Kyle Isom
f9635578e0
Replace the CoreDNS precursor with a purpose-built authoritative DNS server. Zones and records (A, AAAA, CNAME) are stored in SQLite and managed via synchronized gRPC + REST APIs authenticated through MCIAS. Non-authoritative queries are forwarded to upstream resolvers with in-memory caching. Key components: - DNS server (miekg/dns) with authoritative zone handling and forwarding - gRPC + REST management APIs with MCIAS auth (mcdsl integration) - SQLite storage with CNAME exclusivity enforcement and auto SOA serials - 30 tests covering database CRUD, DNS resolution, and caching Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
46 lines
1.3 KiB
Go
46 lines
1.3 KiB
Go
package grpcserver
|
|
|
|
import (
|
|
mcdslgrpc "git.wntrmute.dev/kyle/mcdsl/grpcserver"
|
|
)
|
|
|
|
// methodMap builds the mcdsl grpcserver.MethodMap for MCNS.
|
|
//
|
|
// Adding a new RPC without adding it to the correct map is a security
|
|
// defect — the mcdsl auth interceptor denies unmapped methods by default.
|
|
func methodMap() mcdslgrpc.MethodMap {
|
|
return mcdslgrpc.MethodMap{
|
|
Public: publicMethods(),
|
|
AuthRequired: authRequiredMethods(),
|
|
AdminRequired: adminRequiredMethods(),
|
|
}
|
|
}
|
|
|
|
func publicMethods() map[string]bool {
|
|
return map[string]bool{
|
|
"/mcns.v1.AdminService/Health": true,
|
|
"/mcns.v1.AuthService/Login": true,
|
|
}
|
|
}
|
|
|
|
func authRequiredMethods() map[string]bool {
|
|
return map[string]bool{
|
|
"/mcns.v1.AuthService/Logout": true,
|
|
"/mcns.v1.ZoneService/ListZones": true,
|
|
"/mcns.v1.ZoneService/GetZone": true,
|
|
"/mcns.v1.RecordService/ListRecords": true,
|
|
"/mcns.v1.RecordService/GetRecord": true,
|
|
}
|
|
}
|
|
|
|
func adminRequiredMethods() map[string]bool {
|
|
return map[string]bool{
|
|
"/mcns.v1.ZoneService/CreateZone": true,
|
|
"/mcns.v1.ZoneService/UpdateZone": true,
|
|
"/mcns.v1.ZoneService/DeleteZone": true,
|
|
"/mcns.v1.RecordService/CreateRecord": true,
|
|
"/mcns.v1.RecordService/UpdateRecord": true,
|
|
"/mcns.v1.RecordService/DeleteRecord": true,
|
|
}
|
|
}
|