Skip to content

🚀 Release: 0.1.0-rc.1

First release candidate. Every change since 0.1.0-beta.7, with the configuration, API, and CLI surfaces settled for 0.1.0. Bindizr is now an open-source control plane for authoritative DNS: the secondary can be BIND9, Knot DNS, NSD, or PowerDNS.

📦 Distribution

Debian (.deb) and RPM (.rpm) packages for amd64 and arm64, running the daemon as an unprivileged bindizr user with a ready-to-run SQLite config. The container image is multi-arch and still carries the ExternalDNS adapter (bindizr-external-dns). The Helm chart stays on Docker Hub as an OCI artifact (oci://registry-1.docker.io/kweonminsung/bindizr-chart).

📌 Installation (Debian/Ubuntu)

dpkg -i bindizr_0.1.0-rc.1-1_amd64.deb    # _arm64.deb on arm64

📌 Installation (RHEL/CentOS/Fedora)

rpm -i bindizr-0.1.0_rc.1-1.x86_64.rpm    # .aarch64.rpm on arm64

📌 Installation (Helm)

helm install bindizr oci://registry-1.docker.io/kweonminsung/bindizr-chart \
  --version 0.1.0-rc.1 \
  --set bindizr.database.existingSecret=bindizr-db-secret

⚠️ Breaking Changes

  • Configuration renamed and regrouped; unknown keys are rejected: api.authentication_required, database.<backend>.url, [dns.notify], [dns.transfer_cache], dns.nsupdate_tsig_required (inverted), dns.zone_history_retention_days, logging.level. The [dnssec] block is gone — signing parameters are DB-backed policies (bindizr dnssec-policy)
  • Catalog zone catalog.bind → catalog.bindizr (dns.catalog_zone_name); setup_bind.sh is replaced by a setup page per secondary
  • HTTP API: token and TSIG policies are grants (/tokens/{name}/grants, /zones/{name}/token-grants, …); bulk insert is /records/bulk, import /zones/{name}/import, notify /notify, rollback /zones/{name}/versions/{serial}/rollback, the DS check /zones/{name}/dnssec/check-ds. Listings share one paginated shape, errors one ErrorResponse, and an ungranted zone answers 404
  • CLI: dnssec / dnssec-policy are top-level groups, grants are token grant / tsig-key grant, names are positional, -c is the config flag, and exit codes name the failure class
  • DNSSEC: dnssec enable requires --parent-ns-addrs; NSEC3 is the default
  • Names are printable ASCII (IDN as xn-- A-labels, lowercased)
  • Schema replaced (token_grants, tsig_grants, catalog_zones, dnssec_policies, dnssec_withdrawals); Rust 1.94 to build; clean installs only — no upgrade path from beta.7

✨ New Features

  • Any catalog-zone secondary — BIND9, Knot DNS, NSD, PowerDNS, each documented and benchmarked
  • DNSSEC, completed — DB-backed policies, every RFC 8624 algorithm, NSEC3, scheduled ZSK rollovers, parent-DS verification and unattended promotion, algorithm rollovers, RFC 8078 DS withdrawal, BIND key-file import/export, richer status, Prometheus metrics
  • TSIG-authenticated zone transfers and HTTPS for the API
  • API tokens over HTTP — create, list, delete, GET /tokens/self; read-only grants
  • Zone migration — zone import --from-server pulls a zone over AXFR; --create builds it from the file's SOA
  • Records — DNAME and NAPTR, set-wide deletes, --dry-run previews on every change, versions record their author, zone update --enabled false
  • Daemon — config reload without restart, graceful SIGTERM, configurable maintenance interval, JSON logs
  • CLI — -o json|yaml|table everywhere, ls/rm aliases, colorized diffs, man, completions, doctor -o json

🧹 Fixes & Improvements

  • UDP listener no longer serves one query at a time; both listeners are bounded
  • Correctness — MX/SRV priority stored, TXT shape preserved, NAPTR validated as BIND does, owner-only daemon socket, NOTIFY delivered across shutdown, one deadline per AXFR
  • Performance — scoped listings narrowed in SQL, journal/version indexes, narrower nsupdate locks, right-sized SQLite bulk inserts, cached ACL lookups