Add support for NextDNS resolver

[arnarg]

This adds support for easily using NextDNS as a DoH resolver in tailscale network controlled by Headscale. More info in #939

To enable you would put the following in config:

dns_config:
  nameservers:
    - nextdns:abcdef # Where abcdef is your NextDNS ID

• read the CONTRIBUTING guidelines
• raised a GitHub issue or discussed it on the projects chat beforehand
• added unit tests
• added integration tests
• updated documentation if needed
• updated CHANGELOG.md

Fixes #939

[arnarg]

This just adds a nice machine identifier in the request log in the NextDNS dashboard.

[arnarg]

I updated some of the code as I wasn't happy with everything and I realized that in getMapResponseDNSConfig the dnsConfigOrig is only cloned when if magic dns is enabled. I believe NextDNS resolver can be enabled without magic DNS but as is it will overwrite the resolver in the global config, appending machine specific config over and over again.

What do you think would be more appropriate to resolve that.

• Only do the machine config appending to the nextdns resolver when magic DNS is enabled
• Always clone the dnsConfigOrig in case there is a nextdns resolver in there that needs to be modified for the machine

I personally think the second would be better as the DoH resolvers don't have much to do with magic DNS.

[iSchluff]

As far as I understand the code in tailscale you should just be able to provide a nexdns ipv6 ip in the headscale dns configuration, and it should work without any changes

https://github.com/tailscale/tailscale/blob/bb7be74756e23d4385a91a9608fd68eddd5a249a/net/dns/publicdns/publicdns.go#L42

[arnarg]

Yeah you are correct. I had not seen this. This will at least make it possible to use NextDNS DoH resolver as is, good to know!

However, from a usability point of view I would still argue that nextdns:abcdef would be nicer to specify than 2a07:a8c0::ab:cdef. But more importantly the ipv6 way does not support adding the metadata so that hosts are identifiable in the request log.

Like this:

Do you think you'd be open for adding this feature at all or not?

[kradalby]

@arnarg looks good now, can you add a CHANGELOG entry and some docs?

[arnarg]

@arnarg looks good now, can you add a CHANGELOG entry and some docs?

I have added to the CHANGELOG and I couldn't find any good place for this in docs except as comments in the example config. Is this acceptable?