blob: fe2a53a96f4109001af4ce1418a95d017ee4ab11 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
|
---
- name: install unbound and nsd
pkgng:
name: "{{ item }}"
state: present
with_items:
- unbound
- nsd
# "root-hints" is the file which contains the listing of primary root
# DNS servers. Unbound does have a listing of root DNS servers in its
# code, but we want to make sure we have the most up to date copy.
# We normally update our copy once every 6 months.
#
# References:
# * Unbound DNS Server Tutorial
# https://calomel.org/unbound_dns.html
#
- name: unbound - fetch root.hints
command: >
fetch -o /usr/local/etc/unbound/root.hints
"https://www.internic.net/domain/named.cache"
notify: reload-unbound
- name: unbound - check existence of control key/cert
stat:
path: /usr/local/etc/unbound/unbound_control.key
register: stat_result
- name: unbound - generate self-signed key/cert for control
command: unbound-control-setup
when: not stat_result.stat.exists
- name: unbound - copy configuration
copy:
src: unbound.conf
dest: /usr/local/etc/unbound/unbound.conf
notify: reload-unbound
- name: unbound - enable and start service
command: rcenable unbound
- name: setup resolv.conf
copy:
src: resolv.conf
dest: /etc/resolv.conf
#
# NSD
#
- name: NSD - copy configuration
template:
src: nsd.conf.j2
dest: /usr/local/etc/nsd/nsd.conf
notify: reload-nsd
- name: NSD - check existence of control key/cert
stat:
path: /usr/local/etc/nsd/nsd_control.key
register: stat_result
- name: NSD - generate self-signed key/cert for control
command: nsd-control-setup
when: not stat_result.stat.exists
- name: NSD - create zones directory
file:
path: /usr/local/etc/nsd/zones
state: directory
- name: NSD - generate zone files
template:
src: "zones/{{ item }}.zone.j2"
dest: "/usr/local/etc/nsd/zones/{{ item }}.zone"
with_items: "{{ domains }}"
notify: reload-nsd
- name: NSD - enable and start service
command: rcenable nsd
|
