Setting Up PowerDNS with Power

Configuration

After installing the components, their final configuration is required, especially for Nginx, so that it correctly serves Poweradmin, and to set up TLS/HTTPS.

1. Nginx Configuration for Poweradmin

Create a new Nginx configuration file for Poweradmin. Delete the default Nginx config if it exists, or simply create a new one.

sudo nano /etc/nginx/sites-available/poweradmin.conf # Creates a new Nginx configuration file

Insert the following content:

# /etc/nginx/sites-available/poweradmin.conf
server {
    listen 80;
    server_name your_poweradmin_domain.com ВАШ_IP_АДРЕС_VPS; # Replace with your domain or IP
    root /var/www/html;
    index index.php index.html index.htm;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock; # Ensure this matches your PHP-FPM version
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~ /\.ht {
        deny all;
    }
}

Create a symbolic link to this file in sites-enabled and check the Nginx configuration:

sudo ln -s /etc/nginx/sites-available/poweradmin.conf /etc/nginx/sites-enabled/ # Creates a symbolic link
sudo nginx -t # Checks Nginx configuration syntax

If the test is successful, restart Nginx:

sudo systemctl restart nginx # Restarts Nginx

Now you can access Poweradmin via your VPS's IP address or domain name, if you have already configured it (e.g., http://poweradmin.yourdomain.com).

2. TLS/HTTPS Setup via Certbot (Let's Encrypt)

It is crucial to secure the Poweradmin web interface with HTTPS. We will use Certbot to obtain free SSL/TLS certificates from Let's Encrypt.

sudo apt install certbot python3-certbot-nginx -y # Installs Certbot and the Nginx plugin

Run Certbot. It will automatically detect your domain (specified in Nginx server_name) and configure Nginx.

sudo certbot --nginx -d your_poweradmin_domain.com # Obtains and installs a certificate for your domain

Follow the Certbot instructions: enter an email address, agree to the terms. Certbot will offer to redirect HTTP traffic to HTTPS, which is recommended.

Check automatic certificate renewal:

sudo certbot renew --dry-run # Checks the possibility of renewing certificates without actual renewal

If successful, your Poweradmin is now accessible via HTTPS.

3. PowerDNS Operability Check

After all configurations, let's ensure that PowerDNS is working correctly and responding to queries.

sudo systemctl status pdns # Ensure PowerDNS is running

Use the dig utility to check DNS queries. First, add a test zone via Poweradmin. For example, create a zone test.com with an A-record for www.test.com pointing to the IP address 192.0.2.1.

dig @ВАШ_IP_АДРЕС_VPS www.test.com A # Sends a DNS query to your PowerDNS server

In the response, you should see the IP address 192.0.2.1. If PowerDNS responds, it means it is working correctly.

Check that Poweradmin is accessible via HTTPS:

curl -v https://your_poweradmin_domain.com # Checks Poweradmin's HTTPS accessibility and displays certificate information

You should see a successful connection and SSL certificate details.

4. Poweradmin Secret Configuration

In Poweradmin's config.inc.php file, there is a variable $session_key. It is used for session encryption. Generate a random string and place it there. Never leave the default value.

head /dev/urandom | tr -dc A-Za-z0-9_ | head -c 32 ; echo # Generates a random 32-character string

Edit config.inc.php:

sudo nano /var/www/html/config.inc.php

And insert the generated string:

// config.inc.php (fragment)
$session_key = 'ВАША_СЛУЧАЙНАЯ_32_СИМВОЛЬНАЯ_СТРОКА';

Backups and Maintenance

Regular backups and timely maintenance are critically important for any production server, including DNS. Loss of DNS records can lead to the unavailability of all your services.

What to Back Up

1. PowerDNS Database (MariaDB): This is the most important component, containing all your domain zones and records.
2. PowerDNS Configuration Files: /etc/powerdns/pdns.conf and any other custom configs.
3. Nginx Configuration Files: /etc/nginx/sites-available/poweradmin.conf, /etc/nginx/nginx.conf.
4. Poweradmin Configuration Files: /var/www/html/config.inc.php.
5. Let's Encrypt Certificates: Although they can be reissued, keeping a backup will speed up recovery. They are stored in /etc/letsencrypt/.

