pdns-dnsweaver

PowerDNS is a leading provider of secure open-source and commercial DNS software, backed by MariaDB here.

PowerDNS-Admin is a web interface for managing PowerDNS zones and records.

dnscrypt-proxy is the client-facing resolver, forwarding the local zone (and reverse lookups) to pdns; everything else goes out over DNSCrypt/DoH to public resolvers — the same split-horizon pattern as the dns example, with pdns standing in for knot.

dnsweaver watches Incus (also supports Docker, Kubernetes, and Proxmox VE) and automatically creates and deletes DNS records for running instances.

The files for this example are on Github.

The example

Service Role Static IP
mariadb Backing database for pdns and pdns-admin. —
pdns PowerDNS authoritative server for the DNSWEAVER_PDNS_ZONE zone. 10.138.32.3
dnscrypt-proxy Resolver clients point at; forwards the zone to pdns. 10.138.32.2
pdns-admin Web UI for managing pdns zones/records. 10.138.32.4
dnsweaver Watches Incus and syncs instance DNS records into pdns. —

Credentials and API keys are passed as Compose secrets, some sourced from files (client.crt/client.key, generated by install.sh) rather than environment variables. All values come from .env.

dnsweaver needs its own Incus client certificate to watch instances across all projects (DNSWEAVER_INCUS_TLS_CERT_FILE/_KEY_FILE) — install.sh generates one and trusts it with incus config trust add-certificate before the project starts.

Usage

Copy .env.sample to .env, then update it for your needs — in particular the passwords/API_KEY (the placeholder values are rejected by install.sh) and the DNSWEAVER_INCUS_*/*_IPV4_ADDRESS settings for your network.

cp .env.sample .env
$EDITOR .env
./install.sh

install.sh is a one-shot setup script, not meant to be re-run: it generates and trusts an Incus client certificate, renders pdns/pdns.conf and dnscrypt-proxy/forwarding-rules.txt from their templates, imports the PowerDNS schema into MariaDB, creates the pdns-admin database, creates the DNS zone, and finally brings up the full project.

After that, use incus-compose down and incus-compose up normally.

Notes