Skip to main content
← back to extensions

Knot Dns

@randybias/knot-dnsv2026.10.17.2beta· 18d agoBEHAVIORSACCEPTED WARNINGS
01README

Manage authoritative Knot DNS zones and a Knot Resolver 6 recursive resolver over SSH. Every candidate zone file, Knot config fragment and resolver config is rendered deterministically and validated by the vendor tools before it reaches the live service; secrets stay in the vault and reach the host over stdin.

02Behaviors1
@randybias/knot-dnsv2026.10.17.2knot_dns.ts
fn install()
Install Knot (and Knot Resolver 6 when resolver is true) and add the model's include line to knot.conf. Idempotent: an already-installed host is unchanged.
fn render_zone()
READ-ONLY. Render the canonical zone file, its config fragment and their sha256 without touching any host. Persists the render under its own resource name, never overwriting applied state.
fn apply_zone()
DESTRUCTIVE. Render, validate with kzonecheck and knotc conf-check, atomically swap, reload and verify one whole zone, restoring the previous zone if verification fails. A managed zone owns all of its records, so records not declared are removed. Idempotent: an unchanged render is a no-op.
fn remove_zone()
DESTRUCTIVE. Stop serving one managed zone, remove its zone file, config fragment and TSIG fragment, and no-op a second call. A signed zone is refused unless dnssec_unsign_ack is set; purge_keys_ack, only for a zone this model applied, purges the journal, timers and KASP keys irreversibly.
fn get_ds()
READ-ONLY. Read the DS records for a signed zone's current KSK(s) and persist them for submission to the parent. Never returns private key material.
fn ksk_submitted()
DESTRUCTIVE. Tell Knot the zone's KSK DS has been submitted to the parent (knotc zone-ksk-submitted). Idempotent. Refuses a zone that is not present.
fn get()
READ-ONLY. Observe the host: each managed zone's served records diffed against its recorded declaration, its DNSSEC key states, and the resolver service. Persists the observation only after every probe succeeds.
fn sync()
READ-ONLY. Reconcile the recorded state with the host and report drift (a changed zone file, missing or extra served records, an inactive resolver). Persists the observation only after every probe succeeds.

Resources

zone(infinite)— Zone declaration and its last applied render
resolver(infinite)— Resolver configuration and its last applied render
observation(infinite)— Last live observation of managed zones and the resolver
outcome(infinite)— What the last install, apply or remove did (changed, removed, versions)
ds(infinite)— Last DS records read for a signed zone
03Previous Versions1
2026.10.17.1
04Stats
A
93 / 100
Downloads
2
Archive size
78.4 KB
  • Has README or module doc2/2earned
  • README has a code example1/1earned
  • README is substantive1/1earned
  • Most symbols documented1/1earned
  • No slow types (deprecated)1/1earned
  • Dependencies pass trust audit2/2earned
  • Has description1/1earned
  • Platform support declared (or universal)2/2earned
  • License1/2partial

    no SPDX license declared

  • Verified public repository2/2earned
Repository
https://github.com/randybias/swamp-extensions

06Platforms
07Labels
#knot-dns#dns#dnssec#knot-resolver#recursion#ssh