Read-only proxies (keep your own configuration)

• Caddy proxy / Traefik proxy: DNZ configures it, with the routes set up in DNZ. A Caddy proxy’s configuration replaces the Caddyfile; a Traefik proxy gets DNZ’s routes next to its own.
• Keep my Caddyfile / Keep my Traefik config: a read-only proxy, this page. DNZ never sends it any configuration: it gets nothing from Traefik’s HTTP provider or Caddy’s config loader, it can’t have routes or a token of its own, and the connect key never connects a Traefik or Caddy as it.

Who can manage them

• Proxy managers (proxy.manage, Manage proxies) and superadmins see and manage every one.
• A division’s owners (integrations.manage, Manage integrations, in that division) see and manage their division’s under Settings → Proxy, without needing Manage proxies.
• Anyone who can view a division’s zones (zones.read) can see its read-only proxies and preview what a sync would do.

The settings

Connect a Caddy

# Read-only access to Caddy's admin API for DNZ.
:2020 {
	basic_auth {
		dnz $2a$10$…
	}
	@read method GET
	handle @read {
		reverse_proxy localhost:2019 {
			header_up Host localhost:2019
		}
	}
	respond 405
}

{
	admin 0.0.0.0:2019
}

sudo ufw allow from 10.0.0.2 to any port 2019 proto tcp
sudo ufw deny 2019/tcp

Connect a Traefik

# traefik.yml: the API, and an entry point for DNZ to read it.
api: {}
entryPoints:
  api-read:
    address: ":8081"

--api=true
--entrypoints.api-read.address=:8081

# A file of the file provider: read-only access to the API for DNZ.
http:
  routers:
    api-read:
      entryPoints: [api-read]
      rule: "Method(`GET`) && PathPrefix(`/api`)"
      service: api@internal
      middlewares: [api-read-auth]
  middlewares:
    api-read-auth:
      basicAuth:
        users:
          - "dnz:<bcrypt hash>"

# Labels on the Traefik container (docker-compose).
labels:
  - "traefik.enable=true"
  - "traefik.http.routers.api-read.entrypoints=api-read"
  - "traefik.http.routers.api-read.rule=Method(`GET`) && PathPrefix(`/api`)"
  - "traefik.http.routers.api-read.service=api@internal"
  - "traefik.http.routers.api-read.middlewares=api-read-auth"
  - "traefik.http.middlewares.api-read-auth.basicauth.users=dnz:<bcrypt hash>"

# traefik.yml: Traefik's API (read-only) on port 8080.
api:
  insecure: true

--api.insecure=true

sudo ufw allow from 10.0.0.2 to any port 8080 proto tcp
sudo ufw deny 8080/tcp

Which hostnames get records

• Host, HostHeader and HostSNI, several per rule (joined with || or listed in one matcher)
• HostRegexp when it is one label of anything in front of a fixed domain (^[a-z0-9-]+\.apps\.example\.com$ becomes *.apps.example.com)
• left out: routers named dnz-…, Traefik’s internal ones, disabled ones, negated !Host(…) and rules without a usable name

• hostnames outside the division’s zones, or in a secondary zone
• IP addresses, localhost and names under .localhost
• placeholders Caddy didn’t fill in ({$SITE}), and wildcards anywhere but in front
• a site at a zone’s apex when the proxy answers with a CNAME (the apex can’t hold one)

What DNZ never changes

• A name that already has records made by hand (A, AAAA, CNAME or ALIAS; with a CNAME, any record) is taken: DNZ leaves it alone and lists it with the reason. Delete the hand-made record to let the proxy take over.
• A name another proxy keeps (another read-only proxy, or a Traefik proxy’s records from its own routers) is taken too. The first one to add it keeps it.
• A record you edit by hand (in the record form, or restored from history) becomes yours: the proxy stops changing or removing it, and the name shows as taken. Turning it off, tagging it or changing its TTL in bulk keeps the mark.

When its configuration changes

• A new site gets its records.
• When the proxy’s addresses, CNAME target, TTL or Records setting change in DNZ, its records change with them.
• A site that left the configuration loses its records. With Keep them (flagged) (add only), they stay and are listed as kept instead.

Preview, then sync

• Sync now shows the preview again before it writes anything.
• Pause stops reading and leaves the records as they are. Resume previews first, then starts syncing again.
• Remove, with its records deletes the proxy and the records it added.
• Remove, keep its records deletes the proxy and leaves its records as records made by hand. Records that went Through DNZ then answer with their own value.

From the terminal and the API

dnz proxy sites check --api http://10.0.0.5:2020 --user dnz --password   # read it, save nothing
dnz proxy add edge-1 --kind caddy --read-only --api http://10.0.0.5:2020 --user dnz --password --address 203.0.113.5,2001:db8::5
dnz proxy sites ls
dnz proxy sites sync edge-1

Upgrading from v1

• Every Caddy and Traefik of Sites in DNS becomes a read-only proxy with the same settings (API, user and password, addresses or CNAME, TTL, read interval, add only, paused, division) and the same records, still marked as its own. Its records are DNS only, as before.
• It keeps its name. When a proxy already has that name, it becomes <name>-sites (and <name>-sites-<id> if that is taken too).
• Records lose the caddy_id, origin_port and origin_https fields (the last two were unused since routes came).
• dnz caddy is now dnz proxy sites; dnz caddy … only says which command to use instead.
• The API moved from /api/divisions/{id}/caddies and /api/caddies/{id} to /api/proxy-sites and /api/proxies/{id}/sites.
• The metrics are dnz_proxy_sites_sync_success and dnz_proxy_sites_sync_timestamp_seconds. The old dnz_caddy_sync_* names are kept for one release: move dashboards and alerts to the new ones.