DNS record derivation and address-mode reference

DNS is global, not multi-instance.

Its state is split across:

everlock-system/config/dns.toml
everlock-dns/<zone>.toml

The backend combines:

derived records from other Everlock services
explicit records stored in zone files
generated SOA and ns1 / ns2 NS records for each owned zone

Explicit records override derived records by name + type.

What it currently derives

Everlock derives DNS records from:

site vhosts
image vhosts
OCI registry vhosts
mail domains

Mail domains also derive:

MX <zone> -> 10 mail.<zone>
address records for mail.<zone>

Address resolution

The address used for synthesised A and AAAA records — vhost records, mail.<zone>, and the ns1 / ns2 glue — is selected at runtime by the address_mode key in config/dns.toml:

Mode	Where the address comes from	When to use
`static`	`default_ipv4` / `default_ipv6` from `dns.toml`	Datacenter VM, VPS, paid static line
`interface`	First public address on a local interface	Hosts where the routable IP is on the LAN interface
`discover`	Hourly probe against public DNS services	NAT or residential lines
`localhost`	`127.0.0.1` / `::1`	Containers and dev machines
`manual`	Operator pushes values via `/dns ip set v4	v6 `
`auto`	Picks one of the above at startup based on what's around	Default if `address_mode` is unset

In discover mode the loop talks to myip.opendns.com against OpenDNS and whoami.cloudflare against 1.1.1.1 once per hour. When the public address changes, Everlock updates the synthesised records and bumps the SOA serial.

Three environment variables override the equivalent TOML keys:

EVERLOCK_PUBLIC_IPV4
EVERLOCK_PUBLIC_IPV6
EVERLOCK_ADDRESS_MODE

listen_udp and listen_tcp in config/dns.toml accept comma-separated bind addresses, so you can bind explicit IPv4 and IPv6 addresses instead of 0.0.0.0:53.

Admin commands

In addition to the zone and record commands, the admin SSH backend exposes two commands for managing the address overlay:

/dns ip refresh wakes the discovery loop for an out-of-band probe
/dns ip set v4|v6 <addr> pushes a value into the manual overlay

/dns info shows the resolved mode and the effective address values currently used in synthesised records.

Current gaps

Still missing:

warning and reporting for suppressed derived records
SSH public-host derived records
ACME DNS-01 integration

For the internal design and deeper rationale, see the internal DNS backend doc.