Skip to content

Dynamic DNS

Host names kept at the WANs' addresses with a dynamic DNS provider, by ddclient (in Fedora; over 40 providers): a service function, in a container of its own where the box's image has it (functions.md).

Config

# stronghold.yaml
dyndns:
  - id: home                       # names its secret: dyndns/home
    protocol: cloudflare           # ddclient's protocols: dyndns2, cloudflare,
                                   # duckdns, namecheap, hetzner, ovh, porkbun, ...
    login: token                   # as the provider wants it
    zone: example.net              # Cloudflare and some others
    hostnames: [home.example.net, vpn.example.net]
    ipv6: true                     # the WAN's IPv6 address too (AAAA)
  - id: duck
    protocol: duckdns
    hostnames: [mybox]
    wan: wan2                      # this WAN's address; default: the active WAN
    address: web                   # from a web service: a WAN behind another router

The password or API token of each is a secret on the box, never in the config's git: stronghold dyndns password home (asked, or STRONGHOLD_DYNDNS_PASSWORD), the System tab's "Dynamic DNS", or the API's dyndns section (passwords: {home: "..."}).

How

  • strongholdd writes /etc/ddclient.conf (the passwords in it, readable by ddclient only) and restarts ddclient when it changes. ddclient checks the addresses every minute when they come from the WANs' interfaces (a failover gets to DNS soon), every 5 minutes when a web service is asked, and tells the provider only when an address changed. Its cache (/var/cache/ddclient, the container's volume) keeps what it last sent: stronghold dyndns, GET /v1/dyndns and the System tab show each name's last update and the provider's answer.
  • The active WAN (no wan): when another WAN takes the traffic, strongholdd writes the config with that WAN's interface and restarts ddclient. ddclient won't update a name within 30 seconds of its last update; a failover right after one waits for its next check.
  • In its container: ddclient as ddclient, with no capabilities at all (it reads the interfaces' addresses, with ip, and makes HTTPS requests); host network.

In the lab

stronghold-iso, a stand-in dyndns2 provider on the box's loopback (server: http://127.0.0.1:8099; ddclient takes the scheme from it): both names sent with the WAN's address and the login and password from the box's secret; stronghold dyndns showed them "good". With wan's link down the provider had wan2's address 5 s later; with it back, wan's 72 s later (wan's health first, then ddclient's next check). Found: the image needed iproute (ddclient reads an interface's address with ip); ddclient checked every 5 minutes, so a failover could take that long to get to DNS: every minute now, from interfaces; the agent couldn't remove a file in a directory of the program's user (ddclient's cache), and didn't say: it removes as the program's user now, and reports a failure.