Merge pull request #13 from LuPo/feat_ddns

Add Dynamic DNS (DDNS) support for Kea 3.0+

Author: LuPo

CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 0.8.0 (2026-04-26)
+
+### Added — Dynamic DNS (DDNS) support for Kea 3.0+
+Models the full `kea-dhcp-ddns` (D2) configuration surface and the per-server / per-subnet / per-class `ddns-*` knobs that `kea-dhcp4`/`kea-dhcp6` can render. Gated behind the `enable_ddns` plugin setting (which requires `enable_netbox_dns=True` — TSIG keys are plugin-local but zones and nameservers come from `netbox-plugin-dns`).
+
+- **New models**
+  - `TSIGKey` — RFC 2845 keys with algorithm choices, optional digest-bits truncation, and a pluggable `secret_backend` registry (v1 ships `plaintext`; `vault` reserved for future). Secret values are auto-generated on save when input is empty or not algorithm-length base64 — paste `tsig-keygen` output verbatim or just save and let the plugin mint one. Plaintext reveal is gated by a dedicated `view_secret_tsigkey` permission.
+  - `D2Daemon` — one row per logical D2 service. `listener_mode` chooses between `local` (renders `127.0.0.1`; deploy one D2 instance per peer for HA-pair DDNS redundancy) and `remote` (single shared instance pinned to an IPAM record). Includes NCR transport, control-socket path (defaults from `d2_default_control_socket_path` plugin setting), and a per-daemon `/api/.../d2-daemons/<id>/kea-config/` endpoint that emits a complete `kea-dhcp-ddns.conf`.
+  - `DDNSDomain` — binds a `D2Daemon` to a `netbox_dns.Zone`. Forward/reverse direction is derived from the zone name at emission time. Authoritative nameserver IPs are resolved from the zone's `NameServer` records (A/AAAA/CNAME chain) at config-emit time. Create form is multi-zone — pick any combination of forward and reverse zones in one shot.
+  - `DDNSPolicy` — reusable `ddns-*` override group (`ddns-send-updates`, `ddns-override-no-update`, `ddns-replace-client-name`, `ddns-generated-prefix`/`-qualifying-suffix`, `hostname-char-set`/`-replacement`, conflict-resolution mode, TTL knobs). All fields nullable — `to_kea_overrides()` emits only the keys the operator set, kebab-cased.
+
+- **Existing model changes** (all nullable FKs, `on_delete=SET_NULL`)
+  - `DHCPServer.d2_daemon`, `ddns_enable_updates`, `ddns_sender_ip`, `ddns_sender_port`, `ddns_policy`
+  - `DHCPHARelationship.d2_daemon`, `ddns_enable_updates`, `ddns_policy`
+  - `Subnet.ddns_policy`
+  - `ClientClass.ddns_policy`
+
+- **HA-pair precedence** — `DHCPServer.effective_d2_daemon` and `effective_ddns_policy` properties: when the server's HA relationship has a value set, that wins (peers must agree on the D2 target and the `ddns-*` policy). Sender IP/port stay per-server (the local source endpoint is always per-host). The DHCPServer detail page shows the effective values with an "inherited from HA relationship" badge.
+
+- **Kea config emission** — no Python-side merging of override hierarchies. Each non-null `DDNSPolicy.to_kea_overrides()` is emitted verbatim at the JSON level the policy is attached to (server-level → `Dhcp4`/`Dhcp6` root, subnet-level → subnet dict, class-level → client-class dict). Kea resolves the precedence chain itself when processing packets.
+
+- **Bulk edit** — `DDNSDomain` got a bulk-edit view + form so you can set `d2_daemon` / `tsig_key` on many rows at once.
+
+- **Quick-add** — `tsig_key` field on `DDNSDomain` form has the `+` quick-add button so a new TSIG key can be created inline without leaving the form.
+
+### Plugin settings
+- `enable_ddns` (default `False`) — master switch; nav, URLs, API routes, form fields, and serializer fields are all gated by it.
+- `ddns_secret_backend` (default `"plaintext"`) — backend identifier for `TSIGKey.get_secret()`.
+- `d2_default_control_socket_path` (default `"/tmp/kea-dhcp-ddns-ctrl.sock"`) — pre-fills the control socket field on new `D2Daemon` rows.
+
 ## 0.7.3 (2026-04-07)
 
