b1a35783bb
- Merge Infrastructure + Secure + Systems → SNS Networking (Business #1) - Merge Web + Software + Cloud → SNS Digital (planned) - SNS Support unchanged (planned) - Add infra/ folder with 16 FOSS-first buildable designs - Update all agent knowledge, division briefs, legal structure - Restructure businesses/ from 7 to 3 operating folders
71 lines
2.9 KiB
Markdown
71 lines
2.9 KiB
Markdown
# DNS & Domain Management — SNS Digital
|
|
|
|
**Entity:** SNS Digital · **Status:** Buildable now
|
|
|
|
## What it is
|
|
|
|
Centralized DNS management strategy. Public DNS on Route53 (cheap, reliable, API-driven).
|
|
Internal DNS on AdGuard Home (split-horizon for private services).
|
|
|
|
## Architecture
|
|
|
|
```
|
|
Public (internet-facing) Internal (on-prem only)
|
|
┌─────────────────────┐ ┌─────────────────────────┐
|
|
│ AWS Route53 │ │ AdGuard Home (LXC) │
|
|
│ │ │ │
|
|
│ snsnetlabs.com │ │ *.internal.sns → 192.168.122.x │
|
|
│ client-domain.com │ │ *.wg.internal → 10.10.0.x │
|
|
│ (delegated zones) │ │ │
|
|
└─────────────────────┘ └─────────────────────────┘
|
|
```
|
|
|
|
## Public DNS (Route53)
|
|
|
|
| Record | Purpose |
|
|
|--------|---------|
|
|
| `snsnetlabs.com` | Primary business domain |
|
|
| `A` / `CNAME` → Caddy public IP or Cloudflare | Client sites |
|
|
| `MX` → Google Workspace | Email |
|
|
| `TXT` SPF/DKIM/DMARC | Email auth |
|
|
| `CAA` | Restrict cert issuance to Let's Encrypt |
|
|
|
|
**Why Route53 over self-hosted DNS:** $0.50/zone/month, 100% SLA, no maintenance.
|
|
DNS is the one thing you don't want to self-host — if it goes down, everything goes down.
|
|
|
|
## Internal DNS (AdGuard Home)
|
|
|
|
- Runs on Proxmox LXC.
|
|
- Resolves `*.internal.sns` to local service IPs.
|
|
- Blocks ads/telemetry for all on-prem devices.
|
|
- Upstream: Cloudflare DoH (`https://dns.cloudflare.com/dns-query`).
|
|
|
|
## Domain Registration
|
|
|
|
- **Registrar:** Cloudflare Registrar (at-cost, no markup) or Porkbun (cheap, good UI).
|
|
- **Rule:** All client domains registered under the client's own account. SNS never
|
|
holds a client's domain hostage.
|
|
- **SNS-owned domains:** registered under Sam's account, Route53 for DNS.
|
|
|
|
## Build Steps
|
|
|
|
1. Register domain at Cloudflare/Porkbun.
|
|
2. Create Route53 hosted zone → get NS records.
|
|
3. Point registrar NS to Route53.
|
|
4. Add records via Ansible (`amazon.aws.route53` module) or Terraform.
|
|
5. For internal: add entry to AdGuard Home's DNS rewrites.
|
|
|
|
## Security Posture
|
|
|
|
- **DNSSEC:** Enable on Route53 for SNS-owned zones.
|
|
- **CAA records:** Restrict to `letsencrypt.org` only — prevents rogue cert issuance.
|
|
- **DMARC:** `p=reject` on all owned domains once SPF/DKIM confirmed working.
|
|
- **Registrar lock:** Transfer lock enabled on all production domains.
|
|
- **No wildcard DNS on public zones** unless explicitly needed (reduces attack surface).
|
|
|
|
## Upgrade Path
|
|
|
|
- **Terraform-managed DNS:** When zone count exceeds 5, manage all Route53 records
|
|
in Terraform for version control and drift detection.
|
|
- **PowerDNS:** If Route53 cost becomes a factor at scale (unlikely at $0.50/zone).
|