Simple Auto-Backup Script

Let's create a simple script for daily backups of the database and key configuration files. We will use mysqldump for the database and tar for the files. An external S3-compatible service can be used for storage.

sudo mkdir -p /opt/backup/pdns # Create backup directory
sudo nano /opt/backup/pdns/backup_pdns.sh # Create backup script

Contents of /opt/backup/pdns/backup_pdns.sh:

#!/bin/bash

# Database settings
DB_USER="pdns_user"
DB_PASS="YOUR_STRONG_PASSWORD" # Use an env variable or .my.cnf file for production
DB_NAME="powerdns"

# Backup directory
BACKUP_DIR="/opt/backup/pdns"
DATE=$(date +%Y%m%d%H%M%S)

# Create database dump
echo "Dumping MariaDB database..."
mysqldump -u "$DB_USER" -p"$DB_PASS" "$DB_NAME" > "$BACKUP_DIR/powerdns_db_$DATE.sql"
if [ $? -eq 0 ]; then
    echo "Database dump created successfully: $BACKUP_DIR/powerdns_db_$DATE.sql"
else
    echo "Error creating database dump."
    exit 1
fi

# Archive configuration files
echo "Archiving configuration files..."
tar -czvf "$BACKUP_DIR/pdns_configs_$DATE.tar.gz" \
    /etc/powerdns/pdns.conf \
    /etc/nginx/sites-available/poweradmin.conf \
    /etc/nginx/nginx.conf \
    /var/www/html/config.inc.php \
    /etc/letsencrypt/live/your_poweradmin_domain.com/ # Specify your domain
if [ $? -eq 0 ]; then
    echo "Configuration files archived successfully: $BACKUP_DIR/pdns_configs_$DATE.tar.gz"
else
    echo "Error archiving configuration files."
    exit 1
fi

# Delete old backups (keep for 7 days)
echo "Cleaning up old backups..."
find "$BACKUP_DIR" -type f -name "*.sql" -mtime +7 -delete
find "$BACKUP_DIR" -type f -name "*.tar.gz" -mtime +7 -delete
echo "Backup process completed."

Replace YOUR_STRONG_PASSWORD and your_poweradmin_domain.com with actual values. Set execution permissions:

sudo chmod +x /opt/backup/pdns/backup_pdns.sh # Makes the script executable

Add the script to cron for daily execution (e.g., at 3 AM):

sudo crontab -e # Opens crontab for editing

Add the following line to the end of the file:

0 3 * * * /opt/backup/pdns/backup_pdns.sh >> /var/log/pdns_backup.log 2>&1

This will run the script every day at 03:00 and record the output to a log file.

Where to Store

Never store backups on the same server! If the server fails, you will lose both data and backups. Recommended storage locations:

• External S3-compatible object storage: AWS S3, DigitalOcean Spaces, Backblaze B2, Yandex Object Storage. This is a reliable and scalable solution. Utilities like s3cmd or rclone can be used for automatic uploads.
• Separate VPS: An inexpensive VPS in a different location, used exclusively for storing backups. Synchronization can be done via rsync or scp.
• Local NAS/server: If you have your own infrastructure.

Updates: rolling vs maintenance window

Software updates are an important part of maintenance. For a DNS server, which must be maximally available, this is especially relevant.

• Rolling updates: If you have two (or more) DNS servers (primary and secondary NS) configured in different locations, you can update them one by one. Update one server, ensure it's working correctly, then update the next. This ensures continuous availability.
• Maintenance window: If you only have one DNS server, or you want to minimize risks, plan updates for periods of low load (e.g., late at night). Be sure to warn users about possible short-term service interruptions.

Always back up before updating and test updates on a test server, if possible. To update the system and packages, use:

sudo apt update && sudo apt upgrade -y # Update all packages

After major kernel or system library updates, a server reboot may be required:

sudo reboot # Reboot server

Troubleshooting + FAQ

This section collects common problems and answers to frequently asked questions that may arise when setting up and operating PowerDNS with Poweradmin.

