Skip to content
DNS-Editor

Quick Start

DNS-Editor is a single static binary with an embedded interface. There is nothing to install besides the file itself: no Node, no web server in front, no external database to get started.

Prerequisites

Section titled “Prerequisites”
  • Linux or macOS (amd64/arm64)
  • SQLite is enough to get started — the server creates the file itself
  • A 32-byte encryption key (see below)

1. Get the binary

Section titled “1. Get the binary”

Ready-made binaries are attached to every release as generic packages in the GitLab project (dnseditor-linux-amd64, dnseditor-linux-arm64, dnseditor-darwin-arm64). Alternatively, build it yourself:

Terminal window
git clone https://gitlab.techeve.de/dns-editor/dns-editor-ce.git
cd dns-editor-ce
make build          # → dist/dnseditor (UI embedded)

2. Generate a key

Section titled “2. Generate a key”

All provider credentials, certificate keys, and secret settings are stored envelope-encrypted in the database. Without this key they cannot be read — not even from a backup:

Terminal window
openssl rand -hex 32

3. Start

Section titled “3. Start”
Terminal window
DNSE_ENCRYPTION_KEY=<your-hex-key> \
DNSE_ADMIN_PASSWORD=<initial-password> \
./dnseditor

The interface then runs at http://127.0.0.1:8422. Sign in with admin and the password you set. DNSE_ADMIN_PASSWORD is only evaluated on the very first start — a password changed later remains in effect.

Demo mode

Section titled “Demo mode”

To try things out without a real provider, there is an in-memory provider with prepared data (zones, users, history, drift):

Terminal window
make demo           # port 8432, separate database

or directly:

Terminal window
DNSE_DEMO=on DNSE_DB=./demo.db DNSE_LISTEN=127.0.0.1:8432 \
DNSE_ENCRYPTION_KEY=$(openssl rand -hex 32) DNSE_ADMIN_PASSWORD=demo ./dnseditor

In demo mode, certificates are issued self-signed; no external calls are made.

Running behind a reverse proxy

Section titled “Running behind a reverse proxy”

For production use, a reverse proxy with TLS belongs in front. Two settings matter then:

Terminal window
DNSE_LISTEN=127.0.0.1:8422        # listen locally only, proxy terminates TLS
DNSE_SECURE_COOKIES=on            # mark session cookies as Secure
DNSE_TRUSTED_PROXIES=10.0.0.0/8   # trust X-Forwarded-For only from these addresses

DNSE_TRUSTED_PROXIES is not a cosmetic switch: DynDNS determines the IP of the requesting router. Without the list of trusted proxies, either the proxy address would be recorded or a forged header would be accepted.

Next steps

Section titled “Next steps”