git clone https://github.com/PowerDNS/pdns.git

git submodule init
git submodule update
./builder/build.sh

apt install g++ libboost-all-dev libtool make pkg-config default-libmysqlclient-dev libssl-dev libluajit-5.1-dev python3-venv

apt install autoconf automake ragel bison flex

apt install libcurl4-openssl-dev luajit lua-yaml-dev libyaml-cpp-dev libtolua-dev lua5.3 autoconf automake ragel bison flex g++ libboost-all-dev libtool make pkg-config libssl-dev lua-yaml-dev libyaml-cpp-dev libluajit-5.1-dev libcurl4 gawk libsqlite3-dev python3-venv
# For DNSSEC ed25519 (algorithm 15) support with --with-libsodium
apt install libsodium-dev
# If using the gmysql (Generic MySQL) backend
apt install default-libmysqlclient-dev
# If using the gpgsql (Generic PostgreSQL) backend
apt install libpq-dev
# If using --enable-systemd (will create the service scripts so it can be managed with systemctl/service)
apt install libsystemd0 libsystemd-dev
# If using the geoip backend
apt install libmaxminddb-dev libmaxminddb0 libgeoip1 libgeoip-dev

autoreconf -vi

./configure --with-modules="" --disable-lua-records
make
# make install

./configure --with-modules="bind gmysql gpgsql"

autoreconf -vi

cd docs
make html-docs

export CXXFLAGS=-std=c++17

brew install pdns

brew install boost lua pkg-config ragel openssl
./configure --with-modules="" PKG_CONFIG_PATH=/usr/local/opt/openssl/lib/pkgconfig
make -j4

Location of the BIND configuration file to parse.

PowerDNS does not support every directive supported by BIND.
It supports the following blocks and directives:

* ``options``
   * ``directory``
   * ``also-notify``
* ``zone``
   * ``file``
   * ``type``
   * ``masters``
   * ``primaries`` (added in version 4.9.0)
   * ``also-notify``

Unknown directives will be ignored.

.. _setting-bind-check-interval:

``bind-check-interval``

Filename to store and access our DNSSEC metadatabase, empty for none. To
run secondary DNSSEC-enabled domains (where the RRSIGS are in the AXFR), a
``bind-dnssec-db`` is required. This is because the
:ref:`metadata-presigned` domain metadata is set
during the zonetransfer.

You can use ``pdnsutil create-bind-db`` to make this database file for you.

.. warning::
   If this is left empty on slaves and a presigned zone is transferred,
   it will (silently) serve it without DNSSEC. This in turn results in
   serving the domain as bogus.

.. _setting-bind-dnssec-db-journal-mode:

``bind-dnssec-db-journal-mode``

Store DNSSEC keys and metadata storage in another backend. See the
:ref:`dnssec-modes-hybrid-bind` documentation.

.. _setting-bind-ignore-broken-records:

``bind-ignore-broken-records``

.. _setting-bind-autoprimaries:

``bind-autoprimaries``
~~~~~~~~~~~~~~~~~~~~~~

.. versionchanged:: 4.9.0

  This was called ``bind-supermasters`` before 4.9.0.

Specifies file where to read list of autoprimaries.
BIND backend only checks IP address of primary server.

The file must contain one IP and account per line, separated by whitespace.

BIND backend can only read this file, not write it.

.. _setting-bind-autoprimary-config:

``bind-autoprimary-config``
~~~~~~~~~~~~~~~~~~~~~~~~~~~

.. versionchanged:: 4.9.0

  This was called ``bind-supermaster-config`` before 4.9.0.

When a new zone is configured via the autosecondary mechanism, bindbackend *writes* a zone entry to this file.

Your ``bind-config`` file should have an ``include`` statement to make sure this file is read on startup.

.. _setting-bind-autoprimary-destdir:

