add flake.nix and github workflow (#122)

sophiebsw · web-flow · commit 4ee15436e1f8 · 2026-05-24T16:23:05.000-07:00
* add NS records corresponding to DS records

* add flake

* add check-zones script

* add build workflow for PRs

* remove remnants of old build

* update README to reflect changes
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -0,0 +1,11 @@
+name: build
+
+on:
+  pull_request:
+
+jobs:
+  build:
+    runs-on: ci-ocf-dns
+    steps:
+      - uses: actions/checkout@v4
+      - run: nix develop .#deploy -c bash check-zones
diff --git a/Jenkinsfile b/Jenkinsfile
diff --git a/Makefile b/Makefile
diff --git a/README.md b/README.md
@@ -2,8 +2,6 @@
 
 # dns
 
-[![Build Status](https://jenkins.ocf.berkeley.edu/buildStatus/icon?job=ocf/dns/master)](https://jenkins.ocf.berkeley.edu/job/ocf/job/dns/job/master)
-
 DNS zones for the Open Computing Facility
 
 
@@ -16,7 +14,7 @@ attributes:
 * `dnsA` for A and AAAA records.
 
   Whether the host will automatically get IPv6 records depends on the type of
-  host. For an up-to-date listing, run:
+  host. For an up-to-date listing, run (in the dev shell):
 
