Cloud Services DNS - openmrs/openmrs-contrib-itsmresources GitHub Wiki

Our DNS is hosted by CloudFlare, previously DNS Made Easy and before that FastMail.

We also internally host an DNS service at acme.openmrs.org used for DNS-01 challenges.

OCL uses GoDaddy, an account controlled by Jonathan and Rafał.

DNS provides a name service for associating information with domain names, primarily mappings between domain names (e.g., openmrs.org) and the servers that host that service. DNS is also used for various service records, especially records important to email like SPF and DMARC records.

We host acme.openmrs.org to respond to DNS-01 challenges for ACME certificates. Normally, ACME certificates are provided using HTTP-01 challenges, where the certificate signer makes a request for a file that must contain a known secret via HTTP. This file is loaded from the domain name being claimed and being able to serve the file proves control over the web server at that domain. However, for servers where we run CloudFlare's "orange cloud" proxy in front of the service, we are no longer able to use HTTP-01 requests for ACME challenges, as CloudFlare only responds on HTTPS. Instead we use the DNS-01 challenge, which works by publishing the same secret over DNS instead of a file served from the webserver. For this purpose, we host our own light-weight DNS server that only responds to DNS-01 challenges. This server owns the acme.openmrs.org and all _acme-challenge subdomain requests are delegated to this server. Servers we host inside Jetstream communicate to this server over the Jetstream internal network and only the necessary DNS records are published externally.

Credentials for CloudFlare are in OP.

DNS entries should be managed through Terraform. For entries not associated with a specific Terraform stack, use the manual-dns stack.

To configure a server using ACME DNS, see the Cloud SSL Certs guide.

DNS records are created using Terraform. For most servers, e.g. webservers, this should be as simple as ensuring that whatever hosts the server provides are defined in the dns_cnames variable. These are then transformed into the appropriate records and uploaded to our CloudFlare instance. For non-CNAME records, it's preferable to create the necessary resources in the appropriate stack. For records that are not directly related to any specific server, e.g., because they are general or our used simply to redirect users to a cloud service, the entries can be created through the manual-dns stack which defines things at the domain level.