Our next speakers whose names I forgot are going to tell us about new developments in
domain management.
So we were supposed to be only 10 persons, so I'm amazed that the room is full.
So Pierre Olivier, are we ready?
Let me check.
No, no.
The server is not responding.
Okay, do we see cute kitten for instance?
One minute.
Oh, yes, our internet is not broken, so I don't know what is happening.
So does it respond to ping?
Let me check.
The audience said, thank you very much.
Check the DNS maybe?
I don't know how to use an NS lookup.
Makes sense.
Okay, will I need to show you a happy domain later?
Oh, oh, oh, wait, I have a clue.
Oh, it works.
It's always DNS.
Thank you very much.
Thanks to the sponsors and first to the volunteers.
We are there thanks to them.
They're from Warmthanku, Peter.
So, I'm going to start with the first question.
Warmthanku, Peter.
So, look at these DNS issues.
You all know them and these are the most known of the big companies.
Big noise.
Although their team are well skilled and are good professionals.
What does it mean that it happens also to small companies all the time to all of you?
So, like you, we face the same technical issues.
The DNS system is complexity is increasing all the time.
Yet, it's invisible, but not for us, but for all the people who type their URL in the navigator.
Those and their answer are often badly set up through ignorance or lack of skills.
Great.
So, there are areas of improvement.
Therefore, we build a team of experts to try and improve the situation.
Your speaker today, Pierre Olivier Mercier,
system engineer and computer professor in a computer science engineering school.
And myself, Frédéric Griteur, contributor to Free Software Project Volunteer.
Since decade and like you, through my voluntary efforts and regular funding,
I'm going to hand read the URL there, 20 for another, etc.
There are a lot of good ideas, nonetheless, in the Internet.
Good stuff to find.
DNS record assistance, for instance.
Tool to test your records.
Your zone, your delegation, your email parameters.
Some services to monitor your domain, for instance, record propagation,
or which domain is soon to expire.
There are also online interfaces, sometimes with good functionalities.
But each provider has its own interface.
What does it mean?
For us, we are managing several providers.
That means learning each interface.
And at the end, we end up using the raw mode and making errors.
I remember a friend, not me.
We missed the final dot at the end of a record.
Another example, meaning it happens to us all the time.
A few months ago, I wanted to add a CAA record to my domain.
CAA record, which is not very well known, yet 10 years old.
So if you didn't do it, do it. It's very easy.
I found an online form, but it didn't support parameters.
So it was useless for me.
I was not open source. I couldn't help and change.
Happy domain is open source.
That means so much time wasted for switching from tools for another looking for solution,
deepening in the RFC documentation, which is not so easy to read.
Or maybe all of you have read all the RFC.
Who has read all the RFC?
One, two, three, four.
Ah, great. Ah, great, great.
I don't. Apologize.
So we would like to offer you a sort of magic wand in the form of modern interface.
And we named it Happy Domain.
It will make settings pleasant, makes the display easy to read,
and we would like to centralize all the men and registrar in one place
and forgives error as much as possible.
So let's Pierre Olivier make a demo.
Let's dig inside the software because it's five o'clock
and you are supposed to be tired.
So tell me, how does it work?
And I would like if you could change for me CAA in the domain.
We're talking about CAA. Could you do that for me?
Okay, okay.
So I go to happydomain.org.
I log in to my personal account.
And here is the domain I managed today.
We will make the modification or domain that is not listed here.
We can see there are several providers on the left.
I can use this provider to filter my domain.
For the demo, I will use a local authoritative server,
Power DNS that run on my local machine.
As it is not already registered in Happy Domain,
I click the provider and I select the domain I want to manage.
So today this is happydomain.test.
Before I forget, I will assign it a group.
This is useful for example if we have several clients or environment.
So here it is on the happydomain group.
And now this is the abstract view of the zone.
Instead of displaying directly the records,
we group them in a kind of services.
For example, we have the origin with the required record
such as the SOA and the NS record.
And as you can see, there is no technical subdomain here.
For example, the DKIM record is not in the list of subdomains here.
It belongs to the email service.
If we look at it, you can see of course the MX record,
but also the SPF1, the DKIM, the DMARC, etc.
And the corresponding records that can be displayed here,
we see that my domain key record is listed here.
This is not my goal.
Frédéric asked me to change our registered certificate authority.
Yes, I would like to use the bypass.
So the certificate authority is in the service certificate authority authorization.
We can see there is a simple form that assists the user with several choices.
Currently, we use let's encrypt,
and Frédéric told me to change it to bypass.
