Sign inSign up

kronos443/aws-route53-ddns

By kronos443

Updated about 3 years ago

AWS Route53 DDNS client for multiple/wildcard domains (rev. proxy), docker secrets & health webhooks

Image
1

2.3K

kronos443/aws-route53-ddns repository overview

Amazon AWS Route53 Dynamic DNS Client

Key features:
  • Supports multiple domains simultaneously to the same entry point
  • Supports specific URL's as well as wild cards. e.g. home.example1.com and *.example2.com
  • Wild card domain mapping supports the use of reverse proxy servers to access internal services
  • Multiple methods (4) are supported for specifying the AWS credentials for ease of use. See Providing the AWS Credentials below.
  • Up to 10 web hooks to monitor correct function and errors. Ideal for use with monitors such as Uptime Kuma.
Developed using Python and Amazon's BOTO3 library this container will update one or more A records in multiple hosted zones with the locally detected external IP address.

Please see:

Supported Architectures

Currently supports AMD64 (developed on windows and the Synology DS918+ NAS), ARM32 V7 (armhf) (suitable for running on docker under Raspberry PI 32-bit OS) & ARM64 (ARM64V8) (suitable for running on docker under Raspberry PI with a 64-bit OS such as Raspberry PI OS 64-bit and Ubuntu 64-bit)

ArchitectureTag
AMD64latest-amd64 For PC and Synology DSM
ARM32V7 (armhf 32-bit)latest-arm32v7 For Raspberry PI with a 32-bit OS
ARM64V8 (ARM64)arm64v8-latest. For Raspberry PI with a 64-bit OS (RaspberryPI OS 64-bit or Ubuntu 64-bit
Going forward I'll be focusing on 64-bit containers for security reasons.

History

See the app readme.md information at GitHub
DateVersionNotes
27/06/20232.2.1.0
  1. Added support for 10 optional web hooks in the configuration file.
  2. Re-based image to the Python-Alpine image to halve the size of the image.
  3. Bug fixes including catching errors from AWS service outages.
Please note, a configuration issue resulting in any domain record having an issue updating will cause the docker container to be be marked as unhealthy. Be mindful of this if your system is set to restart a container that marks itself as unhealthy since the solution may be to check the log and find any logical issues in the AWS configuration which might have caused this state rather than just restarting the container.
15/10/20222.1.0.0
  1. Added support for multiple methods (four ways) of specifying the AWS credentials, either via environment variables, the configuration file, docker secrets or the AWS credentials file for convienience.
03/06/20222.0.0.3
  1. Fixed potential crash on connectivity issue when obtailing the external IP address
  2. Added try catch to reading the config file
  3. Improved the docker health check to account for the update duration information
  4. Added Webhooks for alerting on errors updating and for healthy update
8/7/212.0.0.2
  1. Added support for docker health checking
  2. Note, a failure to go round the main program loop or a configuration issue resulting in an issue updating a domain record will prevent the health check file from being "touched". Be mindful of this if your system is set to restart a conatiner that marks itself as unhealthy as the solution may be to check the log to find a logical issue in the AWS configuration which caused the condition rather than just restarting it.
  3. Added Config parameters Sleep_Time_Initial_Autherisation and Sleep_Time_Inter_Domain to control the hit rate on AWS
  4. Changes to support re-reading a config file if it's edited while the container is running. This removes the need to re-start the container if the configuration is changed. This is intended to harden the system and lower maintainance.

PLEASE NOTE

The current Raspberry PI 32-bit OS based on Buster has a bug in the libseccomp library.

Please see this note: https://docs.linuxserver.io/faq#libseccomp

If you wish to use the ARM32V7 image on a 32-bit Raspberry PI OS you have 2 options:

  1. Run the container as privelidged (Not generally recommended)
  2. Follow the link above to the Linuxserver team's documents and follow option 2 (My personal preference, although I haven't tested the other option.) to update your docker host Raspberry PI

This should instantly fix this, and any other "funnies" you are having with docker containers.

Preparation and Application Setup

The following steps should be taken when setting up this container:

Prepair an AWS key
  1. Get an AWS IAM key pair
  2. Enable permissions to access Route53 (and only Route53) for the key
Setup the AWS Route53 Zones and Records
  1. Have a functional hosted zone for your domain
  2. If you want one specific URL to point to your IP set up a single A-Record such as home.yourdomain.com
  3. If you want to use reverse proxy to have a number of sub-domain URLs pointing to a number of resources on your IP set up address then set up your records as listed below.
Setup the container
  1. Create the configuration directory on the mapped docker share directory.
  2. Create the .ini file with the nessesary information in the mapped docker share directory.
  3. Add the container to your system and start.

The Configuration File

A text file named AWS_Route53_DDNS.ini should be created in the /config mapped directory. This sets all the options for the program.
The log file is created in the same directory with the name AWS_Route53_DDNS.log and this file will rotate when it reaches 100KB with up to 5 logs named AWS_Route53_DDNS.log.1, AWS_Route53_DDNS.log.2 etc.

