ptoal/toallab-automation
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

WIP3

Browse Source
This commit is contained in:
Patrick Toal
2020-08-17 12:06:41 -04:00
parent 9fa09f26bd
commit 6eb48873e6
455 changed files with 45184 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
roles/bertvv.bind/.gitignore vendored Normal file
View File

@@ -0,0 +1,19 @@
# .gitignore
# Hidden Vagrant-directory
.vagrant
# Backup files (e.g. Vim, Gedit, etc.)
*~
# Vagrant base boxes (you never know when someone puts one in the repository)
*.box
# Python artefacts
.ropeproject
*.pyc
# Ignore test directory
tests/
vagrant-tests/
docker-tests/

48
roles/bertvv.bind/.travis.yml Normal file
View File

@@ -0,0 +1,48 @@
---
language: python
# Use the new container infrastructure
sudo: required
env:
global:
- ROLE_NAME: bind
matrix:
- MOLECULE_DISTRO: centos7
- MOLECULE_DISTRO: centos8
- MOLECULE_DISTRO: debian8
- MOLECULE_DISTRO: debian9
- MOLECULE_DISTRO: debian10
- MOLECULE_DISTRO: ubuntu1604
- MOLECULE_DISTRO: ubuntu1804
- MOLECULE_DISTRO: ubuntu2004
# Enable docker support
services:
- docker
install:
- sudo apt-get update
- sudo apt-get install bats curl dnsutils
# Install dependencies for Molecule test
- python3 -m pip install molecule yamllint ansible-lint docker netaddr
# Check ansible and molecule version
- ansible --version
- molecule --version
# Create ansible.cfg with correct roles_path
- printf '[defaults]\nroles_path=../' >ansible.cfg
before_script:
# Renames ansible-role-bind to bertvv.bind to make it match with Ansible
# Galaxy
- cd ../
- mv ansible-role-$ROLE_NAME bertvv.$ROLE_NAME
- cd bertvv.$ROLE_NAME
script:
# Run molecule test
- molecule test
notifications:
webhooks: https://galaxy.ansible.com/api/v1/notifications/

56
roles/bertvv.bind/.yamllint Normal file
View File

@@ -0,0 +1,56 @@
---
rules:
braces:
min-spaces-inside: 0
max-spaces-inside: 0
min-spaces-inside-empty: -1
max-spaces-inside-empty: -1
brackets:
min-spaces-inside: 0
max-spaces-inside: 0
min-spaces-inside-empty: -1
max-spaces-inside-empty: -1
colons:
max-spaces-before: 0
max-spaces-after: 1
commas:
max-spaces-before: 0
min-spaces-after: 1
max-spaces-after: 1
comments:
level: warning
require-starting-space: true
min-spaces-from-content: 2
comments-indentation:
level: warning
document-end: disable
document-start:
level: warning
present: true
empty-lines:
max: 2
max-start: 0
max-end: 0
empty-values:
forbid-in-block-mappings: false
forbid-in-flow-mappings: false
hyphens:
max-spaces-after: 1
indentation:
spaces: consistent
indent-sequences: true
check-multi-line-strings: false
key-duplicates: enable
key-ordering: disable
line-length:
max: 1000
level: warning
allow-non-breakable-words: true
allow-non-breakable-inline-mappings: false
new-line-at-end-of-file: enable
new-lines:
type: unix
trailing-spaces: enable
truthy:
level: warning

250
roles/bertvv.bind/CHANGELOG.md Normal file
View File

@@ -0,0 +1,250 @@
# Change log
This file contains al notable changes to the bind Ansible role.
This file adheres to the guidelines of [http://keepachangelog.com/](http://keepachangelog.com/). Versioning follows [Semantic Versioning](http://semver.org/). "GH-X" refers to the X'th issue/pull request on the Github project.
## 4.2.0 - 2020-05-23
An update that's been long overdue. Several PRs with new features were merged!
A special thanks to @blofeldthefish for his willingness to help out with maintaining this role and to @RobinsOphalvens for contributing the new testing harness based on Molecule. Thanks to them, further development of this role got out of the deadlock it's been in since the previous version.
## Added
- New supported platforms
- CentOS 8 (GH-107, credit: [Paulius Mazeika](https://github.com/pauliusm))
- Debian 10 (no changes were needed)
- FreeBSD (GH-100, credit: [psa](https://github.com/psa))
- Ubuntu 20.04 LTS (no changes were needed)
- (GH-69) Allow TTLs for individual records (credit: [Stuart Knight](https://github.com/blofeldthefish))
- (GH-79) Added support for the SSHFP record type (credit: [Romuald](https://github.com/rds13))
- (GH-81) Added support for the DNAME record type (credit: [B. Verschueren](https://github.com/bverschueren))
- (GH-82) Added support for the NAPTR record type (credit: [Aido](https://github.com/aido))
- (GH-83) Added support for the [`$GENERATE` directive](http://www.zytrax.com/books/dns/ch8/generate.html) (credit: [Rayford Johnson](https://github.com/rayfordj))
- (GH-85) New role variable `bind_other_logs` (credit: [Paulo E. Castro](https://github.com/pecastro))
- (GH-87) New role variable `bind_dns_keys`, a list of binding keys (credit: [Jérôme Avond](https://github.com/jadjay))
- (GH-88) New role variable `bind_statistics_channels` (credit: [Stuart Knight](https://github.com/blofeldthefish))
- (GH-105, GH-113) New role variable `bind_query_log`, with more flexibility w.r.t. query logging (credit: [Romuald](https://github.com/rds13) and [Jascha Sticher](https://github.com/itbane))
- New keys in `bind_zone_domains`: `create_forward_zones` and `create_reverse_zones`. When present and set to false, they will prevent the creation of the forward or reverse zones, respectively. This results in a reverse only or forward only name server for that zone.
## Changed
- Molecule is now used as testing harness (credit: [Robin Ophalvens](https://github.com/RobinOphalvens)). The previous system was written before any standardised testing tools were available. It became too cumbersome to maintain, which had serious impact on the further development of this role.
- (GH-75) Refactored hash gathering to determine if zone files need to be regenerated (credit: [Stuart Knight](https://github.com/blofeldthefish))
- (GH-89) Add missing `allow-recursion` parameter for bind slaves, allowing them to handle recursion correctly (credit: [Lennart Weller](https://github.com/lhw))
- (GH-91) Ensure the directory for cached slave zones is created (credit: [Otto Sabart](https://github.com/seberm))
- (GH-99) Use `bind_group` variable instead of hard-coded value (credit: [Boris Momčilović](https://github.com/kornrunner))
- (GH-114,115) Fix error with scenario in conjunction with a dhcp shared secret key to provide dynamic dns updates. (credit: [Fabio Rocha](https://github.com/frock81))
## Removed
- (GH-106) Removed DNSSEC Lookaside Validation, this service has been shut down
## 4.1.0 - 2018-10-05
## Added
- (GH-53) Add variable `bind_zone_dir` and `bind_zone_file_mode` for setting the master zone file path and mode, and `bind_extra_include_files` for including arbitrary configuration files into named.conf. (credit: [Brad Durrow](https://github.com/bdurrow))
- (GH-64) