Getting up and running

Tip

The shortest route onto a server is installing from a package: .deb/.rpm set up the service account, a systemd unit with Restart=always and the configuration in one go. This page covers the settings themselves.

Startup

DNSE_LICENSE_FILE=/etc/dnseditor/license.json \
DNSE_ENCRYPTION_KEY=<hex-key> \
DNSE_ADMIN_PASSWORD=<initial-password> \
./dnseditor-ee

Like CE, the instance listens on 127.0.0.1:8422 unless DNSE_LISTEN says otherwise.

Configuration

EE takes over all variables of the Community Edition — database, encryption, ACME, SMTP, Valkey, proxy trust. The complete list is in the CE configuration.

On top of that:

Variable	Default	Meaning
DNSE_LICENSE_FILE	./license.json	Path to the license file
DNSE_LICENSE_PUBKEY	—	Public key override (development only)
DNSE_SSO_ISSUER	—	OIDC issuer URL
DNSE_SSO_CLIENT_ID	—	Client ID at the identity provider
DNSE_SSO_CLIENT_SECRET	—	Client secret
DNSE_SSO_REDIRECT_URL	—	Callback address of this instance
DNSE_SSO_AUTOPROVISION	on	Automatically create unknown identities

Details on the sign-in flow: Single sign-on.

Migrating from CE to EE

CE and EE use the same data model. The switch therefore consists of:

1. Stop the CE service.
2. Swap the binary for dnseditor-ee and put the license file in place.
3. Start with the same DNSE_ENCRYPTION_KEY and the same database.

Schema adjustments run automatically at startup. Going back to CE is possible as long as no EE-only features are strictly required — the data remains readable.

Caution

The encryption key must be identical. With a different key, the stored provider credentials can no longer be decrypted.

Development

Locally, the CE repo is included via a go.work in the parent directory.

make test           # Go tests (race) + gofmt + vet
make run            # port 8423, with license gate
make demo           # port 8433, demo data (audit history browsable)
make license        # re-sign the dev license, e.g. after expiry

CI builds without go.work. Therefore add new dependencies with GOWORK=off go mod tidy and bump the CE pin whenever EE needs a fresh CE state:

GOWORK=off GOPRIVATE=gitlab.techeve.de \
  go get gitlab.techeve.de/dns-editor/dns-editor-ce@<commit>
GOWORK=off go mod tidy

Self-healing in continuous operation

EE inherits the core’s full crash safety: panics in handlers and background jobs stay local, GET /healthz and GET /readyz report the state, and the built-in watchdog terminates a persistently unhealthy process cleanly (exit code 2) so the supervisor restarts it. Every installation therefore needs a restart policy — systemd Restart=always or Docker restart: unless-stopped. Configuration (DNSE_WATCHDOG*) and a systemd unit example live in the CE docs under Getting started → Operations & Self-Healing.