Example Configuration File
[Domains]
yourdomain.com = home.yourdomain.com
yourdomain.eu = yourdomain.eu
yourdomain.click = yourdomain.click

[Credentials] ; See notes below on the four methods of providing credentials ;AWS_Access_Key_ID = AAAAAAAAAAAAAAAAAAAAAA ;AWS_Secret_Access_Key = BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB ;AWS_Credential_Profile = route53_user ; [Defaults] Update_Interval = 3600 Exception_Interval = 300 ; Log_Level options are: Debug Info Warning Error Critical Log_Level_Logfile = Info Log_Level_Console = Warning TTL = 3211 Sleep_Time_Initial_Authorisation = 1 Sleep_Time_Inter_Domain = 1 WebHook_Alive = 'HTTP://x.x.x.x/aaaaaaaaa' WebHook_Alive1 = 'HTTP://x.x.x.x/aaaaaaaaa' WebHook_Alive2 = 'HTTP://x.x.x.x/aaaaaaaaa' WebHook_Alert = 'HTTP://x.x.x.x/aaaaaaaaa' WebHook_Alert1 = 'HTTP://x.x.x.x/aaaaaaaaa'

Please note, a configuration issue resulting in any domain record having an issue updating will cause the docker container to be be marked as unhealthy. Be mindful of this if your system is set to restart a container that marks itself as unhealthy since the solution may be to check the log and find any logical issues in the AWS configuration which might have caused this state rather than just restarting the container.

The Configuration File Parameters

The parameters for the configuration file are as follows.

ParameterStatusDefaultFunction
[Domains] SectionRequiredAny (resonable) number of lines can be included here.
Hosted zone nameThe text name of the hosted zone (also called the domain name) without the trailing dot '.' that is often used to demark them.
Record nameThis is the value for the corrosponding hosted zone (domain) name. See below for options on this.
[Defaults] SectionOptional
Update_IntervalOptional3600The interval between checking the external IP to see if the address has changed.
Exception_IntervalOptionalUpdate_Interval valueThe checking interval after an error in obtaining the external IP or in obtailing the AWS hosted domain connection. You may wish to set this value lower than the usual update interval to resume correct mapping after a disruption to the IP address.
Log_Level_LogfileOptionalWarningSets the detail and level for the file stored in the /config mapping
Log_Level_ConsoleOptionalErrorSets the detail and level for the console (docker log)
Logging levels options are :- Critical Error Warning Info Debug
TTLOptional3600The time-to-live value for your entries in seconds. 1-2 hours is usual, less than 5 minutes is not recomended. Values below 60 are ignored and set to 60 seconds.
Sleep_Time_Initial_AuthorisationOptional1The time to pause before first domain changes after start up. Not normally required
Sleep_Time_Inter_Domain Optional1The time to pause between consecutive domain interrogations. Not normally required
WebHook_Alive
WebHook_Alive1
WebHook_Alive2
.
WebHook_Alive9
Optional-Each given entry is called when the update of all records was successful. There can be up to 10 entries, starting with WebHook_Alive, then WebHook_Alive1 and so on until WebHook_Alive9. Entries need not be contiguous and so can be commented out as required.
WebHook_Alert
WebHook_Alert1
WebHook_Alert2
.
WebHook_Alert9
Optional-Each given entry is called when the update of any record was unsuccessful. There can be up to 10 entries, starting with WebHook_Alert, then WebHook_Alert1 and so on until WebHook_Alert9. Entries need not be contiguous and so can be commented out as required.
[Credentials]Optional-Only required as below.
AWS_Access_Key_ID
AWS_Secret_Access_Key
Optional-The second option for providing AWS credentials. (See below)
AWS_Credential_ProfileOptional-Use only when using the AWS credentials file option for providing AWS credentials.

The example file above shows two main options for configuring an address. The first updates a specific A record in the hosted domain so that home.yourdomain.com is given the external IP address. This is the most simple case and you must create an A-Record with the name home.yourdomain.com in AWS before it can be updated.

The second and third lines show a more flexible option that would allow you to create multiple sub-domain mappings to resources within your network using reverse proxy. To make this work you must create an A-Record within you hosted zone (domain) called yourdomain.click and then a second A-Record called *.yourdomain.click that has a value of yourdomain.click. This will cause any DNS request for sub-domains of this address such as voip.yourdomain.click or sonarr.yourdomain.click to be mapped through to the IP address set up in the yourdomain.click A-Record.

Providing the AWS Credentials

The AWS authorisation credentials can be provided in one of 4 methods.

  1. Add them to the AWS_Route53_DDNS.ini file using the AWS_Access_Key_ID and AWS_Secret_Access_Key options
  2. This method is the easiest to get started. It does mean the credentials could be exposed through backups or to users who have access to change the setup however.

