Deploys PowerDNS authoritative server on existing anycast worker nodes for globally distributed DNS with BGP anycast routing. Every node serves the same zones, and DNS queries are automatically routed to the nearest PoP.
On each existing anycast node:
- MariaDB for zone storage
- PowerDNS authoritative server with MySQL backend
- PowerDNS API enabled (localhost only)
- DNS listening on the anycast IP and localhost
Never commit real credentials. The group_vars/all file contains placeholder
values for pdns_db_password and pdns_api_key. For production deployments, use
ansible-vault:
ansible-vault encrypt_string 'your-real-password' --name 'pdns_db_password'
ansible-vault encrypt_string 'your-real-api-key' --name 'pdns_api_key'Then run playbooks with --ask-vault-pass or --vault-password-file.
- Existing anycast nodes from netactuate-ansible-bgp-bird2 with BGP sessions established
- Ansible venv set up (from the BGP deployment)
community.mysqlAnsible collection:ansible-galaxy collection install community.mysql
| Variable | Type | Default | Description |
|---|---|---|---|
pdns_db_name |
string | pdns |
MariaDB database name |
pdns_db_user |
string | pdns |
MariaDB user |
pdns_db_password |
string | CHANGEME |
MariaDB password — use vault |
pdns_api_key |
string | CHANGEME |
PowerDNS API key — use vault |
pdns_admin_email |
string | admin@example.com |
SOA contact email |
pdns_anycast_ip |
string | required | Anycast IP PowerDNS listens on |
Reuse the hosts file from your BGP deployment.
source .venv/bin/activate
ansible-playbook pdns-auth.yamldig @YOUR_ANYCAST_IP version.bind chaos txtExpected: response from PowerDNS with version string.
To test a zone (after creating one via the API or pdnsutil):
dig @YOUR_ANYCAST_IP example.com SOAUse pdnsutil on any node or the PowerDNS API:
# SSH to a node
ssh ubuntu@<node-ip>
sudo pdnsutil create-zone example.com ns1.example.com
sudo pdnsutil add-record example.com @ A 3600 192.0.2.1- NetActuate support: support@netactuate.com