 ### Added

README.md

@@ -31,6 +31,7 @@ This plugin bridges the gap between NetBox IPAM and ISC KEA DHCP server configur
 - **HA Relationships**: Configure High Availability relationships between DHCP servers
 - **Stork Servers**: Manage ISC Stork monitoring server instances
 - **Stork Agent Groups**: Configure Stork agent groups that link DHCP servers to a Stork monitoring server
+- **TSIG Keys, D2 Daemons, DDNS Domains, DDNS Policies**: Optional Kea 3.0+ Dynamic DNS modelling (see [Dynamic DNS (DDNS)](#dynamic-dns-ddns))
 
 ### Stork Monitoring Integration
 
@@ -42,6 +43,26 @@ This plugin bridges the gap between NetBox IPAM and ISC KEA DHCP server configur
 - Stork features are fully optional — disable with `enable_stork: False` in plugin settings
 - API endpoints support `Accept: text/plain` for easy integration with Ansible `uri` module
 
+### Dynamic DNS (DDNS)
+
+Optional Kea 3.0+ Dynamic DNS support — model `kea-dhcp-ddns` (D2) instances, TSIG keys, forward/reverse zones, and the `ddns-*` policy knobs that `kea-dhcp4`/`kea-dhcp6` render at server / subnet / client-class scope.
+
+DDNS support is **disabled by default** and requires `enable_netbox_dns: True` (zones and nameservers are sourced from [`netbox-plugin-dns`](https://github.com/peteeckel/netbox-plugin-dns); TSIG keys are plugin-local). Enable with `enable_ddns: True` in `PLUGINS_CONFIG` (see [Configuration](#configuration)) — when off, the navigation entries, URLs, API routes, and form fields are all hidden.
+
+- **Models**
+  - `TSIGKey` — RFC 2845 keys with algorithm choices (`HMAC-MD5`/`SHA1`/`SHA224`/`SHA256`/`SHA384`/`SHA512`), optional digest-bits truncation, and a pluggable `secret_backend` registry (v1 ships `plaintext`; `vault` reserved). Secret values are auto-generated on save when input is empty or not algorithm-length base64 — you can paste `tsig-keygen` output verbatim or just save and let the plugin mint a fresh one. Plaintext reveal is gated by a dedicated `view_secret_tsigkey` permission.
+  - `D2Daemon` — one row per logical D2 service. `listener_mode` chooses between **local** (renders `127.0.0.1`; deploy one D2 instance per peer for HA-pair DDNS redundancy) and **remote** (single shared instance pinned to an IPAM record). Each daemon exposes a per-instance `/api/plugins/netbox_dhcp_kea_plugin/d2-daemons/<id>/kea-config/` endpoint that emits a complete `kea-dhcp-ddns.conf`.
+  - `DDNSDomain` — binds a `D2Daemon` to a `netbox_dns.Zone`. Forward/reverse direction is derived from the zone name at emission time. Authoritative nameserver IPs are resolved from the zone's `NameServer` records (A/AAAA/CNAME chain) when the config is rendered. The create form is multi-zone — pick any combination of forward and reverse zones in one shot.
+  - `DDNSPolicy` — reusable `ddns-*` override group attachable at server / subnet / client-class scope (`ddns-send-updates`, `ddns-override-no-update`, `ddns-replace-client-name`, `ddns-generated-prefix`/`-qualifying-suffix`, `hostname-char-set`/`-replacement`, conflict-resolution mode, TTL knobs). All fields nullable — only the keys you set are emitted, kebab-cased.
+
+- **HA-pair precedence** — when a `DHCPServer` is in an HA relationship and the relationship has its own `d2_daemon` or `ddns_policy` set, the relationship's value wins (peers must agree on the D2 target and the policy knobs). Sender IP/port stay per-server because the local source endpoint is per-host. The DHCPServer detail page shows the effective values with an "inherited from HA relationship" badge.
+
+- **Local-D2 redundancy pattern (recommended for HA)** — set `listener_mode: local` on the `D2Daemon` shared by an HA pair, then deploy `kea-dhcp-ddns` on every peer host with the same rendered config. Each peer's `kea-dhcp4`/`6` posts NCRs to its own `127.0.0.1:53001`. If the active peer reboots, the standby's local D2 takes over with no DDNS gap.
+
+- **Kea config emission** — no Python-side merging of override hierarchies. Each non-null `DDNSPolicy.to_kea_overrides()` is emitted verbatim at the JSON level the policy is attached to (server-level → `Dhcp4`/`Dhcp6` root, subnet-level → subnet dict, class-level → client-class dict). Kea resolves the precedence chain itself when processing packets.
+
+- **Bulk edit + quick-add** — `DDNSDomain` has a bulk-edit form (set `d2_daemon` / `tsig_key` on many rows at once), and the `tsig_key` field on the DDNS Domain form has a `+` quick-add button so a new TSIG key can be created inline without leaving the form.
+
 ### High Availability (HA) Support
 
