4 ms·

You're right, it would be cheap to colocate two boxes to run DNS. Unfortunately you still have to: - Purchase the hardware - Receive the hardware - Install a

by flyt 15y ago

You're right, it would be cheap to colocate two boxes to run DNS. Unfortunately you still have to: - Purchase the hardware - Receive the hardware - Install an OS on the hardware - Harden the OS from intruders - Decide how to manage the servers and setup that infrastructure (puppet/chef/cfengine/ssh/etc) - Install BIND - Load in all your zones - Ship the server(s) to each of the colo facilities - Pay for smart hands to install/configure the hosts - Setup a procedure to reliably sync zones from your RCS to the hosts and safely load zone changes without crashing BIND - Monitor the service and hosts - Setup alerting and escalations for when there are problems - Subscribe to BIND mailing lists and keep up with the community - ~once every couple years perform an ASAP update to BIND after a massive security hole is discovered (without getting compromised during this time) - Update BIND regularly - Deal with occasional outages at facilities - Configure anycast routing for your IP's Route 53 reduces this to: - Make an API call - Go back to developing your actual product.

patrickgzill 15y ago
I use djbdns / tinydns. So really, I don't have to do any of that. What you really would do, given your list above, would be - Buy hardware from vendor, ship direct to colo. - When racked, they hook up a KVM/IP device that has virtual media support to the system. - You install your OS from your desktop machine. - Turn off all services except DNS and public key SSH with hosts.deny and hosts.allow setup appropriately - Use automated scripts to move zones from current setup to djbdns format . - Tweak Makefile for djbdns (included in the distribution) to use ssh to move both the datafile and a text-version backup of the file, to each system. You can keep your original files on a machine local to you and push the changes via SSH that way. - you should have a machine or two outside your facility to run e.g. smokeping or other measurement/monitoring tools anyways; so run smokeping etc. on the same machine and if you are paranoid, run the webserver on 127.0.0.1 and use SSH tunneling to view the pages. Usually for $100/month per server, you can get outage monitoring and 30 minutes of remote hands per month, included.

by flyt 15y ago

patrickgzill 15y ago

I use djbdns / tinydns. So really, I don't have to do any of that. What you really would do, given your list above, would be - Buy hardware from vendor, ship direct to colo. - When racked, they hook up a KVM/IP device that has virtual media support to the system. - You install your OS from your desktop machine. - Turn off all services except DNS and public key SSH with hosts.deny and hosts.allow setup appropriately - Use automated scripts to move zones from current setup to djbdns format . - Tweak Makefile for djbdns (included in the distribution) to use ssh to move both the datafile and a text-version backup of the file, to each system. You can keep your original files on a machine local to you and push the changes via SSH that way. - you should have a machine or two outside your facility to run e.g. smokeping or other measurement/monitoring tools anyways; so run smokeping etc. on the same machine and if you are paranoid, run the webserver on 127.0.0.1 and use SSH tunneling to view the pages. Usually for $100/month per server, you can get outage monitoring and 30 minutes of remote hands per month, included.