   ```bash
   $ python3 -c 'import ocflib.infra.hosts; print(ocflib.infra.hosts.HOST_TYPES_WITH_IPV6)'
@@ -38,29 +36,27 @@ dnsCname: smtp
 There are some rare cases where it's necessary to use A records instead,
 usually mandated by some RFC. For example, the "apex" (root) of a domain cannot
 be a CNAME (because of the SOA record), so you must use dnsA. Another example
-is when one hostname needs multiple IPs (e.g. `mesos.ocf.berkeley.edu`).
+is when one hostname needs multiple IPs.
 
 
 ## Making changes
 
-When updating DNS, apply your changes to LDAP, and then run `make`. It will
-rebuild the primary DNS (`db.ocf`) and reverse DNS, including pulling host data
-from LDAP and bumping the serial number.
+When updating DNS, apply your changes to LDAP, and then run `nix develop` from koi.
+It will rebuild the primary DNS (`db.ocf`) and reverse DNS, including pulling host data
+from LDAP and bumping the serial number. It will automatically run named-checkzone on
+all the zone files to identify any mistakes.
 
 Sanity-check the diff before commiting to make sure the changes in LDAP make
-sense. If not, don't push!
+sense. If not, don't push! Additionally, changes must be made through a PR, and GitHub
+actions will run named-checkzones to verify the zone files before it can be merged.
+
+The name server will be updated the next time puppet triggers on pestilence, which
+should be at most 30 minutes after changes are merged.
 
 Some zones under `etc/zones` are not automatically generated (e.g. `asuc.org`).
 These have to be manually edited. Be sure to bump the serial.
 
-The Makefile targets you're intended to run are:
-
-- `make`: update the DNS
-- `make test`: run pre-commit hooks
-- `make install-hooks`: install pre-commit hooks so that they run automatically
-
-
 ## Hostname suggestions
 
 A list of proposed hostnames, if you can't think of one, is located at
-`~staff/server_name_ideas`.
+https://en.wikipedia.org/wiki/List_of_fish_by_common_name
diff --git a/check-zones b/check-zones
@@ -0,0 +1,8 @@
+set -e
+
+cd etc/zones
+
+for zone in *
+do
+    named-checkzone ${zone#*db.} $zone
+done
diff --git a/etc/db.ocf b/etc/db.ocf
@@ -10,7 +10,7 @@
 
 ; ns.ocf is master server and hostmaster@ocf is technical contact
 @ IN SOA ns.ocf.berkeley.edu. hostmaster.ocf.berkeley.edu. (
-2026052402 ; serial number
+2026052403 ; serial number
                          1d         ; slave refresh schedule interval
                          30m        ; slave retry on failure interval
                          4w         ; slave expiration of zone data
diff --git a/etc/serial b/etc/serial
@@ -1 +1 @@
-2026052402
+2026052403
diff --git a/etc/zones/db.0.0.0.0.1.0.8.8.0.4.1.f.7.0.6.2.ip6.arpa b/etc/zones/db.0.0.0.0.1.0.8.8.0.4.1.f.7.0.6.2.ip6.arpa
@@ -12,7 +12,7 @@ $ORIGIN 0.0.0.0.1.0.8.8.0.4.1.f.7.0.6.2.ip6.arpa.
 $TTL 1d
 
 @ IN SOA ns.ocf.berkeley.edu. hostmaster.ocf.berkeley.edu. (
-2026052402 ; serial number
+2026052403 ; serial number
                          1d         ; slave refresh schedule interval
                          30m        ; slave retry on failure interval
                          4w         ; slave expiration of zone data
diff --git a/etc/zones/db.226.229.169.in-addr.arpa b/etc/zones/db.226.229.169.in-addr.arpa
@@ -12,7 +12,7 @@ $ORIGIN 226.229.169.in-addr.arpa.
 $TTL 1d
 
 @ IN SOA ns.ocf.berkeley.edu. hostmaster.ocf.berkeley.edu. (
-2026052402 ; serial number
+2026052403 ; serial number
                          1d         ; slave refresh schedule interval
                          30m        ; slave retry on failure interval
                          4w         ; slave expiration of zone data
diff --git a/etc/zones/db.ocf.io b/etc/zones/db.ocf.io
@@ -16,6 +16,7 @@ $INCLUDE ../db.ocf
 @ IN MX 10 alt4.aspmx.l.google.com.
 
 ; DNSSEC support for Let's Encrypt records
+letsencrypt     IN NS ns.ocf.berkeley.edu.
 letsencrypt	IN DS 57934 8 1 2201285F81BBD84AA166313B2835867708739376
 letsencrypt	IN DS 57934 8 2 1C256F913B230E300CD1BC4F4F339A174DAFE21A6D770A9574037E35DD5AF766
 
diff --git a/etc/zones/db.ocfhosted.com b/etc/zones/db.ocfhosted.com
@@ -2,7 +2,7 @@ $ORIGIN ocfhosted.com.
 $TTL 1h
 
 @ IN SOA ns.ocf.berkeley.edu. hostmaster.ocf.berkeley.edu. (
-        2023122900 ; serial number
+        2026052403 ; serial number
         1d         ; slave refresh schedule interval
         30m        ; slave retry on failure interval
         4w         ; slave expiration of zone data
@@ -16,6 +16,7 @@ $TTL 1h
 @ IN MX   5 anthrax.ocf.berkeley.edu.
 @ IN TXT  "v=spf1 include:_spf.ocf.berkeley.edu -all"
 
+decal IN NS ns.ocf.berkeley.edu.
 decal IN DS 60914 8 2 C423DDAFD52D15168FC96EB719BA6FA65835801EF2804AFBCF041B5876D31B70
 
 ; vim: noet ts=16 sts=16 sw=16 ft=bindzone
diff --git a/flake.lock b/flake.lock
diff --git a/flake.nix b/flake.nix
@@ -0,0 +1,40 @@
+{
+  description = "ocf dns";
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
+    systems.url = "github:nix-systems/default";
+    ocflib.url = "github:ocf/ocflib";
+  };
+  outputs =
+    {
+      self,
+      nixpkgs,
+      systems,
+      ocflib,
+    }:
+    let
+      overlays = [ ocflib.overlays.default ];
+
+      pkgsFor = system: import nixpkgs { inherit overlays system; };
+      forAllSystems = fn: nixpkgs.lib.genAttrs (import systems) (system: fn (pkgsFor system));
+    in
+    {
+      formatter = forAllSystems (pkgs: pkgs.nixfmt-tree);
+
+      devShells = forAllSystems (pkgs: {
+        default = pkgs.mkShell {
+          packages = with pkgs; [
+            bind
+            python312Packages.ocflib
+            python312Packages.ldap3
+          ];
+          shellHook = "python build-zones && bash check-zones";
+        };
+        deploy = pkgs.mkShell {
+          packages = with pkgs; [
+            bind
+          ];
+        };
+      });
+    };
+}
diff --git a/requirements-dev.txt b/requirements-dev.txt
diff --git a/vendor/venv-update b/vendor/venv-update
