blob: 3f439e516f680482aec9d0f69b7f72e58a1d61c2 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
|
---
- name: install unbound and nsd
pkgng:
name:
- unbound
- nsd
state: present
# "root-hints" is the file which contains the listing of primary root
# DNS servers. Unbound does have a listing of root DNS servers in its
# code, but we want to make sure we have the most up to date copy.
# We normally update our copy once every 6 months.
#
# References:
# * Unbound DNS Server Tutorial
# https://calomel.org/unbound_dns.html
#
- name: unbound - fetch root.hints
command: >
fetch -o /usr/local/etc/unbound/root.hints
"https://www.internic.net/domain/named.cache"
notify: reload-unbound
tags: unbound
- name: unbound - check existence of control key/cert
stat:
path: /usr/local/etc/unbound/unbound_control.key
register: stat_result
tags: unbound
- name: unbound - generate self-signed key/cert for control
command: unbound-control-setup
when: not stat_result.stat.exists
tags: unbound
- name: unbound - fetch initial anchor
command: >
unbound-anchor -a /usr/local/etc/unbound/root.key
-r /usr/local/etc/unbound/root.hints
ignore_errors: true
tags: unbound
- name: unbound - copy configuration
copy:
src: unbound.conf
dest: /usr/local/etc/unbound/unbound.conf
validate: "unbound-checkconf %s"
notify: reload-unbound
tags: unbound
- name: unbound - enable and start service
command: rcenable unbound
tags: unbound
- name: setup resolv.conf
copy:
src: resolv.conf
dest: /etc/resolv.conf
tags: unbound
#
# NSD
#
- name: NSD - check existence of control key/cert
stat:
path: /usr/local/etc/nsd/nsd_control.key
register: stat_result
tags: nsd
- name: NSD - generate self-signed key/cert for control
command: nsd-control-setup
when: not stat_result.stat.exists
tags: nsd
- name: NSD - create zones directory
file:
path: /usr/local/etc/nsd/zones
state: directory
tags: nsd
- name: NSD - get the list of zone files
set_fact:
zonefiles: "{{ lookup('fileglob', '../templates/zones/*.j2', wantlist=True) }}"
tags:
- nsd
- zones
- debug: var=zonefiles
- block:
- name: NSD - generate zone files
include_tasks: nsd-zone.yml
vars:
zonefile: "{{ item }}"
with_items: "{{ zonefiles }}"
tags:
- nsd
- zones
# NOTE: requires variable `zonefiles`
- name: NSD - generate configuration
template:
src: nsd.conf.j2
dest: /usr/local/etc/nsd/nsd.conf
validate: "nsd-checkconf %s"
notify: reload-nsd
tags:
- nsd
- zones
- name: NSD - enable and start service
command: rcenable nsd
tags: nsd
|
