[Feature] Wildcard support for split DNS configuration

[lgrn]

Use case

There is a split attribute in config-example.yaml that allows you to configure "a map of domains and which DNS server to use for each". In cases of a split VPN scenario, where Headscale is only used to access "internal" resources but not the rest of the Internet, it seems likely that one would want to configure entire domains or subdomains rather than explicit domain names to be passed to a separate DNS.

Description

Functionality today:

  nameservers:
    global:
      - 1.1.1.1
      - 1.0.0.1

    split:
      foo.internal.domain:
        - 10.10.10.10
      bar.internal.domain:
        - 10.10.10.10

Feature request:

  nameservers:
    global:
      - 1.1.1.1
      - 1.0.0.1

    split:
      *.internal.domain:
        - 10.10.10.10

If starting an attribute with * causes yaml or other syntax issues, perhaps the syntax .internal.domain or similar could be considered instead.

Contribution

• I can write the design doc for this feature
• I can contribute this feature

How can it be implemented?

No response

[Nathanael-Mtd]

You can just set internal.domain to your specified DNS server, every request to that domain or subdomain will be handeled by the specified server.

For example:

  nameservers:
    global:
      - 1.1.1.1
      - 1.0.0.1

    split:
      internal.domain:
        - 10.10.10.10

[lgrn]

That's great, if that already works then I'll just suggest that it's maybe clarified in the comments in config-example.yamland/or the docs (most of the attribute documentation seems to be in the config example itself).

If I understand the behavior correctly then adding foo.bar.com would also mean that sub.foo.bar.com triggers the same DNS rule which may be unexpected, so maybe that should be documented as well.

[Nathanael-Mtd]

Yeah, DNS docs seems outdated.

It's not really unexpected, that's how DNS servers works.

Every requests you send with a specified suffix (zone is the right word) will be sent to the specified DNS server.
If the specified DNS server got the entry in his zone, it will return the answer, if not (depends of the DNS server config) it will check recursively the authoritative DNS server for the zone and get DNS entry and return that to you.

[lgrn]

Yeah, I guess the comment does kind of already explain it since it says that it's a "map of domains" and not a map of hostnames. Anyway, thanks for the quick feedback.