Introduce PowerDnsWriter for zone synchronization to PowerDNS #2758

[qrtp]

Introduce a new DNS writer package that can forward zone changes to a PowerDNS backend. Leverages the PowerDNS API to manage records, with full support for DNSSEC and TSIG key management.

An older version of this PR has been closed by the author

Background

At Unstoppable Domains we use PowerDNS as the backend for DNS zones and DNSSEC management. We've created a Nomulus plugin to facilitate synchronization with PowerDNS, that we believe would be useful for the Nomulus community at large.

Usage

In order to use the new PowerDnsWriter, a TLD must be created with a PowerDnsWriter specified in the dnsWriters stanza of the TLD configuration yaml.

dnsWriters:
- "PowerDnsWriter"

The PowerDNS config can be modified in the main environment config files. For example, the default config shows the available options for the PowerDNS settings, which can be customized per environment.

powerDns:
  baseUrl: http://localhost:8081/api/v1
  apiKey: example-api-key
  dnssecEnabled: false
  tsigEnabled: true
  rootNameServers:
  - ns1.example.com.
  - ns2.example.com.
  soaName: nstld.example.com.

DNSSEC

If enabled, the PowerDnsWriter will ensure a TLD is properly configured with a KSK and ZSK and use them to sign zone records. The ZSK will be automatically rotated on a monthly basis. The Nomulus registry operator must still take the manual step to publish the KSK DS record to the parent root server(s) to establish a chain of trust. The DS value(s) to publish are available in the Nomulus GAE logs, or can be retrieved from the PowerDNS command line.

TSIG

If enabled, the PowerDnsWriter will establish a TSIG configuration for each managed TLD to facilitate secure zone replication. If zone replication is desired, the TSIG key needs to be manually retrieved from the PowerDNS command line and shared with the secondary DNS server.

PowerDNS configuration

Consult the PowerDNS documentation to setup your own instance. The key requirement is to ensure the PowerDNS API server is enabled and accessible from your Nomulus environment. An SSL connection is not directly supported from PowerDNS, and we suggest using Nginx to terminate SSL and proxy requests to the PowerDNS backend.

---

This change is 

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.