Maxmind DB update automation

.gitignore

@@ -14,6 +14,5 @@ tests/docker_logs
 .nginx-validate.*
 /docs/
 /dev/bootstrap/GeoLite2-ASN/
-/dev/bootstrap/GeoLite2-City/
 /dev/bootstrap/monitoring/
 /scripts/

README.md

@@ -116,8 +116,8 @@ cp api/.env.sample api/.env
 cp proxy/.env.sample proxy/.env
 cp dnscheck/.env.sample dnscheck/.env
 
-# 2. MaxMind GeoLite2 databases (mounted by the proxy and dnscheck)
-#    Place them under dev/bootstrap/GeoLite2-ASN/ and dev/bootstrap/GeoLite2-City/
+# 2. MaxMind GeoLite2-ASN database (mounted by the proxy and dnscheck)
+#    Place GeoLite2-ASN.mmdb under dev/bootstrap/GeoLite2-ASN/
 ```
 
 Then:

compose.dnscheck.yml

@@ -16,7 +16,6 @@ services:
     volumes:
       - ./dnscheck:/app
       - ./dev/bootstrap/GeoLite2-ASN/:/opt/dnscheck/GeoIP
-      - ./dev/bootstrap/GeoLite2-City/:/opt/dnscheck/GeoIPCity
       # - ./dev/certs:/certs
     env_file:
       - ./dnscheck/.env

dnscheck/api/check.go

@@ -49,10 +49,7 @@ func (s *APIServer) DnsCheck() fiber.Handler {
 			return HandleError(c, err, ErrFailedToUnmarshalRecord)
 		}
 
-		return c.Status(200).JSON(dns.DNSCheckResponse{
-			Status:    dnsRecord.Status,
-			ProfileId: dnsRecord.ProfileId,
-		})
+		return c.Status(200).JSON(dns.DNSCheckResponse(dnsRecord))
 	}
 	return handler
 }

dnscheck/cache/cache.go

@@ -16,8 +16,7 @@ type Cache interface {
 
 // New creates a new Cache instance whose entries expire after ttl.
 func New(cacheType string, ttl time.Duration) (Cache, error) {
-	switch cacheType {
-	case CacheTypeBigCache:
+	if cacheType == CacheTypeBigCache {
 		return NewBigcache(ttl)
 	}
 	return nil, errors.New("unknown cache type")

dnscheck/config/config.go

@@ -83,9 +83,14 @@ type CacheConfig struct {
 	HMACKey string
 }
 
+// DefaultGeoIPDBReload is how often the ASN database file is checked for a
+// refreshed build when GEOIP_DB_RELOAD is unset.
+const DefaultGeoIPDBReload = 15 * time.Minute
+
 // GeoLookupConfig represents access to the MaxMind GeoIP ASN database
 type GeoLookupConfig struct {
-	DBASNFile string
+	DBASNFile   string
+	ReloadEvery time.Duration
 }
 
 // IsValid check whether config section is valid
@@ -123,8 +128,18 @@ func New() (*Config, error) {
 		return nil, errors.New("CACHE_HMAC_KEY environment variable is required")
 	}
 
+	geoReload := DefaultGeoIPDBReload
+	if raw := os.Getenv("GEOIP_DB_RELOAD"); raw != "" {
+		parsed, err := time.ParseDuration(raw)
+		if err != nil || parsed <= 0 {
+			return nil, fmt.Errorf("GEOIP_DB_RELOAD must be a positive duration, got %q", raw)
+		}
+		geoReload = parsed
+	}
+
 	geoLookup := &GeoLookupConfig{
-		DBASNFile: os.Getenv("GEOIP_DB_ASN_FILE"),
+		DBASNFile:   os.Getenv("GEOIP_DB_ASN_FILE"),
+		ReloadEvery: geoReload,
 	}
 	if err := geoLookup.IsValid(); err != nil {
 		return nil, err

dnscheck/config/config_test.go

@@ -129,3 +129,35 @@ func TestNewCacheTTLDefaultsAndValidates(t *testing.T) {
 		}
 	}
 }
+
+// specRef: dnscheck-behaviour.md #S8
