# Dynamic Zone update(root zone)

# NOTES: This small guide assumes you have some idea of how BIND9 works.

# Server(named.conf)
# - Add zone configuration in named.conf
# : include "/etc/bind/zone.conf";
# : include "/etc/bind/tsig.key";

# Server(zone.conf)
# -
# mkdir /etc/bind/dynamic
# chown bind:bind /etc/bind/dynamic
# chmod 0750 /etc/bind/dynamic

# Create zone.conf with the following:-
zone "domain.com" IN {
  type master;
  file "/etc/bind/dynamic/domain.com.conf";
  notify no;
  allow-query { any; };
  allow-update { key nsupdate; };
  allow-transfer { none; };
};

# Generating TSIG keys for dynamic zone updates.
# : Command: tsig-keygen -a algorithm keyName
# : Example: tsig-keygen -a hmac-sha512 nsupdate

# Copy the output into /etc/bind/tsig.key
# It should look like this:-
# -
key "nsupdate" {
  algorithm hmac-sha512;
  secret "yadaydadyadasecretkey==";
};

# chown bind:bind /etc/bind/tsig.key
# chmod 0400 /etc/bind/tsig.key
# systemctl restart named.service

# Copy the key file to your client that will be doing dynamic updates remotely.
# This is important as it authorizes the client to do the updates using the same TSIG key.

# Client Side
# In $HOME, create a script called update.sh with the following:-

#!/usr/bin/env bash
keyfile='/home/username/tsig.key'
dnsfile='/tmp/nsupdate.txt'

ip4=$(curl -4 https://ifconfig.me/ip ; echo)
ip6=$(curl -6 https://ifconfig.me/ip ; echo)

echo "server 1.2.3.4" > $dnsfile
echo "zone domain.com" >> $dnsfile
echo "update delete hostname.domain.com" >> $dnsfile
echo "update add hostname.domain.com 120 IN A ${ip4}" >> $dnsfile
echo "update add hostname.domain.com 120 IN AAAA ${ip6}" >> $dnsfile
echo "send" >> $dnsfile

/usr/bin/nsupdate -k $keyfile -v $dnsfile
/bin/rm -f $dnsfile

# Replace '1.2.3.4' with the server's public IP address.

# Set permissions:-
# chmod 0400 /home/username/tsig.key
# chown username:username /home/username/tsig.key
# chown username:username /home/username/update.sh
# chmod 0700 update.sh

# On the server, monitor the log file: journalctl -fen 15
# On the client, run the script: $ ./update.sh
# Watch the output on the server. You should see it successfully doing dynamic updates.

# If you notice permission errors, you can fix them using chown/chmod commands.

# Cheers :>