diff options
| author | Ruben Herold <ruben@puettmann.net> | 2026-08-09 22:01:25 +0200 |
|---|---|---|
| committer | Ruben Herold <ruben@puettmann.net> | 2026-09-01 14:16:05 +0200 |
| commit | fa8404441ac0124878d52eaad07c0ac974a72fbc (patch) | |
| tree | 9bf36c79f332be97f8efd3e7c2c7fdfa00f36956 /interface-definitions | |
| parent | 3623796a0577659e789e4344daede98dad479233 (diff) | |
| download | vyos-1x-fa8404441ac0124878d52eaad07c0ac974a72fbc.tar.gz vyos-1x-fa8404441ac0124878d52eaad07c0ac974a72fbc.zip | |
dns: T9175: make PowerDNS security status poll opt-in
The PowerDNS recursor periodically polls secpoll.powerdns.com to check
for known security issues, but VyOS ships a patched/backported package
that is never updated in-place, so the check result is meaningless and
only produces log noise.
Add a new `service dns forwarding options security-poll-suffix` option,
disabled by default. Users who still want the check (e.g. against
PowerDNS' own poll domain, or a custom one) can opt back in.
Diffstat (limited to 'interface-definitions')
| -rw-r--r-- | interface-definitions/service_dns_forwarding.xml.in | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/interface-definitions/service_dns_forwarding.xml.in b/interface-definitions/service_dns_forwarding.xml.in index 1cb1e4083..a316552bd 100644 --- a/interface-definitions/service_dns_forwarding.xml.in +++ b/interface-definitions/service_dns_forwarding.xml.in @@ -889,6 +889,22 @@ <multi/> </properties> </leafNode> + <leafNode name="security-poll-suffix"> + <properties> + <help>Domain suffix for the periodic PowerDNS security status poll (default: disabled)</help> + <valueHelp> + <format>secpoll.powerdns.com</format> + <description>Use PowerDNS' own security status poll domain</description> + </valueHelp> + <valueHelp> + <format>txt</format> + <description>Custom domain suffix to poll instead</description> + </valueHelp> + <constraint> + <validator name="fqdn"/> + </constraint> + </properties> + </leafNode> </children> </node> <tagNode name="zone-cache"> |