Skip to content

🚀 Release: 0.1.0-rc.2

Second release candidate. Every change since 0.1.0-rc.1: secondaries and access rights move into the database, every payload speaks one vocabulary, and releases carry their third-party license notice. Clean installs only — no upgrade path from rc.1.

📦 Distribution

Debian (.deb) and RPM (.rpm) packages for amd64 and arm64, the multi-arch container image carrying the ExternalDNS adapter (bindizr-external-dns), and the Helm chart on Docker Hub as an OCI artifact (oci://registry-1.docker.io/kweonminsung/bindizr-chart). Every release now attaches THIRD_PARTY_LICENSES.html, the notice cargo-about renders for the crates the binaries are built from, the vendored OpenSSL included.

📌 Installation (Debian/Ubuntu)

dpkg -i bindizr_0.1.0-rc.2-1_amd64.deb    # _arm64.deb on arm64

📌 Installation (RHEL/CentOS/Fedora)

rpm -i bindizr-0.1.0_rc.2-1.x86_64.rpm    # .aarch64.rpm on arm64

📌 Installation (Helm)

helm install bindizr oci://registry-1.docker.io/kweonminsung/bindizr-chart \
  --version 0.1.0-rc.2 \
  --set bindizr.database.existingSecret=bindizr-db-secret

⚠️ Breaking Changes

  • Secondaries are registered at runtime, not configured. dns.secondary_addrs is gone; bindizr secondary create|list|get|update|delete and /secondaries register a name, a host[:port] address (a hostname is resolved when used), enabled, and an optional notify_key_name whose TSIG key signs every NOTIFY to that secondary. NOTIFY fan-out and the unsigned-transfer ACL read the rows
  • Rights belong to roles, not credentials. An API token or TSIG key names exactly one role (--role, required) and only authenticates; the role's grants decide what it may do. token grant / tsig-key grant and the /tokens/{name}/grants, /tsig-keys/{name}/grants routes are replaced by role grant|grants|revoke and /roles/{name}/grants. A grant is a zone scope (all zones, or one), a set of <resource>:<action> actions — zone:read|create|update|delete|transfer, record:read|create|update|delete, dnssec:read|manage, secondary:read|manage, access:manage — and record name and type constraints. The built-in admin role holds every action in all zones; the first token is token create --role admin over the socket. A TSIG-signed transfer needs zone:transfer
  • Configuration (unknown keys are rejected): dns.notify.after_update and dns.notify.on_startup are gone — batch_ms alone decides immediate or batched NOTIFY and nothing is notified at startup; dns.transfer_cache.enabled is gone — max_records = 0 turns the cache off
  • HTTP API vocabulary: a field naming another entity is <entity>_name (zone_name, role_name, policy_name, notify_key_name), a serial is u32, a key tag u16, a count u64 named added/deleted/unchanged, a fixed set of values is an enum with a schema (SecondaryStatus, TransferResult, RecordChange, …), and a response's optional field is null, never omitted. Every record response carries the caller's actions on it
  • A new zone starts with an apex NS record naming its SOA MNAME, unless the request says apex_ns: false (--no-apex-ns)
  • Schema replaced: roles, role_grants, secondaries, and transfers are new; token_grants and tsig_grants are gone. Rust 1.94 to build

✨ New Features

  • Secondaries — secondary check (POST /secondaries/{name}/check) asks one secondary what doctor asks all of them: resolution, the catalog serial it serves, and a NOTIFY round trip; secondary transfers lists what Bindizr served each of its addresses, kept in the database so it reads back across restarts. Guides for Technitium, Windows Server DNS, YADIFA, Unbound, and CoreDNS join BIND9, Knot DNS, NSD, and PowerDNS
  • Roles — role create|list|get|delete|grant|grants|revoke over the CLI, the HTTP API, and the daemon socket; token list --role / tsig-key list --role; a role reports its grant, token, and TSIG key counts, and a delete refused while credentials hold it names them. GET /permissions reports what the caller may do, so a client offers only what the server allows
  • Helm chart — bind9.service.nodePort for clusters without a load balancer, bindizr.dns.extraSecondaries for secondaries outside the chart, and named's directory on the persistent volume the chart already claimed
  • Releases attach the third-party license notice

🧹 Fixes & Improvements

  • Hashing and TLS run on ring alone
  • Internals — the workspace takes the shape the project's rules describe: modules of functions, a Context passed by reference, typed errors with their causes intact, newtypes for serials, TTLs, key tags, and row ids, and one data-carrying DaemonCommand. The HTTP API, CLI, and DNS behaviour are unchanged by it, error codes and messages included