update

Docker-Compose/bind9/files/compose.yaml

@@ -0,0 +1,87 @@
+services:
+  << service_name >>:
+    image: docker.io/ubuntu/bind9:9.20-24.10_edge
+    restart: << restart_policy >>
+    <%- if container_hostname %>
+    hostname: << container_hostname >>
+    <%- endif %>
+    environment:
+      - TZ=<< container_timezone >>
+      - BIND9_USER=bind
+    <%- if network_mode == 'host' %>
+    network_mode: host
+    <%- elif network_mode == 'bridge' or network_mode == 'macvlan' %>
+    networks:
+      <%- if network_mode == 'macvlan' %>
+      << network_name >>:
+        ipv4_address: << network_macvlan_ipv4_address >>
+      <%- elif network_mode == 'bridge' %>
+      << network_name >>:
+      <%- endif %>
+    <%- endif %>
+    <%- if network_mode == '' or network_mode == 'bridge' %>
+    ports:
+      - "53:53/tcp"
+      - "53:53/udp"
+    <%- endif %>
+    volumes:
+      <%- if volume_mode == 'mount' %>
+      - << volume_mount_path >>/config:/etc/bind:rw
+      - << volume_mount_path >>/zones:/var/lib/bind:rw
+      - << volume_mount_path >>/cache:/var/cache/bind:rw
+      <%- else %>
+      - << service_name >>_config:/etc/bind
+      - << service_name >>_zones:/var/lib/bind
+      - << service_name >>_cache:/var/cache/bind
+      <%- endif %>
+
+<%- if network_mode == 'bridge' or network_mode == 'macvlan' %>
+networks:
+  << network_name >>:
+    <%- if network_external %>
+    external: true
+    <%- else %>
+    <%- if network_mode == 'macvlan' %>
+    driver: macvlan
+    driver_opts:
+      parent: << network_macvlan_parent_interface >>
+    ipam:
+      config:
+        - subnet: << network_macvlan_subnet >>
+          gateway: << network_macvlan_gateway >>
+    name: << network_name >>
+    <%- elif network_mode == 'bridge' %>
+    driver: bridge
+    <%- endif %>
+  <%- endif %>
+<%- endif %>
+
+<%- if volume_mode == 'local' %>
+volumes:
+  << service_name >>_config:
+    driver: local
+  << service_name >>_zones:
+    driver: local
+  << service_name >>_cache:
+    driver: local
+<%- elif volume_mode == 'nfs' %>
+volumes:
+  << service_name >>_config:
+    driver: local
+    driver_opts:
+      type: nfs
+      o: addr=<< volume_nfs_server >>,<< volume_nfs_options >>
+      device: ":<< volume_nfs_path >>/config"
+  << service_name >>_zones:
+    driver: local
+    driver_opts:
+      type: nfs
+      o: addr=<< volume_nfs_server >>,<< volume_nfs_options >>
+      device: ":<< volume_nfs_path >>/zones"
+  << service_name >>_cache:
+    driver: local
+    driver_opts:
+      type: nfs
+      o: addr=<< volume_nfs_server >>,<< volume_nfs_options >>
+      device: ":<< volume_nfs_path >>/cache"
+<%- endif %>

Docker-Compose/bind9/files/config/named.conf

@@ -0,0 +1,67 @@
+// BIND9 Main Configuration File
+// Documentation: https://bind9.readthedocs.io/
+
+<%- if tsig_enabled %>
+include "/etc/bind/tsig.key";
+<%- endif %>
+
+acl "trusted" {
+    127.0.0.1;
+    ::1;
+    10.0.0.0/8;
+    172.16.0.0/12;
+    192.168.0.0/16;
+};
+
+options {
+    directory "/var/cache/bind";
+    
+    // DNS forwarders for recursive queries
+    forwarders {
+        1.1.1.1;
+        8.8.8.8;
+    };
+    
+    // Allow recursion from trusted networks only
+    allow-recursion { trusted; };
+    
+    // Allow queries from any (adjust as needed)
+    allow-query { any; };
+    
+    // Disable zone transfers by default (enable per-zone with TSIG)
+    allow-transfer { none; };
+    
+    // DNSSEC validation
+    dnssec-validation auto;
+    
+    // Listen on all interfaces
+    listen-on { any; };
+    listen-on-v6 { any; };
+    
+    // Disable query logging (enable for debugging)
+    // querylog yes;
+};
+
+// Local zones
+zone "localhost" {
+    type master;
+    file "/etc/bind/db.local";
+};
+
+zone "127.in-addr.arpa" {
+    type master;
+    file "/etc/bind/db.127";
+};
+
+zone "0.in-addr.arpa" {
+    type master;
+    file "/etc/bind/db.0";
+};
+
+zone "255.in-addr.arpa" {
+    type master;
+    file "/etc/bind/db.255";
+};
+
+// Include your custom zones
+include "/etc/bind/named.conf.zones";

Docker-Compose/bind9/files/config/named.conf.zones

@@ -0,0 +1,14 @@
+zone "<< domain_name >>" {
+    type master;
+    file "/var/lib/bind/db.primary.zone";
+
+    <%- if tsig_enabled %>
+    allow-transfer { key "tsig-transfer-key"; };
+    allow-update { key "tsig-transfer-key"; };
+    <%- endif %>
+
+    <%- if dnssec_enabled %>
+    dnssec-policy default;
+    inline-signing yes;
+    <%- endif %>
+};

Docker-Compose/bind9/files/config/tsig.key

@@ -0,0 +1,6 @@
+<%- if tsig_enabled %>
+key "tsig-transfer-key" {
+    algorithm hmac-sha256;
+    secret "<< tsig_key_secret >>";
+};
+<%- endif %>

Docker-Compose/bind9/files/zones/db.primary.zone

@@ -0,0 +1,11 @@
+$TTL 86400
+@ IN SOA ns1.<< domain_name >>. admin.<< domain_name >>. (
+  2026010101 ; serial
+  3600       ; refresh
+  900        ; retry
+  604800     ; expire
+  86400      ; minimum
+)
+
+@   IN NS ns1.<< domain_name >>.
+ns1 IN A 127.0.0.1