nextdns-rewrite.sh

#!/usr/bin/env bash
set -euo pipefail

# Updates NextDNS rewrites for a domain based on dig results from a specific DNS server.
#
# Required env vars:
#   NEXTDNS_API_KEY      - Your NextDNS API key (https://my.nextdns.io/account)
#   NEXTDNS_PROFILE_ID   - Your NextDNS profile ID (e.g. "abc123")
#
# Usage:
#   nextdns-rewrite.sh <dns_server> <domain>

main() {
  local -r API_BASE="https://api.nextdns.io"

  [[ $# -eq 2 ]] || { echo "Usage: $0 <dns_server> <domain>" >&2; exit 1; }

  local -r DNS_SERVER="$1"
  local -r DOMAIN="$2"

  [[ -n "${NEXTDNS_API_KEY:-}" ]]    || die "NEXTDNS_API_KEY env var is not set."
  [[ -n "${NEXTDNS_PROFILE_ID:-}" ]] || die "NEXTDNS_PROFILE_ID env var is not set."

  local -r REWRITES_URL="${API_BASE}/profiles/${NEXTDNS_PROFILE_ID}/rewrites"
  local -r AUTH_HEADER="X-Api-Key: ${NEXTDNS_API_KEY}"

  # Resolve current IPs
  local IPS=()
  while IFS= read -r line; do
    IPS+=("$line")
  done < <(dig +short "${DOMAIN}" "@${DNS_SERVER}" | grep -E '^[0-9]')

  [[ ${#IPS[@]} -gt 0 ]] || die "dig returned no IPs for ${DOMAIN} @${DNS_SERVER}"
  echo "Resolved ${DOMAIN} → ${IPS[*]}" >&2

  # Delete existing rewrites for this domain
  local existing
  existing=$(curl -sf --max-time 10 -H "${AUTH_HEADER}" "${REWRITES_URL}")

  local ids_to_delete
  ids_to_delete=$(echo "${existing}" | jq -r --arg d "${DOMAIN}" \
    '.data[] | select(.name == $d) | .id')

  if [[ -n "${ids_to_delete}" ]]; then
    while IFS= read -r id; do
      curl -sf --max-time 10 -X DELETE -H "${AUTH_HEADER}" "${REWRITES_URL}/${id}"
    done <<< "${ids_to_delete}"
    echo "Deleted stale rewrite(s)." >&2
  fi

  # Create new rewrites
  local payload
  for ip in "${IPS[@]}"; do
    payload=$(jq -n --arg name "${DOMAIN}" --arg content "${ip}" \
      '{name: $name, content: $content}')
    curl -sf --max-time 10 -X POST \
      -H "${AUTH_HEADER}" \
      -H "Content-Type: application/json" \
      -d "${payload}" \
      "${REWRITES_URL}" > /dev/null
  done

  echo "Created ${#IPS[@]} rewrite(s) for ${DOMAIN}." >&2
}

die() {
  echo "Error: $*" >&2
  exit 1
}

main "$@"