So great, it is in the list.
If it wasn't, I can select other and write the domain names corresponding to the certificate authority.
And we can also provide parameters.
For example, some certificate authority can restrict
which user can generate a certificate for a certain domain name.
So here we can provide a client ID, which is API domain.
And only the API domain account will be able to issue a certificate in the bypass certificate authority.
We can see there are a lot of other settings,
for example to restrict wildcard certificate issuance
or the SMIME certificate issuance.
And at the end of the form, we have the incident response.
We will see a record, provide a way to contact the owner of the domain by mail or via a hook.
Here, if someone in another certificate authority tried to issue a certificate,
we will be alert for a violation of our security policy.
All of that is a summary of the RFCs on the CAA records,
and it's pretty easy to fill for a system administrator.
So the modification here is made,
but only for now on API domain.
We can make several other modifications to make a batch
and ensure the coherence of the zone we published.
So here I just have one modification to make,
so I can directly publish my changes.
The interface asks us to review the change,
so this is a modification for the API domain.test domain for the CAA record,
and it changes from letsancript.org to bypass.com with some parameters.
This is exactly what we want to do.
And like in Git, you can add a log to retrieve it easily later.
So I applied the change, and that's it.
Frédéric, are you happy with that?
Great, but sorry, it's in one month.
I'm really sorry, it's a mistake for me.
Could you roll back this stuff?
With pleasure.
So of course I can do the same modification as there was only one modification.
This is pretty easy, but in case of many more modifications.
As of today, we support 40 providers.
We rely on the DNS control project, which is led by Stack Overflow,
and several providers are added each month to that project.
And also we support a classic authoritative server like Bind, Power DNS, and Not.
We do our best for a facilitated readability, even river zones are supported.
First, you can review your change at a glance before publishing them.
We archive your modifications, therefore users can try and roll back.
If required, you can easily export the record, and also you can import in a standard raw file.
I think on the cake, the interface can be controlled.
For instance, you may need to create a dedicated suit domain for testing,
or before putting a project into production.
Or you can have a local environment for your development,
and then a prep production on a domain hosted by, for instance, Gandhi,
and the production hosted by OVH.
No problem, happy domain talk to every one of them.
There is no need to learn the intricate of everyone's API.
You can just call the same script for all your environments.
Use a pedoman as you wish, first online, or you can easily install it on your server.
We have binaries and docker image for you, so you can use it.
Here is what we have today. You can use it right now, and please welcome.
We're convinced that we can save time and bring a piece of main for teams that manage domain name.
Think 15 seconds right now.
This is your time to work.
Think about what are your main issues, what are your main tasks,
and your greatest interest of improvement.
And then we will do our best according to what you say, and your results.
We don't promise to build it, of course, but we'll do our best.
Some ideas, for instance, now when you use a domain name provider,
you are the only one to have access to the setup.
We could use it with different levels for bringing several people all together
and keep track of their modification.
It could also be used to delegate to part of the system domain,
for instance for the marketing department or whatever.
And testing is really important.
So Apidomen could perform some tests on every record,
not only the delegation with the SOA record.
Of course, we could use and display directly in Apidomen the result of the master,
but for email, we can also perform the count of resolution for the SPF record.
All these tests take time, and Apidomen could save operational teams
a lot of time by aggregating all these tests in the interface.
Apidomen could also constantly monitor your domain names
and notify you when an issue occurs.
And the propagation time is certainly the least understood part of the DNS,
so why not display the theoretical propagation time directly and clearly in the interface?
Yes, please.
We could have also some dashboards.
This is an example for DMARC.
That means at a glance you can see your features and how they are going.
And last but not least, with the effort we put to build the API for Apidomen and the form we build,
we can also imagine using artificial intelligence to create a chat
and interact directly with the OER zone.
This is made possible thanks to function calling in recent models and API.
So please use the Element Network of the first-dem or login our system.
Use your fingers, rate your dreams and priorities and help us to help you.
So thank you very much. Now the questions.
Thank you. We have time for one question.
Okay, one question. What time is it?
No, that's another question.
Please.
So my company will use DNS control to have DNS managed by Git.
Could Apidomains be integrated in that so that both work at the same time,
so that somebody could edit the DNS using the Apidomains and see that they're committed to Git
where someone else follows from it?
I don't know.
So the question is, can Apidomen be linked with DNS control?
Currently not. We does not use JavaScript language used by DNS control,
but perhaps that can be a good idea to go that.
And you're welcome.
Thank you.
Thank you very much.