``bind-autoprimary-destdir``
~~~~~~~~~~~~~~~~~~~~~~~~~~~~

.. versionchanged:: 4.9.0

  This was called ``bind-supermaster-destdir`` before 4.9.0.

Each new zone configured via the autosecondary mechanism gets a zone file in this directory.
This directory must be writable.

.. _bind-operation:

Operation
---------

On launch, the BIND backend first parses the ``named.conf`` to determine
which zones need to be loaded. These will then be parsed and made
available for serving, as they are parsed. So a ``named.conf`` with
100.000 zones may take 20 seconds to load, but after 10 seconds, 50.000
zones will already be available. While a domain is being loaded, it is
not yet available, to prevent incomplete answers.

Reloading is currently done only when a request (or zone transfer) for a
zone comes in, and then only after :ref:`setting-bind-check-interval`
seconds have passed since the last check. If a change occurred, access
to the zone is disabled, the file is reloaded, access is restored, and
the question is answered. For regular zones, reloading is fast enough to
answer the question which lead to the reload within the DNS timeout.

If :ref:`setting-bind-check-interval` is specified as
zero, no checks will be performed until the ``pdns_control reload`` command
is issued.

Please note that also the :ref:`setting-xfr-cycle-interval` setting
controls how often a primary would notify a secondary about changes.
Especially in 'hidden primary' configurations, where servers usually
don't receive regular queries, you may want to lower that setting to a
value as low as :ref:`setting-bind-check-interval`.

pdns\_control commands
----------------------

``bind-add-zone <domain> <filename>``

.. versionadded:: 4.3.0

Output an extended status of a domain or domains, containing much more information than
the simple domain status, like the number of records currently loaded, whether pdns
is primary or secondary for the domain, the list of primaries, various timers, etc

``bind-domain-status [domain ...]``
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Output status of domain or domains. Can be one of:

* ``seen in named.conf, not parsed``,
* ``parsed successfully at <time>`` or
* ``error parsing at line ... at <time>``.

``bind-list-rejects``
~~~~~~~~~~~~~~~~~~~~~

Lists all zones that have problems, and what those problems are.

``bind-reload-now <domain>``
~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Reloads a zone from disk immediately, reporting back results.

``rediscover``
~~~~~~~~~~~~~~

Reread the BIND configuration file (``named.conf``). If parsing fails,
the old configuration remains in force and ``pdns_control`` reports the
error. Any newly discovered domains are read, discarded domains are
removed from memory.

``reload``
~~~~~~~~~~

All zones with a changed timestamp are reloaded at the next incoming
query for them.

.. _bind_performance:

Performance
-----------

The BIND backend does not benefit from the packet cache as it is fast
enough on its own. Furthermore, on most systems, there will be no
benefit in using multiple CPUs for the packetcache, so a noticeable
speedup can be attained by specifying
``distributor-threads=1`` in ``pdns.conf``.

Primary/secondary/native configuration
--------------------------------------

Primary
~~~~~~~

Works as expected. At startup, no notification storm is performed as
this is generally not useful. Perhaps, in the future, the BIND backend
will attempt to store zone metadata in the zone, allowing it to
determine if a zone has changed its serial since the last time
notifications were sent out.

Changes which are discovered when reloading zones do lead to
notifications however.

Secondary
~~~~~~~~~

Also works as expected. The BIND backend expects to be able to write to
a directory where a secondary domain lives. The incoming zone is stored as
'zonename.RANDOM' and atomically renamed if it is retrieved
successfully, and parsed only then.

In the future, this may be improved so the old zone remains available
should parsing fail.