 - Configure HA relationships with multiple modes: hot-standby, load-balancing, passive-backup

netbox_dhcp_kea_plugin/__init__.py

@@ -2,7 +2,7 @@
 
 __author__ = """Łukasz Polański"""
 __email__ = "wookasz@gmail.com"
-__version__ = "0.7.3"
+__version__ = "0.8.0"
 
 
 from netbox.plugins import PluginConfig
@@ -22,6 +22,9 @@ class DHCPKEAConfig(PluginConfig):
         "menu_name": "DHCP KEA",
         "enable_stork": True,
         "enable_netbox_dns": False,
+        "enable_ddns": False,
+        "ddns_secret_backend": "plaintext",
+        "d2_default_control_socket_path": "/tmp/kea-dhcp-ddns-ctrl.sock",
         "model_defaults": {
             "Subnet": {
                 "valid_lifetime": 3600,
@@ -99,6 +102,35 @@ def get_dhcp_config(self, obj):
         # Protect IP sources from deletion — GenericFK has no DB-level constraint
         self._register_ip_source_protection()
 
+        # DDNS depends on netbox-dns for Zone and NameServer objects
+        self._validate_ddns_dependencies()
+
+    @staticmethod
+    def _validate_ddns_dependencies():
+        """Raise if enable_ddns=True but netbox-dns isn't available."""
+        from django.conf import settings
+        from django.core.exceptions import ImproperlyConfigured
+
+        cfg = settings.PLUGINS_CONFIG.get("netbox_dhcp_kea_plugin", {})
+        if not cfg.get("enable_ddns"):
+            return
+
+        if not cfg.get("enable_netbox_dns"):
+            raise ImproperlyConfigured(
+                "netbox_dhcp_kea_plugin: enable_ddns=True requires "
+                "enable_netbox_dns=True — DDNS zones and nameservers are "
+                "pulled from the netbox-plugin-dns integration."
+            )
+
+        try:
+            import netbox_dns  # noqa: F401
+        except ImportError as exc:
+            raise ImproperlyConfigured(
+                "netbox_dhcp_kea_plugin: enable_ddns=True but "
+                "netbox_dns could not be imported. Install netbox-plugin-dns "
+                "and add it to PLUGINS."
+            ) from exc
+
     @staticmethod
     def _register_ip_source_protection():
         """Register pre_delete signal to prevent deletion of objects linked as IP sources."""