CLI Commands

Bindizr provides a command-line interface for managing the DNS synchronization service, its zone data, access control (roles, API tokens, TSIG keys), and DNSSEC. bindizr help lists everything; this page covers the commands you reach for most and points to the pages that cover the rest.

Management commands connect to the local daemon and have full control. Run them as the daemon's user or root: sudo bindizr ... for a package install, or through docker exec / kubectl exec in a container. There is no remote mode; use the HTTP API for remote access.

config check, completion, man, and help work without a daemon. doctor can also diagnose an installation while the daemon is stopped.

Command map

Commands	What they manage	Documented in
start, stop, restart, status, doctor, config	The daemon and its configuration	this page
completion, man	The shell completion scripts and the man page	this page
zone, record	Zone data: CRUD, import/export, versions, NOTIFY, secondary status	Zones and Records
secondary	The secondary servers: who receives NOTIFY and may pull zones	Secondaries
role	Roles and the grants that decide what their tokens and keys may do	Access Control
token	API tokens, each authenticating into one role	Access Control
tsig-key	TSIG keys, each authenticating into one role, for nsupdate and transfers	Access Control, Dynamic Updates
dnssec-policy, dnssec	Signing-parameter bundles and each zone's signing state	DNSSEC

Result commands support -o json and -o yaml for scripting. Exports, completion, and man write their file content directly and take no -o. Results go to stdout and diagnostics to stderr.

Service

# Start bindizr on foreground
bindizr start

# Start with a custom configuration file. `start`, `doctor`, and `config check`
# all take `-c` and fall back to $BINDIZR_CONFIG_PATH
bindizr start -c <FILE>

# Stop the running daemon, or restart it in place
bindizr stop
bindizr restart

# Whether the daemon runs, where it listens, its database and zone count, and its
# secondaries. Exits non-zero when the database does not answer, so a health
# check can branch on it
bindizr status

# Check the installation end to end; without a daemon it checks the database, the
# listen ports, and BIND's catalog setup itself
bindizr doctor

# Validate a configuration file without starting bindizr (defaults to /etc/bindizr/bindizr.conf.toml)
bindizr config check [-c <FILE>]

# Show the configuration loaded by the running daemon, or one value by dotted key
bindizr config list
bindizr config get dns.listen_port

# Re-read the configuration file without restarting (`systemctl reload bindizr` or SIGHUP does the same)
bindizr config reload

# doctor also answers as one JSON document, for a cron job or CI check
bindizr doctor -o json

Completions and the man page

A package install puts both in place already. Elsewhere the binary prints them, generated from the same command it parses with:

# Shell completion: bash, zsh, fish, elvish, or powershell
bindizr completion bash | sudo tee /usr/share/bash-completion/completions/bindizr
bindizr completion zsh  | sudo tee /usr/share/zsh/site-functions/_bindizr
bindizr completion fish > ~/.config/fish/completions/bindizr.fish

# Man page
bindizr man | sudo tee /usr/share/man/man1/bindizr.1 > /dev/null

Exit codes

A failure exits with the class of the error, so a script can branch on it without parsing the message.

Code	Meaning
0	Success
1	Failure, including invalid input
2	Usage error, such as an unknown command or a missing argument
3	Not found: no such zone, record, token, version, key, or policy
4	Conflict: the name is taken, or the object is in use or in the wrong state
5	Denied: the token is missing, invalid, or its role lacks a grant
6	The configuration file is unusable, so running the same command again changes nothing
7	Unavailable: the daemon is not running, so the command never reached it