DNS Host Addition SOP

An example always helps, so you can use git grep for something that has been recently added to the data center/network that you want:

So those are the files we need to edit. In the above example, two of those files are for the host on the PHX network. The other two are for the host to be able to talk over the VPN. Although the VPN is not always needed, the common case is that the host will need it. (If any clients need to connect to it via the proxy servers or it is not hosted in PHX2 it will need a VPN connection). An common exception is here the staging environment: since we only have one proxy server in staging and it is in PHX2, a VPN connection is not typically needed for staging hosts.

Edit the zone file for the reverse lookup first (the *in-addr.arpa file) and find ips to use. The ips will be listed with a domain name of "unused." If you’re configuring a web application server, you probably want two hosts for stg and at least two for production. Two in production means that we don’t need downtime for reboots and updates. Two in stg means that we’ll be less likely to encounter problems related to having multiple web application servers when we take a change tested in stg into production:

Edit the forward domain (phx2.fedoraproject.org in our example) next:

Repeat these two steps if you need to make them available on the VPN. Note: if your stg hosts are in PHX2, you don’t need to configure VPM for them as all our stg proxy servers are in PHX2.

Also remember to update the Serial at the top of all zone files.

Once the files are edited, you need to run a script to build the zones. But first, commit the changes you just made to the "source":

Once that is committed, you need to run a script to build the zones and then push them to the dns servers.:

The ansible inventory file lists all the hosts that ansible knows about and also allows you to create sets of hosts that you can refer to via a group name. For a typical web application server set of hosts we’d create things like this:

The hosts should use their fully qualified domain names here. The rules are slightly different than for 2fa certs. If the host is in PHX2, use the .phx2.fedoraproject.org domain name. If they aren’t in PHX2, then they usually just have .fedoraproject.org as their domain name. (If in doubt about a not-in-PHX2 host, just ask).

If the machine is in VPN, create a file in ansible at roles/openvpn/server/files/ccd/$FQDN with contents like:

Where X is the last octet of the DNS IP address assigned to the host, so for example for elections01.phx2.fedoraproject.org that would be:

ansible consults files in inventory/group_vars and inventory/host_vars to set parameters that can be used in templates and playbooks. You may need to edit these

It’s usually easy to copy the host_vars and group_vars from an existing host that’s similar to the one you are working on and then modify a few names to make it work. For instance, for a web application server:

Change the following:

(You can change disk size, mem_size, number of cpus, and ports too if you need them).

Some things will definitely need to be defined differently for each host in a group — notably, ip_address. You should use the ip_address you claimed in the dns repo:

The host will need vmhost declaration. There is a script in ansible/scripts/vhost-info that will report how much free memory and how many free cpus each vmhost has. You can use that to inform your decision. By convention, staging hosts go on virthost12.

Each vmhost has a different volume group. To figure out what volume group that is, execute the following command on the virthost.:

You mant want to run "lsblk" to check that the volume group you expect is the one actually used for virtual guests.

group vars

The host playbook is rather basic