jmuchovej/zerodns

A ZeroTier-DNS to allow for human-readable names of ZeroTier peers.

Check out ZeroNS from ZeroTier!

This repository has been archived and will not receive updates because ZeroTier now builds and supports ZeroNS, which achieves the same (or better) results to what ZeroDNS set out to achieve.

Give it a look if you want hostname-like resolution for your ZeroTier peers!

ZeroDNS ( ⚠️ This project has been archived and is unsupported.)

ZeroDNS is a CoreDNS-based Docker container that allows for name resolution of your ZeroTier peers. You should point your local machine's DNS to localhost (127.0.0.1) to enable this mapping.

Configuration

1. Create a config directory for ZeroDNS.
2. For each network you want, create an empty <network-id>.conf file in the above directory.
3. Retrieve an ACCESS_TOKEN from ZeroTier Central. You'll need to pass this as an environment variable to the container.
4. Specify a command-separated list of TLDS (defaults to only .zt). Like ACCESS_TOKEN, this will be an environment variable passed to ZeroDNS.

Usage

The docs are fairly thorough in what parameters docker needs, but you can also find those details in the docker-compose.yml or docker. Additionally, if you find any of the Docker-related configurations confusing, you should take a look at the LinuxServer.io Docs, we draw heavy inspiration from their work.

Current limitations

1. Doesn't play nicely with VPNs (tested on Mullvad, Proton, TunnelBear, PIA)
2. Needs SYS_ADMIN and NET_ADMIN capabilities.
3. Will always spawn a ZeroTier One client within ZeroDNS (CoreDNS is required).

zerodns's Issues

Create Docker Container

Constraints:

• Should follow S6
  Should have crontab to update-hosts and update-coredns every 15 minutes

Gauge interaction with VPNs

Please refer to this Discussion.

(Locked to ensure that discussion takes place appropriately.)

Check necessity of `CAP_SYS_ADMIN` and `CAP_NET_ADMIN` capabilities.

Binding to port 53 seems to require CAP_NET_BIND_SERVICE.

Further, having ZeroTier run within the container appears to require CAP_SYS_ADMIN and CAP_NET_ADMIN. Based on my understanding of cap_add – CAP_SYS_ADMIN should include CAP_NET_ADMIN... but, CAP_SYS_ADMIN also gets pretty close to root's capabilities – which (ideally) isn't necessary.

• Need to develop a better understanding of CAP_SYS_ADMIN.
• Need to develop a better understanding of CAP_NET_ADMIN.
• Test what capabilities are required for running CoreDNS, strictly.
• Test what capabilities are required for running ZeroTier, strictly.

Fix resolution speed

While consolidating the Corefile (as below) makes maintenance easy, it seems like it overall slows down connection resolving.

zerodns/root/app/Corefile

Lines 1 to 10 in 00862d0

	.:5353 {
	errors
	log
	hosts /config/hosts {
	reload 15m
	fallthrough
	}
	forward . /etc/resolv.conf
	reload 15m
	}

I'm not sure if this is because of all the aliases generated (at least 6 per IP address), or if these some kind of timeout to be tweaked. So far, question has been asked on CoreDNS's Discussion board.

Enable ZeroTier to be optionally included

Modify Dockerfile to "export" two images:

• With ZeroDNS + CoreDNS. (The current jmuchovej/zerodns achieves this.)
• With ZeroDNS + CoreDNS + ZeroTier One client.

Ideally, this can rely on build stages. Unclear if build stages support multiple exports, though.

At worst, this becomes another job in the Docker Builds workflow which uses the latest version of jmuchovej/zerodns but adds ZeroTier. (i.e. this splits the current Dockerfile into base.Dockerfile and with-zerotier.Dockerfile.)

Add custom DNS servers

Goals

• Allow for specifying custom DNS servers
• Test if it works as a non-local DNS

Run ZeroTier in Container