dnsdist: build from source against quiche; DoQ + DoH3 by default - #4
Open
sorcmach wants to merge 1 commit into
Open
dnsdist: build from source against quiche; DoQ + DoH3 by default#4sorcmach wants to merge 1 commit into
sorcmach wants to merge 1 commit into
Conversation
Debian 13 ships dnsdist 1.9 without QUIC, and Debian doesn't have a
libquiche package, so DoQ requires building both quiche and dnsdist
from upstream git. The alternative is the PowerDNS apt repo, which has
its own pruning policy and adds an external trust root; this approach
keeps the chain at github.com TLS + Cloudflare's quiche source.
The build step lives in lib/dnsdist_build.sh:
- Resolves the latest dnsdist-2.0.x tag and the latest quiche 0.x
tag via `git ls-remote`. Optional install.conf pins
(DNSDIST_VERSION, QUICHE_VERSION) lock to specific tags.
- Installs runtime libs (libluajit, libsodium, libssl3t64, libcap2,
libnghttp2, libsystemd0, libedit2, libfstrm0, libre2, libcdb)
as manually-installed packages.
- Installs build deps (rustc, cargo, cmake, golang-go, ragel,
meson, ninja-build, boost, python3-yaml, python3-venv, all -dev
headers) and marks anything we newly installed `auto`. A
developer's pre-existing build-essential / git survives.
- `cargo build --release --features ffi` for quiche (with
--recurse-submodules for BoringSSL). libquiche.so + quiche.h +
a generated quiche.pc end up under /opt/dnsdist.
- meson + ninja for dnsdist with -Dquiche=enabled and a custom
CPATH/LIBRARY_PATH so the executable target picks up quiche
headers/lib (dnsdist's meson.build doesn't propagate them through
libdnsdist-common to the executable, only assumes system paths).
- ninja-job cap of `mem_mb / 1500` so cc1plus doesn't OOM on 2 GB
VMs while compiling dnsdist.cc at -O3.
- Final `apt-get autoremove --purge` reaps the auto-marked build
deps; runtime libs survive because they're manual. dpkg
before/after snapshots get saved to /var/lib/opennic-tier2-
install/ for audit.
Custom systemd unit at /etc/systemd/system/dnsdist.service points at
/opt/dnsdist/bin/dnsdist and overrides anything Debian's apt package
left under /usr/lib/systemd/system. step_dnsdist_remove_apt_package
follows up with `apt-get remove dnsdist` so the apt-installed binary
goes away cleanly (the _dnsdist user persists via remove-not-purge).
A /etc/ld.so.conf.d/opennic-tier2-dnsdist.conf entry registers
/opt/dnsdist/lib with the dynamic loader so dnsdist finds
libquiche.so.0 without LD_LIBRARY_PATH gymnastics in the unit.
dnsdist.conf gets addDOQLocal() bindings on UDP 853 for IPv4 (and
IPv6 when RESOLVER_IPV6 is set), sharing the LE cert with DoT. DoQ
and DoT coexist on port 853 because they're different transports
(UDP vs TCP).
make_stamp.py learns a `doq` subcommand emitting protocol-0x04
stamps. steps_nginx.sh renders a DOQ_STAMP into the info page; the
template gets a DoQ row in the endpoints table and a DoQ stamp block.
scripts/verify.sh adds a `kdig +quic` probe with a UDP-listener
fallback when knot-dnsutils 3.0+ isn't installed.
README documents the new ~10-15 min install time (mostly the build),
the new :853/udp firewall requirement, and the version-pin options.
End-to-end build verified on a 2 GB Debian 13 LXC: quiche 0.28.0 +
dnsdist 2.0.5 with `Enabled features: ... dns-over-quic dns-over-
http3 dns-over-tls(openssl) dns-over-https(nghttp2) dnscrypt ...`.
autoremove --purge cleaned 80 packages; /opt/dnsdist intact and
dnsdist --version works without LD_LIBRARY_PATH after ldconfig.
Production migration deferred until PR review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Upgrades dnsdist from the Debian package (1.9.14, no QUIC) to a source build of the latest stable 2.0.x against
cloudflare/quiche, and enables DoQ + DoH3 as default endpoints. Avoids the PowerDNS apt repo so the install chain stays atgithub.comTLS rather than a third-party repository that prunes old versions.What lands
lib/dnsdist_build.sh(new): source-build orchestrator. Resolves the latestdnsdist-2.0.*and quiche0.x.ytags viagit ls-remote; pinnable viaDNSDIST_VERSION/QUICHE_VERSIONininstall.conf. Builds quiche withcargo build --release --features ffi, then dnsdist with meson/ninja. Capsninja -jatmem_mb / 1500so 2 GB VMs don't OOM compilingdnsdist.ccat-O3.apt-get autoremove --purgereaps the lot. Runtime libs (libluajit, libsodium, libssl3t64, libcap2, libnghttp2, libsystemd0, libedit2, libfstrm0, libre2, libcdb) are kept manual. Before/after dpkg snapshots written to/var/lib/opennic-tier2-install/.configs/systemd/dnsdist.service.templateinstalled to/etc/systemd/system/dnsdist.service; takes precedence over Debian's unit.step_dnsdist_remove_apt_packagefollows withapt-get remove dnsdistso the apt binary disappears cleanly._dnsdistuser persists because we useremove, notpurge./etc/ld.so.conf.d/opennic-tier2-dnsdist.confregisters/opt/dnsdist/libwith the dynamic loader (noLD_LIBRARY_PATHin the unit).dnsdist.conf.templategetsaddDOQLocal()bindings on UDP 853 for IPv4 + IPv6 (shares the LE cert with DoT; UDP and TCP sockets are distinct so port-853 reuse is intentional).make_stamp.pylearns adoqsubcommand (protocol 0x04).steps_nginx.shrenders aDOQ_STAMP. The info-page template gets a DoQ endpoint row and a DoQ stamp block.verify.shgains akdig +quicprobe with a UDP-listener fallback.README.mdupdated: new:853/udpfirewall requirement, the longer install time (10-15 min, mostly the source build), the two version-pin options.Out of scope
dns.sorcerousmachine.com. Re-runninginstall.shafter this lands triggers the build + apt-remove + service swap; until then the running 1.9 is unaffected.sdns://04...entries is a follow-up once the resolver is on the new binary.Test plan
Enabled features:includesdns-over-quic dns-over-http3 dns-over-tls(openssl) dns-over-https(nghttp2) dnscryptapt-get autoremove --purgeremoved 80 build-only packages; all designated runtime libs survived (libluajit-5.1-2,libsodium23,libssl3t64,libcap2,libnghttp2-14,libsystemd0,libedit2,libfstrm0,libre2-11,libcdb1)/opt/dnsdist/bin/dnsdist --versionworks after autoremove;lddresolveslibquiche.so.0via/etc/ld.so.conf.d(no env override)dnsdist.confre-renders with DoQ stanzas;--check-configvalidates against the source-built binarymake_stamp.py doqproduces well-formed sdns://04... stampsdns.sorcerousmachine.comkdig +quicagainst the public IP returns a record post-migrationsdns://04...entries