skills.rest
erfianugrah
erfianugrahCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

knot-dns

Deploys Knot DNS on Fly.io with TSIG-protected RFC 2136 updates.

1|Updated Mar 18, 2024
Search Tags:#fly.io#authoritative dns#knot dns#acme dns-01#rfc 2136#tsig#cloudflare migration
One-click install
npx skills add https://github.com/erfianugrah/dotfiles --skill knot-dns
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: knot-dns
Source: https://github.com/erfianugrah/dotfiles/tree/main/.pi/agent/skills/knot-dns
Command: npx skills add https://github.com/erfianugrah/dotfiles --skill knot-dns

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provides an authoritative DNS deployment on Fly.io using Knot DNS while keeping ACME DNS-01 issuance working through a secure TSIG-based RFC 2136 path.

Core Features & Use Cases

  • Deploy Knot DNS end-to-end on Fly: run Knot 3.5 with correct Fly networking assumptions (including the TCP PROXY-related constraint) and durable configuration using confdb.
  • Secure ACME DNS-01 updates via RFC 2136: configure tightly-scoped TSIG keys and the correct Knot ACL matching behavior for _acme-challenge TXT updates.
  • Migrate from Cloudflare to self-hosted authoritative DNS: use outgoing AXFR from Knot/Cloudflare with verification steps, then cut over the registrar NS and migrate Caddy sites from dns cloudflare to dns rfc2136.

Quick Start

Deploy the referenced Knot-on-Fly setup for your zone from the working tree, then update your Caddy site blocks to use dns rfc2136 with the TSIG_CADDY_ACME key and the Knot anycast resolver.

Frequently Asked Questions about knot-dns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up self-hosted authoritative DNS on Fly.io using Knot DNS?▼

To set up self-hosted authoritative DNS on Fly.io, deploy Knot 3.5 with durable confdb persistence, ensuring correct Fly networking by avoiding PROXY protocol on TCP/53 for reliable zone serving.

How does ACME DNS-01 issuance work with RFC 2136 dynamic updates?▼

ACME DNS-01 issuance via RFC 2136 works by automating _acme-challenge TXT record updates, requiring tightly-scoped TSIG keys and strict Knot ACL matching to securely authorize certificate provisioning.

Can I migrate my DNS zones from Cloudflare to a self-hosted authoritative server?▼

Yes, you can migrate DNS zones from Cloudflare by configuring outgoing AXFR/IXFR transfers, verifying NOTIFY constraints, and then updating your registrar NS records to point to the new Knot DNS servers.

What are the prerequisites for using TSIG-based master and secondary DNS replication?▼

Using TSIG-based master and secondary replication requires generating shared TSIG keys, configuring strict ACLs on the Knot DNS server, and ensuring network paths allow AXFR/IXFR transfers without PROXY protocol interference.

Why are my Knot DNS zone transfers failing on Fly.io?▼

Knot DNS zone transfers on Fly.io often fail due to PROXY protocol interference on TCP/53; disabling PROXY protocol for DNS traffic and verifying strict TSIG/ACL configurations resolves the connection issue.

Do I need to update Caddy configurations when migrating from Cloudflare to Knot DNS?▼

Yes, when migrating from Cloudflare to Knot DNS, you must update Caddy site blocks from dns cloudflare to dns rfc2136, applying the designated TSIG_CADDY_ACME key and pointing to the Knot anycast resolver.

Related Skills

Explore More Software Engineering Skills→
AstorYHAstorYH
15

dns-record-lookup

Query a DNS server to retrieve IPv4 A records for a domain name.

Community
Basic
erfianugraherfianugrah
1

caddy

Configure and operate a custom Caddy reverse-proxy with WAF enforcement and TLS automation.

Community
Advanced
jtucker9jtucker9

domain-ssl

Configure domain DNS records and TLS certificates for hosting deployments.

Community
Intermediate
L3DigitalNetL3DigitalNet
6

bind9

Administer and troubleshoot BIND9 DNS servers with zone and named.conf management.

Official
Advanced