Cấu hình Azure DNS

# Tạo Resource Group
az group create \
  --name rg-az104-m11 \
  --location southeastasia \
  --tags Course=AZ-104 Module=11

# Tạo Public DNS Zone
# Thay "yourdomain.io.vn" bằng domain bạn sở hữu
az network dns zone create \
  --resource-group rg-az104-m11 \
  --name yourdomain.io.vn

# Xem 4 nameserver Azure cấp phát cho zone
az network dns zone show \
  --resource-group rg-az104-m11 \
  --name yourdomain.io.vn \
  --query nameServers \
  -o table

# Liệt kê tất cả record sets trong zone (SOA và NS mặc định)
az network dns record-set list \
  --resource-group rg-az104-m11 \
  --zone-name yourdomain.io.vn \
  --query "[].{name:name, type:type, ttl:ttl}" \
  -o table

# A record: www → 20.10.5.100 (TTL 3600s)
az network dns record-set a add-record \
  --resource-group rg-az104-m11 \
  --zone-name yourdomain.io.vn \
  --record-set-name www \
  --ipv4-address 20.10.5.100 \
  --ttl 3600

# A record: @ (apex) → cùng IP
az network dns record-set a add-record \
  --resource-group rg-az104-m11 \
  --zone-name yourdomain.io.vn \
  --record-set-name "@" \
  --ipv4-address 20.10.5.100 \
  --ttl 3600

# CNAME: blog → www.yourdomain.io.vn
az network dns record-set cname set-record \
  --resource-group rg-az104-m11 \
  --zone-name yourdomain.io.vn \
  --record-set-name blog \
  --cname www.yourdomain.io.vn \
  --ttl 3600

# MX record: mail server (Microsoft 365)
az network dns record-set mx add-record \
  --resource-group rg-az104-m11 \
  --zone-name yourdomain.io.vn \
  --record-set-name "@" \
  --exchange "yourdomain-io-vn.mail.protection.outlook.com" \
  --preference 10 \
  --ttl 3600

# TXT record: SPF cho Microsoft 365
az network dns record-set txt add-record \
  --resource-group rg-az104-m11 \
  --zone-name yourdomain.io.vn \
  --record-set-name "@" \
  --value "v=spf1 include:spf.protection.outlook.com ~all" \
  --ttl 3600

# Kiểm tra tất cả records đã tạo
az network dns record-set list \
  --resource-group rg-az104-m11 \
  --zone-name yourdomain.io.vn \
  -o table

# Tạo VNet cho lab Private DNS
az network vnet create \
  --resource-group rg-az104-m11 \
  --name vnet-az104-m11 \
  --address-prefix 10.11.0.0/16 \
  --location southeastasia

az network vnet subnet create \
  --resource-group rg-az104-m11 \
  --vnet-name vnet-az104-m11 \
  --name snet-default \
  --address-prefix 10.11.1.0/24

# Tạo Private DNS Zone (tên miền nội bộ)
az network private-dns zone create \
  --resource-group rg-az104-m11 \
  --name "internal.corp"

# Link VNet vào Private DNS Zone với auto-registration
VNET_ID=$(az network vnet show \
  --resource-group rg-az104-m11 \
  --name vnet-az104-m11 \
  --query id -o tsv)

az network private-dns link vnet create \
  --resource-group rg-az104-m11 \
  --zone-name "internal.corp" \
  --name "link-vnet-m11" \
  --virtual-network $VNET_ID \
  --registration-enabled true

# Thêm A record tĩnh cho server nội bộ
az network private-dns record-set a add-record \
  --resource-group rg-az104-m11 \
  --zone-name "internal.corp" \
  --record-set-name "dc01" \
  --ipv4-address 10.11.1.10

az network private-dns record-set a add-record \
  --resource-group rg-az104-m11 \
  --zone-name "internal.corp" \
  --record-set-name "sqlprod" \
  --ipv4-address 10.11.1.20

# Xem tất cả record sets trong Private DNS Zone
az network private-dns record-set list \
  --resource-group rg-az104-m11 \
  --zone-name "internal.corp" \
  --query "[].{name:name,type:type}" \
  -o table

# Xác nhận VNet link đã active
az network private-dns link vnet list \
  --resource-group rg-az104-m11 \
  --zone-name "internal.corp" \
  --query "[].{name:name,registrationEnabled:registrationEnabled,virtualNetworkLinkState:virtualNetworkLinkState}" \
  -o table

# Tạo VM trong VNet đã link Private DNS
az vm create \
  --resource-group rg-az104-m11 \
  --name vm-dns-test-m11 \
  --vnet-name vnet-az104-m11 \
  --subnet snet-default \
  --image Ubuntu2204 \
  --size Standard_B1s \
  --admin-username azureadmin \
  --generate-ssh-keys \
  --public-ip-sku Standard

# Đợi VM sẵn sàng
az vm wait \
  --resource-group rg-az104-m11 \
  --name vm-dns-test-m11 \
  --created

# Kiểm tra Private DNS Zone — VM vừa tạo phải xuất hiện tự động
az network private-dns record-set list \
  --resource-group rg-az104-m11 \
  --zone-name "internal.corp" \
  --query "[?contains(type, 'A')].{name:name,ip:aRecords[0].ipv4Address}" \
  -o table

# Lấy Public IP để SSH test DNS resolution
PUBLIC_IP=$(az vm show \
  --resource-group rg-az104-m11 \
  --name vm-dns-test-m11 \
  --show-details \
  --query publicIps -o tsv)

echo "Public IP: $PUBLIC_IP"

# SSH vào VM và test DNS resolution
ssh azureadmin@$PUBLIC_IP "nslookup dc01.internal.corp && nslookup sqlprod.internal.corp"

# Gỡ VNet link trước khi xóa Private DNS Zone
az network private-dns link vnet delete \
  --resource-group rg-az104-m11 \
  --zone-name "internal.corp" \
  --name "link-vnet-m11" \
  --yes

# Xóa Private DNS Zone
az network private-dns zone delete \
  --resource-group rg-az104-m11 \
  --name "internal.corp" \
  --yes

# Xóa toàn bộ Resource Group (VM, VNet, Public DNS Zone đều bị xóa)
az group delete --name rg-az104-m11 --yes --no-wait

echo "Đang xóa rg-az104-m11... Quá trình mất 3-5 phút."