
## The problem

After recently setting up this blog at Cloudflare Pages, I was having trouble reaching it internally as I had setup a split horizon DNS. The external zone had moved to Cloudflare a few years ago, which was fine as the domain was mostly handling email and I didn't have any external websites.

I like being able to use the internal DNS view to have internal services, but since the page is hosted in CF Pages there is no IP address I can put into DNS. Fortunately I learned that they provide CNAME records for all hostnames, which are automatically updated by the Cloudflare network. 

## CNAMEs for everyone
To use this, append your actual hostname with `.cdn.cloudflare.net`, so in my case, it is `www.vsnine.org.cdn.cloudflare.net`. Their edge will route the traffic as long as the host header the client is using matches what's set in DNS.

That's nice, but what about `vsnine.org`? An issue I face here is that you can't use a CNAME record as the target of a DNS zone's origin or apex record. I could have tried to manually add the same Cloudflare IPs to my private DNS, but there is the chance the IPs could change sometime down the road, and that could get annoying.

This ISC blog goes into more details and was quite useful: [ISC Blog: CNAME at the apex of a zone](https://www.isc.org/blogs/cname-at-the-apex-of-a-zone/) It lists a number of potential options and weighs the pros and cons. It describes how RFC1034 states that a CNAME record cannot be shared by any other types, so while a CNAME apex could technically work, it likely won't work well, or have undesired results. 

In my case, I'll be using alternative #4: the ALIAS record type.

## So what next?
My internal DNS service is provided by a PowerDNS server, which I found does support use of the ALIAS record type pointed to a CNAME. More info on this is available in the docs here: [PowerDNS: Using ALIAS records](https://doc.powerdns.com/authoritative/guides/alias.html)

Some other products and providers support CNAME flattening, you will need to check the docs for support. Notably, BIND does not support dynamically setting an ALIAS record, so other methods would be needed, which I mention later..

## Let's fix it!
Simply put, PowerDNS needs the `expand-alias` flag set to yes, and the field `resolver` set to use some DNS server to be able to transform the CNAME into an A record response. As the note in the PowerDNS guide says, if the resolver isn't specified, this feature won't work. Also I imagine it would begin to fail if that resolver became unavailable.

To implement this fix, I edited `/etc/powerdns/pdns.conf`, and found the two options commented out and waiting. In my case I used the local piHole server for the resolve target. 

Next, I restarted the service by running `systemctl restart pdns`, and was able to add the record in the web UI.

`vsnine.org. ALIAS vsnine.org.cdn.cloudflare.net.` 

And then ran some tests. I was happy to see positive results. (Don't forget the trailing dot!)

![PowerDNS Admin utility showing ALIAS and CNAME records](pdns1/pdns1a.png)

## The results
So here is the internal response for www.vsnine.org via `dig`, which shows the CNAME:
```
;; QUESTION SECTION:
;www.vsnine.org.                        IN      A

;; ANSWER SECTION:
www.vsnine.org.         3600    IN      CNAME   www.vsnine.org.cdn.cloudflare.net.
```

And now the internal response for vsnine.org, which is an ALIAS type. You can see that pdns automatically solved the answer for the CNAME and instead returns the data as an A record.
```
;; QUESTION SECTION:
;vsnine.org.                    IN      A

;; ANSWER SECTION:
vsnine.org.             300     IN      A       172.67.171.164
vsnine.org.             300     IN      A       104.21.55.155
```

## Epilogue

What if you're not using PowerDNS? What options are out there? 

So far my searches haven't been especially fruitful. But for systems like BIND, using nsupdate is an option if you're willing to wrap a little bit of scripting around it. This example from [Reddit /r/usefulscripts](https://www.reddit.com/r/usefulscripts/comments/6saiq0/request_dynamically_update_a_record_in_bind_dns/dlbo0ci?utm_source=share&utm_medium=web2x&context=3) by lbiegaj seems like it would be a decent starting point, with some logic and a cronjob added on.

```
echo "server 127.0.0.1
zone mydomain.eu.
update delete $HOSTNAME.mydomain.eu. A
update add $HOSTNAME.mydomain.eu. 3600 A $IP
send" | nsupdate -d -k $KEYFILE
```


Leverage Cloudflare and PowerDNS inside the lab.

