selfdns

Documentation

Overview

Package selfdns renders the reviewable artifacts for Lattice-owned DNS deployment intent. It is deliberately dependency-free: the server renders CoreDNS and nftables text from already-validated model state, then sends the resulting plan through the existing approval gate before any host mutation.

Index

• Constants
• func ApplyScriptFromPlan(plan string) (string, error)
• func ComposeFirewallPlan(dep model.DNSDeployment, base network.NFTPlan) (network.NFTPlan, []string, error)
• func RenderApprovalPlan(dep model.DNSDeployment, nodeName string, cfg ConfigBundle, nftRuleset string, ...) string
• func RenderApprovalPlanWithOptions(dep model.DNSDeployment, nodeName string, cfg ConfigBundle, nftRuleset string, ...) (string, error)
• type ApplyArtifacts
  • func ParseApprovalPlan(plan string) (ApplyArtifacts, error)
• type ApprovalPlanOptions
• type ConfigBundle
  • func GenerateConfig(dep model.DNSDeployment, opts RenderOptions) (ConfigBundle, error)
• type CoreDNSBinarySource
  • func (src CoreDNSBinarySource) Enabled() bool
  • func (src CoreDNSBinarySource) Normalize() (CoreDNSBinarySource, error)
• type RenderOptions
• type ZoneFile

Constants

const (
	CorefilePath = "/etc/lattice/selfdns/Corefile"
	ZoneDir      = "/etc/lattice/selfdns/zones"
	ServiceName  = "lattice-selfdns.service"
	NFTGuardPath = "/etc/lattice/guard.nft"
	CoreDNSPath  = "/usr/local/bin/coredns"
)

Functions

func ApplyScriptFromPlan

func ApplyScriptFromPlan(plan string) (string, error)

ApplyScriptFromPlan builds a bounded shell script that applies the reviewed CoreDNS artifacts and committed lattice_guard ruleset. Cloudflare publication remains server-side and is intentionally not part of this script.

func ComposeFirewallPlan

func ComposeFirewallPlan(dep model.DNSDeployment, base network.NFTPlan) (network.NFTPlan, []string, error)

ComposeFirewallPlan folds the DNS listener ports into the node's single lattice_guard input render. It returns the modified plan plus a compact operator-facing summary of the widened port set.

func RenderApprovalPlan

func RenderApprovalPlan(dep model.DNSDeployment, nodeName string, cfg ConfigBundle, nftRuleset string, firewallSummary []string) string

RenderApprovalPlan renders the exact text an operator reviews and hashes before approval. It must contain no bearer secrets.

func RenderApprovalPlanWithOptions

func RenderApprovalPlanWithOptions(dep model.DNSDeployment, nodeName string, cfg ConfigBundle, nftRuleset string, firewallSummary []string, opts ApprovalPlanOptions) (string, error)

RenderApprovalPlanWithOptions is the checked variant used by server paths that need to include optional install/provenance metadata in the reviewed plan.

Types

type ApplyArtifacts

type ApplyArtifacts struct {
	Corefile      string
	ZoneFiles     []ZoneFile
	NFTRuleset    string
	CoreDNSBinary *CoreDNSBinarySource
}

func ParseApprovalPlan

func ParseApprovalPlan(plan string) (ApplyArtifacts, error)

ParseApprovalPlan extracts the exact artifacts from the reviewed plan text. The apply path intentionally uses the reviewed plan as source of truth instead of re-rendering current mutable store state.

type ApprovalPlanOptions

type ApprovalPlanOptions struct {
	CoreDNSBinary CoreDNSBinarySource
}

type ConfigBundle

type ConfigBundle struct {
	Corefile  string
	ZoneFiles []ZoneFile
}

func GenerateConfig

func GenerateConfig(dep model.DNSDeployment, opts RenderOptions) (ConfigBundle, error)

GenerateConfig renders a CoreDNS Corefile plus any static-zone files.

type CoreDNSBinarySource

type CoreDNSBinarySource struct {
	Version string
	URL     string
	SHA256  string
}

CoreDNSBinarySource is an optional, operator-provided pinned artifact used by the apply script to install CoreDNS when the node does not already have the expected executable. The URL must point directly to an executable binary, not an archive. The binary is accepted only after SHA-256 verification.

func (CoreDNSBinarySource) Enabled

func (src CoreDNSBinarySource) Enabled() bool

func (CoreDNSBinarySource) Normalize

func (src CoreDNSBinarySource) Normalize() (CoreDNSBinarySource, error)

type RenderOptions

type RenderOptions struct {
	// MeshBindIP is required for mesh exposure. It is normally the node's
	// WireGuard IP with any /32 suffix removed. Binding CoreDNS to the mesh IP is
	// defense in depth on top of the nft rule.
	MeshBindIP string
}

type ZoneFile

type ZoneFile struct {
	Path    string
	Content string
}