PowerDNS is not starting or not responding to queries. What to do?

First, check the status of the PowerDNS service: sudo systemctl status pdns. If it's not running or shows errors, check the logs: sudo journalctl -u pdns --since "5 minutes ago". Common causes include: incorrect configuration in /etc/powerdns/pdns.conf (errors in gmysql-host, gmysql-user, gmysql-password), issues with connecting to MariaDB, or port conflicts. Ensure that MariaDB is running and accessible, and that the user pdns_user has the correct password and privileges for the powerdns database. Check local-address, if specified, to ensure it is your server's IP address.

Poweradmin is not loading or returns a 500/404 error.

Check Nginx configuration: sudo nginx -t and restart it: sudo systemctl restart nginx. Ensure that Nginx is listening on port 80/443 and that the root directory (/var/www/html) and fastcgi_pass for PHP-FPM (unix:/run/php/php8.3-fpm.sock) are correctly configured. Check Nginx logs (/var/log/nginx/error.log) and PHP-FPM logs (/var/log/php8.3-fpm.log). 500 errors often indicate PHP issues, such as incorrect database settings in /var/www/html/config.inc.php or missing PHP modules (php8.3-mysql).

DNS records added via Poweradmin are not resolving.

Ensure that you have correctly configured NS records for your domain with your domain name registrar, pointing to your VPS's IP address. After changing NS records, it may take up to 48 hours for changes to fully propagate across the internet (DNS propagation). Verify that the zone is added in Poweradmin and contains correct records (SOA, NS, A, AAAA, etc.). Use dig @YOUR_VPS_IP_ADDRESS example.com to directly check your DNS server.

What is the minimum VPS configuration suitable for PowerDNS?

For a small number of domains and moderate load, a minimum VPS with 1 vCPU, 1 GB RAM, and 20-30 GB SSD will be sufficient. PowerDNS is very efficient. However, for greater stability, performance headroom, and the ability to run other small services on the same VPS, 2 vCPU, 2 GB RAM, and 50 GB SSD are recommended. An SSD is key for good database performance.

What to choose — VPS or dedicated for this task?

For most users, including developers, solo founders, and small businesses, a VPS is the optimal choice due to its cost-effectiveness, flexibility, and sufficient performance. Dedicated servers are only justified for very high loads (hundreds of thousands of queries per second), strict resource isolation requirements, or the need for specific hardware. Start with a VPS, and if the load grows to a critical level, you can always migrate to a dedicated server.

What other security measures can be taken?

In addition to SSH keys, Fail2ban, and UFW, consider the following steps: regular system updates, using strong and unique passwords, restricting MariaDB access to localhost only, regular log auditing, using two-factor authentication for Poweradmin (if available via third-party modules or workarounds), and setting up a secondary DNS server (secondary NS) in a different location for fault tolerance and DDoS protection.

How does SOA serial work and why is it important?

The SOA (Start of Authority) record contains important information about a zone, including the serial number. The serial number is a number that increments with each change to the zone. Secondary DNS servers use this number to determine if they need to request zone updates (AXFR/IXFR) from the primary server. If the serial number on the primary server is higher than on the secondary, the secondary server initiates a zone transfer. Poweradmin automatically increments the serial number with each record change, ensuring correct synchronization.

Conclusions and Next Steps

Congratulations! You have successfully set up and launched your own authoritative DNS server with PowerDNS and the Poweradmin web interface on your VPS. You now have full control over your domain names, can quickly make changes, and ensure reliable DNS resolution for your projects. This is a powerful tool that provides independence and flexibility.

Here are a few next steps you can take to further develop your DNS infrastructure:

1. Setting up a secondary DNS server: For maximum fault tolerance and performance, deploy a second PowerDNS server on another VPS (preferably in a different geographical location and with a different provider) and configure it as a secondary (slave) NS server.
2. Monitoring: Implement a monitoring system (e.g., Prometheus, Zabbix, Grafana) to track the status of PowerDNS, MariaDB, Nginx, and overall server load.
3. Performance optimization: For very high loads, explore PowerDNS caching capabilities, MariaDB query optimization, and fine-tuning of Nginx/PHP-FPM.