+func TestNewGeoIPReloadDefaultsAndValidates(t *testing.T) {
+	t.Setenv("CACHE_HMAC_KEY", "test-key")
+	t.Setenv("GEOIP_DB_ASN_FILE", "/opt/dnscheck/GeoLite2-ASN.mmdb")
+	t.Setenv("DNS_AUTH_SERVER_IP_RANGE", "10.5.0.0/16")
+
+	t.Setenv("GEOIP_DB_RELOAD", "")
+	cfg, err := New()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if cfg.GeoLookupConfig.ReloadEvery != DefaultGeoIPDBReload {
+		t.Errorf("ReloadEvery = %v, want default %v", cfg.GeoLookupConfig.ReloadEvery, DefaultGeoIPDBReload)
+	}
+
+	t.Setenv("GEOIP_DB_RELOAD", "1h")
+	cfg, err = New()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if cfg.GeoLookupConfig.ReloadEvery != time.Hour {
+		t.Errorf("ReloadEvery = %v, want 1h", cfg.GeoLookupConfig.ReloadEvery)
+	}
+
+	for _, bad := range []string{"daily", "-15m", "0"} {
+		t.Setenv("GEOIP_DB_RELOAD", bad)
+		if _, err := New(); err == nil {
+			t.Errorf("expected an error for GEOIP_DB_RELOAD=%q", bad)
+		}
+	}
+}

dnscheck/dns/handler.go

@@ -171,7 +171,9 @@ func (h *Handler) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
 	default:
 		msg.Ns = h.createSOA()
 	}
-	w.WriteMsg(&msg)
+	if err := w.WriteMsg(&msg); err != nil {
+		log.Error().Err(err).Msg("Failed to write DNS response")
+	}
 }
 
 func (h *Handler) extractConfiguredProfileId(r *dns.Msg) (profileId string) {
@@ -203,7 +205,7 @@ func (h *Handler) createSOA() []dns.RR {
 				Ttl:    TTL},
 			Ns:      "ns1." + dom,
 			Mbox:    "hostmaster." + dom,
-			Serial:  uint32(time.Now().Truncate(time.Hour).Unix()),
+			Serial:  soaSerial(time.Now()),
 			Refresh: 28800,
 			Retry:   7200,
 			Expire:  604800,
@@ -212,6 +214,16 @@ func (h *Handler) createSOA() []dns.RR {
 	}
 }
 
+// soaSerial is the hour-truncated Unix time. RFC 1035 §3.3.13 makes SERIAL a
+// 32-bit unsigned value, which Unix seconds exceed only in 2106.
+func soaSerial(now time.Time) uint32 {
+	s := now.Truncate(time.Hour).Unix()
+	if s < 0 || s > 1<<32-1 {
+		return 0
+	}
+	return uint32(s)
+}
+
 // clientIP returns the transport-level source address of the query. It is read
 // straight from the socket address and never resolved.
 func clientIP(addr net.Addr) (net.IP, error) {

dnscheck/dns/server.go

@@ -1,12 +1,14 @@
 package dns
 
 import (
+	"context"
 	"fmt"
 
 	"github.com/dnscheck/cache"
 	"github.com/dnscheck/config"
 	"github.com/dnscheck/internal/maxmind"
 	"github.com/miekg/dns"
+	"github.com/rs/zerolog/log"
 )
 
 // GeoLookuper resolves a client IP to its ASN record.
@@ -37,6 +39,13 @@ func New(config *config.Config, cache cache.Cache) (*DNSServer, error) {
 		return nil, fmt.Errorf("geoip: %w", err)
 	}
 	srv.GeoLookup = geoLookup
+	// The file is refreshed on disk by geoipupdate; follow it without a restart.
+	go geoLookup.Watch(context.Background(), config.GeoLookupConfig.ReloadEvery)
+	log.Info().
+		Str("path", config.GeoLookupConfig.DBASNFile).
+		Time("build_time", geoLookup.Stats().BuildTime).
+		Dur("reload_every", config.GeoLookupConfig.ReloadEvery).