  3. Add them to the container when the container is created, usually through docker compose, using the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables
  4. This is also quick and easy but has the draw back that anyone with access to the docker system via a management tool such as Portainer can access the credentials.

  5. Use docker secrets using the AWS_ACCESS_KEY_ID_FILE and AWS_SECRET_ACCESS_KEY_FILE environment variables
  6. This is the most secure method of providing credentials.

  7. Use a credentials file in the standard AWS format placed in the directory mapped to /config
  8. This method is ideal if you want to have a single file with multiple credentials that is shared between multiple applications such as S3 or SES services. Use the AWS_Credential_Profile to target the correct profile.

Note In line with the principles of docker secrets the contents of the files should be just the string that forms the key or secret. The app will perform minor cleaning of the contents to remove white space and superfluous returns/line feeds however.

Usage

Create you container locally by either:

Docker CLI
docker run -d \
        --name AWS_Route53_DDNS \
        -v /path/to/config:/config \
        -e AWS_ACCESS_KEY_ID=your-access-ID \
        -e AWS_SECRET_ACCESS_KEY=your-key-secret \
        -e TZ=Europe/London  \
        --restart unless-stopped 
        kronos443/aws-route53-ddns
docker run -d \
        --name AWS_Route53_DDNS \
        -v /path/to/config:/config \
        -e AWS_ACCESS_KEY_ID_FILE=/run/secrets/aws-access-key-id \
        -e AWS_SECRET_ACCESS_KEY_FILE=/run/secrets/aws-secret-access-key \
        -e TZ=Europe/London  \
        --restart unless-stopped 
        kronos443/aws-route53-ddns
Docker Compose
Options 1 & 4
---
version: "2.1"
services:
  aws-route53-ddns:
    image: kronos443/aws-route53-ddns:amd64-latest
    container_name: AWS_Route53_DDNS
    environment:
      - TZ=Europe/London
    volumes:
      - /path/to/config:/config
    restart: unless-stopped
Option 2
---
version: "2.1"
services:
  aws-route53-ddns:
    image: kronos443/aws-route53-ddns:amd64-latest
    container_name: AWS_Route53_DDNS
    environment:
      - TZ=Europe/London
      - AWS_ACCESS_KEY_ID=your-access-ID
      - AWS_SECRET_ACCESS_KEY=your-key-secret
    volumes:
      - /path/to/config:/config
    restart: unless-stopped
Option 3
---
version: "2.1"
services:
  aws-route53-ddns:
    image: kronos443/aws-route53-ddns:amd64-latest
    container_name: AWS_Route53_DDNS
    environment:
      - TZ=Europe/London
      - AWS_ACCESS_KEY_ID_FILE=/run/secrets/your-access-id-file
      - AWS_SECRET_ACCESS_KEY_FILE=/run/secrets/your-key-secret-file
    volumes:
      - /path/to/config:/config
    restart: unless-stopped
Synology NAS

To run the container on a Synology NAS:

  1. Open File Station and create a new directory to act as the /config volume. E.g. /docker/AWS_Route53_DDNS.
  2. Put your customised AWS_Route53_DDNS.ini file in this directory.
  3. Use the GUI on the desktop to search the registry for kronos443.
  4. Download the image from the registry by double clicking it.
  5. On the image tab, double click the newly downloaded image to start configuring it.
  6. On the Gerneral Settings window, name the image and if you want eneable resource limitation.
  7. Click advanced settings
  8. On the Advanced Settings window under the Advanced Settings tab enable auto-restart
  9. On the volume tab add folder and map your new docker/AWS_Route53_DDNS directory to /config
  10. On the netwrok tab select 'Use same network as Docker Host'
  11. On the Environment tab add the environment variables
  12. Click apply, then Next and on the Summary window Apply

Parameters

The parameters are described below.

ParameterFunction
-v /path/to/config:/configThe directory on your host that is shared with the container. Place your AWS_Route53_DDNS.ini file here. Log files will also be written here.
-e AWS_ACCESS_KEY_ID=your-access-IDThe access key string generated by you on AWS IAM
-e AWS_SECRET_ACCESS_KEY=your-key-secretThe secret code for the ID, generated by you on AWS IAM
-e AWS_ACCESS_KEY_ID_FILE=/run/secrets/your-access-id-fileThe docker secrets file containing access key string generated by you on AWS IAM
-e AWS_SECRET_ACCESS_KEY_FILE=/run/secrets/your-key-secret-fileThe docker secrets file containing the secret code for the ID, generated by you on AWS IAM
TZ=Europe/LondonTime zone, e.g. Europe/London optional but means the log times will be in the local timezone rather than UT

If you find this container useful then please consider buying me a coffee by following this link or scanning the QR below. :)

Please consider donating

Tag summary

Content type

Image

Digest

sha256:32f3848a2

Size

34.6 MB

Last updated

about 3 years ago

docker pull kronos443/aws-route53-ddns