DNS Problems


## Some thoughts

Thought I'd write down a few notes of the highlights of attending F5's conference, Agility, which is now in its second virtual year due to COVID-19.

I attended a few years ago when it was in Chicago, which was a cool experience to meet a bunch of F5ers in person. This time the interactions are a little more limited to the session chat rooms, lab working sessions, and the daily hangouts with the DevCentral team of Jason, John, and Peter.

They have a ton to bring to the table with their acquisitions of NGINX, Shape, and Volterra. There has been a mix of live streams, pre-recorded demos, and lab sessions.

## Wanna go FASTer?
My highlight of the con so far has been getting my hands on a live lab demo of the [vscode-f5](https://f5devcentral.github.io/vscode-f5) plugin, which will help administrators who want to deploy their F5 configuration as code! 

It is hosted on the f5devcentral github and is a free extension to Visual Studio Code. It will work in the remote versions of VSCode over SSH, as well as in the web-based `code-server` deployment.

I had looked at an early version last year, but couldn't use it at the time. Coming back to it after the team at F5 has put in a ton of work was a nice surprise. Today, the module has support for managing F5's various extension plugins, which include:

* Application Services 3 (AS3) - deploy your apps
* Declarative Onboarding (DO) - configure your box
* Telemetry Streaming (TS) - see what your box and apps are doing

And, new to me: FAST, or F5 Application Services Templates. This is a templating engine that lives on the BIG-IP, and seems much like the predecessor iApps (at least in spirit). It uses simplified templates which turn into AS3 declarations, which in turn will do the heavy lifting on the BIG-IP side.

Other addons are a config explorer which can use your UCS or QKView archives to provide easy insight into the config, either over time or based on current data.

This leads to the next item...

## Speaking a new language

A big surprise while working through the lab was being introduced to AS3 Config Converter (ACC) ([github](https://github.com/f5devcentral/f5-as3-config-converter)), announced just a few days ago. 

In a nutshell, it takes existing BIG-IP (tmsh) configuration, and transforms it into AS3 declarations. Being able to convert the "brownfield" to updated "greenfield" configurations is definitely attractive, and removes much of the concern that I personally felt when trying to craft AS3 declarations by hand.

## Do I know you?

Learning more about Device ID+ was interesting, and it is available for free through the F5 Cloud Services site. It generates a unique identifier for clients that visit a site, which can be leveraged to help make decisions on whether a client is safe, or potentially malicious.

Device ID+ installs into a webapp by including a Javascript file and gathers data about the clients that connect. The dashboard shows general stats about new vs returning users, device age, session length, country, as well as details on the number of devices per ASN and user agents per device. 

The identifier is passed to the backend server via a cookie, so it could be leveraged to make decisions or be recorded in the SIEM. An [earlier example](https://www.youtube.com/watch?v=ULXv4umSugA) by Matthieu Dierick explains how F5 APM (with an additional DB service) could use it to decide whether to step-up authentication should the values change.

Overall it seems like a decent first step on a path towards implementing a greater anti-bot solution and was very easy to get running in my lab.

New and interesting stuff from this year's conference.

F5 Agility 2021 Highlights - Part 1


# Hello World

I decided to learn more about my journey in learning various technologies, this time with Cloudflare Pages and participate in one of the community challenges to setup a blog.

<blockquote class="twitter-tweet"><p lang="en" dir="ltr">Cloudflare Pages is now Generally Available. <a href="https://t.co/bvIsZGGQRT">https://t.co/bvIsZGGQRT</a> <a href="https://twitter.com/hashtag/DeveloperWeek?src=hash&amp;ref_src=twsrc%5Etfw">#DeveloperWeek</a>💻</p>&mdash; Cloudflare (@Cloudflare) <a href="https://twitter.com/Cloudflare/status/1381593197311315973?ref_src=twsrc%5Etfw">April 12, 2021</a></blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>

I use Cloudflare in my day job as well as for personal projects. Learning how the product works can seem overwhelming sometimes as they have many features which can work for most web apps. So far my biggest focus has been on the core parts of WAF, DNS, and optimization.

It seems like it has been a million years since I last tried to write a blog, we'll see how this goes :)

Dog tax:
![Dog](dog.jpg)


Dipping a toe into JAM Stack with Cloudflare Pages.