+		Msg("GeoIP ASN database loaded")
 
 	// DNS
 	srv.DNSTCP = &dns.Server{Addr: ":53", Net: "tcp"}

dnscheck/go.mod

@@ -6,7 +6,7 @@ require (
 	github.com/go-playground/validator/v10 v10.25.0
 	github.com/gofiber/fiber/v2 v2.52.12
 	github.com/miekg/dns v1.1.62
-	github.com/oschwald/geoip2-golang v1.11.0
+	github.com/oschwald/geoip2-golang v1.13.0
 	github.com/rs/zerolog v1.34.0
 )
 

dnscheck/go.sum

@@ -37,8 +37,8 @@ github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6T
 github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/miekg/dns v1.1.62 h1:cN8OuEF1/x5Rq6Np+h1epln8OiyPWV+lROx9LxcGgIQ=
 github.com/miekg/dns v1.1.62/go.mod h1:mvDlcItzm+br7MToIKqkglaGhlFMHJ9DTNNWONWXbNQ=
-github.com/oschwald/geoip2-golang v1.11.0 h1:hNENhCn1Uyzhf9PTmquXENiWS6AlxAEnBII6r8krA3w=
-github.com/oschwald/geoip2-golang v1.11.0/go.mod h1:P9zG+54KPEFOliZ29i7SeYZ/GM6tfEL+rgSn03hYuUo=
+github.com/oschwald/geoip2-golang v1.13.0 h1:Q44/Ldc703pasJeP5V9+aFSZFmBN7DKHbNsSFzQATJI=
+github.com/oschwald/geoip2-golang v1.13.0/go.mod h1:P9zG+54KPEFOliZ29i7SeYZ/GM6tfEL+rgSn03hYuUo=
 github.com/oschwald/maxminddb-golang v1.13.0 h1:R8xBorY71s84yO06NgTmQvqvTvlS/bnYZrrWX1MElnU=
 github.com/oschwald/maxminddb-golang v1.13.0/go.mod h1:BU0z8BfFVhi1LQaonTwwGQlsHUEu9pWNdMfmq4ztm0o=
 github.com/philhofer/fwd v1.1.3-0.20240916144458-20a13a1f6b7c h1:dAMKvw0MlJT1GshSTtih8C2gDs04w8dReiOGXrGLNoY=

dnscheck/internal/maxmind/maxmind.go

@@ -1,39 +1,53 @@
 package maxmind
 
 import (
+	"context"
 	"fmt"
 	"net"
+	"time"
 
+	"github.com/ivpn/dns/libs/geoipdb"
 	"github.com/oschwald/geoip2-golang"
 )
 
 // GeoLookupManager answers ASN lookups from a MaxMind database that is opened
-// once and shared by every request; geoip2.Reader is safe for concurrent use.
+// once, shared by every request, and reopened in place when the file on disk
+// is refreshed.
 type GeoLookupManager struct {
-	asnDB *geoip2.Reader
+	db *geoipdb.Reader
 }
 
 // NewGeoLookupManager opens the ASN database and fails if the file is missing,
 // unreadable or not an ASN-capable database type.
 func NewGeoLookupManager(dbASNFile string) (*GeoLookupManager, error) {
-	asnDB, err := geoip2.Open(dbASNFile)
+	db, err := geoipdb.Open(dbASNFile)
 	if err != nil {
 		return nil, fmt.Errorf("cannot open geoip ASN database %q: %w", dbASNFile, err)
 	}
+	return &GeoLookupManager{db: db}, nil
+}
 
-	// geoip2 only reports a database/method mismatch at lookup time, so probe
-	// once here rather than on every request.
-	if _, err := asnDB.ASN(net.IPv4(192, 0, 2, 1)); err != nil {
-		asnDB.Close()
-		return nil, fmt.Errorf("geoip database %q does not support ASN lookups: %w", dbASNFile, err)
-	}
+// Reload checks the file now and reopens it if it changed; a broken replacement
+// is rejected and the loaded database keeps serving. Production relies on
+// Watch, which runs the same check on a timer; Reload is the synchronous
+// entry point for tests and for a manual "reload now" trigger.
+func (g *GeoLookupManager) Reload() (bool, error) {
+	return g.db.Reload()
+}
+
+// Watch reloads the database on a timer until ctx is cancelled.
+func (g *GeoLookupManager) Watch(ctx context.Context, every time.Duration) {
+	g.db.Watch(ctx, every)
+}
 
-	return &GeoLookupManager{asnDB: asnDB}, nil
+// Stats reports the build time and reload counters of the loaded database.
