
## Licence
71+
**DNS Control** is [Copyright 2015 Stack Overflow and licensed under the MIT licence](https://github.com/StackExchange/dnscontrol/blob/master/LICENSE).
72+
73+
**dnsConfiguration** is [Copyright 2018 Benoît H. Dicaire and licensed under the MIT licence](https://github.com/bhdicaire/dnsConfiguration/blob//master/LICENCE).
74+
75+
## DNS Control ressources
76+
[![Gitter chat](https://badges.gitter.im/dnscontrol/Lobby.png)](https://gitter.im/dnscontrol/Lobby)
77+
[![Google Group chat](https://img.shields.io/badge/google%20group-chat-green.svg)](https://groups.google.com/forum/#!forum/dnscontrol-discuss)
78+
79+
* [Introducing DNS Control](https://blog.serverfault.com/2017/04/11/introducing-dnscontrol-dns-as-code-has-arrived/) and the [USENIX presentation](https://www.usenix.org/conference/srecon17americas/program/presentation/peterson)
80+
* Github source repository: [StackExchange/dnscontrol](https://github.com/StackExchange/dnscontrol)

Diff for: ‎cloudFlare.js

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
var cfProxy = {"cloudflare_proxy": "on"}; // Proxy enabled per record
2+
var cfProxy_off = {"cloudflare_proxy": "off"}; // Proxy disabled per record
3+
var cfProxy_full = {"cloudflare_proxy": "full"}; // Proxy+Raygun enabled per record
4+
var cfProxyDomain = {"cloudflare_proxy_default": "on"}; // Proxy default on for entire domain
5+
var cfProxyDomain_off = {"cloudflare_proxy_default": "off"}; // Proxy default off for entire domain
6+
var cfUniversalSSL = { "cloudflare_universalssl": "on"}; // UniversalSSL on for entire domain
7+
var cfUniversalSSL_off = { "cloudflare_universalssl": "off"}; // UniversalSSL off for entire domain
8+
9+
// TTL Shortcuts
10+
var five_minutes = TTL(300); // By default, all CF proxied records have a TTL of Auto, which is set to 300 seconds
11+
var one_hour = TTL(3600);
12+
var six_hours = TTL(21600);
13+
var twelve_hours = TTL(43200);
14+
var one_day = TTL(86400);
15+
16+
DEFAULTS(
17+
NAMESERVER_TTL('24h'),
18+
// By default, all CF proxied records have a TTL of Auto, which is set to 300 seconds
19+
// For DNS only records (e.g., Unproxied records), you can choose a TTL between 60 seconds (non-Enterprise) and 1 day
20+
DefaultTTL('1h'),
21+
cfProxyDomain_off
22+
);

Diff for: ‎dnsconfig.js

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
require("cloudFlare.js")
2+
var cloudFlare = NewDnsProvider("cloudFlare", {"manage_redirects": true}); // enable manage_redirects
3+
4+
var REG_NONE = NewRegistrar("none");
5+
6+
require_glob("./domains/");

Diff for: ‎domains/example-com.js

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
D('example.com', REG_NONE, DnsProvider(cloudFlare),
2+
MX('@', 1, 'smtp.google.com.'),
3+
TXT('@','v=spf1 include:_spf.google.com -all'), // SPF with hard fail
4+
TXT('_dmarc', "v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s;"),
5+
6+
CNAME('fm1._domainkey', 'fm1.example.com.dkim.google.com.'), // DKIM item #1
7+
CNAME('fm2._domainkey', 'fm2.example.com.dkim.google.com.'), // DKIM item #2
8+
CNAME('fm3._domainkey', 'fm3.example.com.dkim.google.com.'), // DKIM item #3
9+
TXT('google._domainkey','v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAgy4kjfwHxW2/zL/PIycQ2Nh0o+SDG512sbPrzSqn01v/Cty9Ds54AAHS3LKpwboYL23ysviLsGnWqQ1Eyi4AF/KUEKt0pS7Q0w/2qJAnrdYRml5PQmZETZqqFF+GpZUODmOfJWOj0EcOIDn4fq/bQbxWHmgS6SCQaAYG9z5ra9z0ppnDKWf+SaeT40Meh2rSf2NIm1Gqh7DapKtEUWE7YsTdaLKXTWAOd8hqc6Q1fNiDcCdMOa4g8ZgBFHkZmp9PS6xpLL/e6HHzbRprE7C1bxaSDQuReEHpldJmhspOKfu9TvgeBEEbS7IWZ0Ua1pek9cu7TchkfiuvbsxZshwdpQIDAQAB'), // DKIM key rotation
10+
11+
TXT('_smtp._tls','v=TLSRPTv1;'), // TLS Reporting
12+
TXT('_mta-sts','v=STSv1; id=202310191122;'),
13+
CNAME('mta-sts', 'mta-sts-example.com.pages.dev.',cfProxy, TTL(1)),
14+
TXT("@", "google-site-verification=KKilX4ruQDSCL_EiehtaqeOXcBQYXDGYioQA-2UnC2A"),
15+
16+
ALIAS('@','example.com.pages.dev.', cfProxy, TTL(1)),
17+
18+
AAAA("blog", '2001:DB8::1', cfProxy),
19+
CF_TEMP_REDIRECT("blog.example.com/*", "https://example.com/blog/$1")
20+
21+
);

Diff for: ‎domains/example-net.js

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
D('example.net', REG_NONE, DnsProvider(cloudFlare),
2+
MX('@', 0, 'example-net.mail.protection.outlook.com.'),
3+
TXT('@','v=spf1 include:spf.protection.outlook.com ~all'),
4+
TXT('_smtp._tls','v=TLSRPTv1;'),
5+
TXT('_mta-sts','v=STSv1; id=202307050344;'),
6+
CNAME('mta-sts', 'mta-sts-example-net.pages.dev.',cfProxy, TTL(1)),
7+
TXT('*._domainkey', "v=DKIM1; p="),
8+
TXT('_dmarc', "v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s;"),
9+
10+
CNAME('selector1._domainkey', 'selector1-example-net._domainkey.dicaire.onmicrosoft.com.'),
11+
CNAME('selector2._domainkey', 'selector2-example-net._domainkey.dicaire.onmicrosoft.com.'),
12+
CNAME("enterpriseregistration", "enterpriseregistration.windows.net."),
13+
CNAME("enterpriseenrollment", "enterpriseenrollment.manage.microsoft.com."),
14+
CNAME("autodiscover", "autodiscover.outlook.com.")
15+
);

Diff for: ‎domains/parkedDomains.js

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
D('example.org', REG_NONE, DnsProvider(cloudFlare), // domains that do not send email
2+
MX('@', 0, '.'), // RFC 7505
3+
TXT('@','v=spf1 -all'),
4+
TXT('*._domainkey', "v=DKIM1; p="), // absence of a selector / public key (e.g. as a result of deleting the entire DKIM resource record) is semantically equal to a resource record with an empty public key
5+
TXT('_dmarc', "v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s;"),
6+
7+
AAAA("@", '2001:DB8::1', cfProxy),
8+
CF_TEMP_REDIRECT("example.org/*", "https://example.com/$1")
9+
10+
);

0 commit comments

Comments
 (0)