Native
~~~~~~

PowerDNS has the concept of "native" zones that have the
``type native;`` in the BIND configuration file. These zones are neither
a primary (no notifies are sent) nor a secondary zone (it will never be
AXFR'd in). This means that the replication mechanism for these zone is
not AXFR but out of band, e.g. using ``rsync``. Changes to native zones
are picked up in the same way as primary and secondary zones, see
:ref:`bind-operation`.

Native zones in the BIND backend are supported since version 4.1.0 of
the PowerDNS Authoritative Server.

.. note::
  Any zone with no ``type`` set (an error in BIND) is assumed to be native.

---

## File: docs/backends/generic-mysql.rst

Generic MySQL/MariaDB  backend
==============================

* Native: Yes
* Primary: Yes
* Secondary: Yes
* Producer: Yes
* Consumer: Yes
* Autosecondary: Yes
* DNS Update: Yes
* DNSSEC: Yes (set ``gmysql-dnssec``)
* Disabled data: Yes
* Comments: Yes
* Search: Yes
* Views: No
* API: Read-Write
* :ref:`Multiple instances <setting-launch>`: Yes
* Zone caching: Yes
* Module name: gmysql
* Launch name: ``gmysql``

.. warning::
  If using MySQL with 'slave' support enabled in PowerDNS you
  **must** run MySQL with a table engine that supports transactions. In
  practice, great results are achieved with the 'InnoDB' tables. PowerDNS
  will silently function with non-transaction aware MySQLs but at one
  point this is going to harm your database, for example when an incoming
  zone transfer fails.

.. warning::
  While it is possible to run the Generic MySQL/MariaDB backend on top of MySQL/MariaDB 
  views, we have received several reports of this causing performance
  problems and memory leaks.  Please know that when reporting problems when
  running PowerDNS on top of a modified schema, our open source support
  offering requires you to reproduce your problem on an unmodified schema without
  views.

The default schema is included at the bottom of this page.
:ref:`migration-zone2sql` with the ``--gmysql`` flag also
assumes this layout is in place. For full migration notes, please see
:doc:`../migration`. This schema contains all elements needed
for master, slave and superslave operation.

When using the InnoDB storage engine, we suggest adding foreign key
constraints to the tables in order to automate deletion of records, key
material, and other information upon deletion of a domain from the
domains table. The following SQL does the job:

.. literalinclude:: ../../modules/gmysqlbackend/enable-foreign-keys.mysql.sql
   :language: SQL

.. warning::
  Please note, however, that setting up these foreign key constraints prevents
  the PowerDNS database from being usable with mysql group replication, if you
  are using multiple servers.

Using MySQL/MariaDB replication
-------------------------------

To support ``NATIVE`` domains, the ``binlog_format`` for the MySQL/MariaDB
replication **must** be set to ``MIXED`` or ``ROW`` to prevent
differences in data between replicated servers. See `"Setting
The Binary Log
Format" <https://dev.mysql.com/doc/refman/5.7/en/binary-log-setting.html>`__
and `"Binary Log Formats" <https://mariadb.com/kb/en/binary-log-formats/>`__
for more information.

Otherwise, you will probably see:

::

  Cannot execute statement: impossible to write to binary log since BINLOG_FORMAT = STATEMENT and at least one table uses a storage engine limited to row-based logging.
  InnoDB is limited to row-logging when transaction isolation level is READ COMMITTED or READ UNCOMMITTED.

Settings
--------

.. _setting-gmysql-host:

``gmysql-host``
^^^^^^^^^^^^^^^

Host (ip address) to connect to. Mutually exclusive with :ref:`setting-gmysql-socket`.

.. warning::
  When specified as a hostname, a chicken/egg situation might
  arise where the database is needed to resolve the IP address of the
  database. It is best to supply an IP address of the database here.

.. _setting-gmysql-port:

``gmysql-port``
^^^^^^^^^^^^^^^

The port to connect to on :ref:`setting-gmysql-host`. Default: 3306.

.. _setting-gmysql-socket:

``gmysql-socket``
^^^^^^^^^^^^^^^^^

Connect to the UNIX socket at this path. Mutually exclusive with :ref:`setting-gmysql-host`.

.. _setting-gmysql-dbname:

``gmysql-dbname``
^^^^^^^^^^^^^^^^^

Name of the database to connect to. Default: "powerdns".

.. _setting-gmysql-user:

``gmysql-user``
^^^^^^^^^^^^^^^

User to connect as. Default: "powerdns".

.. _setting-gmysql-group:

``gmysql-group``
^^^^^^^^^^^^^^^^

Group to connect as. Default: "client".

.. _setting-gmysql-password:

``gmysql-password``
^^^^^^^^^^^^^^^^^^^

The password for :ref:`setting-gmysql-user`.

.. _setting-gmysql-dnssec:

``gmysql-dnssec``
^^^^^^^^^^^^^^^^^

Enable DNSSEC processing for this backend. Default: no.

.. _setting-gmysql-innodb-read-committed:

``gmysql-innodb-read-committed``
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Use the InnoDB READ-COMMITTED transaction isolation level. Default: yes.

.. _setting-gmysql-ssl:

``gmysql-ssl``
^^^^^^^^^^^^^^^^^^

.. deprecated:: 5.0.0

Before 5.0.0: Send the CLIENT_SSL capability flag to the server. SSL support is announced by the server via CLIENT_SSL and is enabled if the client returns the same capability. Default: no.

5.0.0 and up: this option does nothing. Use ``gmysql-group`` and put your TLS settings in ``my.cnf``.

.. _setting-gmysql-timeout:

``gmysql-timeout``
^^^^^^^^^^^^^^^^^^

The timeout in seconds for each attempt to read from, or write to the
server. A value of 0 will disable the timeout. Default: 10

.. _setting-gmysql-thread-cleanup:

``gmysql-thread-cleanup``
^^^^^^^^^^^^^^^^^^^^^^^^^

Older versions (such as those shipped on RHEL 7) of the MySQL/MariaDB client libraries leak memory unless applications explicitly report the end of each thread to the library. Enabling ``gmysql-thread-cleanup`` tells PowerDNS to call ``mysql_thread_end()`` whenever a thread ends.

Only enable this if you are certain you need to. For more discussion, see https://github.com/PowerDNS/pdns/issues/6231.

Default Schema
--------------

This is the 4.7 schema.

.. literalinclude:: ../../modules/gmysqlbackend/schema.mysql.sql