+func (g *GeoLookupManager) Stats() geoipdb.Stats {
+	return g.db.Stats()
 }
 
 // Close releases the underlying database.
 func (g *GeoLookupManager) Close() error {
-	return g.asnDB.Close()
+	return g.db.Close()
 }
 
 // GetGeoLookup returns the ASN record for ip. An address that is not in the
@@ -44,7 +58,7 @@ func (g *GeoLookupManager) GetGeoLookup(ip string) (*GeoLookup, error) {
 		return nil, fmt.Errorf("invalid IP address %q", ip)
 	}
 
-	asn, err := g.asnDB.ASN(ipnet)
+	asn, err := g.db.ASN(ipnet)
 	if err != nil {
 		return nil, fmt.Errorf("cannot get ASN: %w", err)
 	}

dnscheck/internal/maxmind/maxmind_test.go

@@ -4,13 +4,98 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
+	"time"
 )
 
 const (
-	asnFixture  = "testdata/GeoLite2-ASN.mmdb"
-	cityFixture = "testdata/GeoLite2-City.mmdb"
+	asnFixture   = "testdata/GeoLite2-ASN.mmdb"       // build 2026-09-04
+	newerFixture = "testdata/GeoLite2-ASN.newer.mmdb" // same networks, build 2026-09-18
+	cityFixture  = "testdata/GeoLite2-City.mmdb"
 )
 
+// installFixture mirrors geoipupdate: write a temporary file, then rename it
+// over the target.
+func installFixture(t *testing.T, src, dst string, mtime time.Time) {
+	t.Helper()
+	data, err := os.ReadFile(src)
+	if err != nil {
+		t.Fatal(err)
+	}
+	tmp := dst + ".temporary"
+	if err := os.WriteFile(tmp, data, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chtimes(tmp, mtime, mtime); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Rename(tmp, dst); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// A database refreshed on disk is served after the next reload; the process
+// never has to restart.
+//
+// specRef: dnscheck-behaviour.md #S6
+func TestGeoLookupManagerReloadsReplacedDatabase(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "GeoLite2-ASN.mmdb")
+	installFixture(t, asnFixture, path, time.Now().Add(-time.Hour))
+	g, err := NewGeoLookupManager(path)
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	defer g.Close()
+	if got := g.Stats().BuildTime.UTC().Format("2006-01-02"); got != "2026-09-04" {
+		t.Fatalf("initial build date %s, want 2026-09-04", got)
+	}
+
+	installFixture(t, newerFixture, path, time.Now())
+	changed, err := g.Reload()
+	if err != nil || !changed {
+		t.Fatalf("reload: changed=%v err=%v", changed, err)
+	}
+	if got := g.Stats().BuildTime.UTC().Format("2006-01-02"); got != "2026-09-18" {
+		t.Errorf("build date after reload %s, want 2026-09-18", got)
+	}
+	got, err := g.GetGeoLookup("8.8.8.8")
+	if err != nil || got.ASN != 15169 {
+		t.Errorf("lookup after reload: %+v err=%v", got, err)
+	}
+}
+
+// A broken replacement (corrupt file or City edition on the ASN path) is
+// rejected and the previously loaded database keeps answering.
+//
+// specRef: dnscheck-behaviour.md #S7
+func TestGeoLookupManagerKeepsOldDatabaseWhenReplacementIsBad(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "GeoLite2-ASN.mmdb")
+	installFixture(t, asnFixture, path, time.Now().Add(-time.Hour))
+	g, err := NewGeoLookupManager(path)
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	defer g.Close()
+
+	installFixture(t, cityFixture, path, time.Now())
+	if _, err := g.Reload(); err == nil {
+		t.Fatal("expected an error for a City database on the ASN path")
+	}
+	if err := os.WriteFile(path, []byte("not an mmdb"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := g.Reload(); err == nil {
+		t.Fatal("expected an error for a corrupt replacement")
+	}
+
+	if s := g.Stats(); s.Failures != 2 || s.BuildTime.UTC().Format("2006-01-02") != "2026-09-04" {
+		t.Errorf("stats after failed reloads: %+v", s)
+	}
+	got, err := g.GetGeoLookup("8.8.8.8")
+	if err != nil || got.ASN != 15169 {
+		t.Errorf("old database not served after failed reloads: %+v err=%v", got, err)
+	}
+}
+
 // specRef: dnscheck-behaviour.md #S2
 func TestNewGeoLookupManagerRejectsMissingFile(t *testing.T) {
 	_, err := NewGeoLookupManager(filepath.Join(t.TempDir(), "missing.mmdb"))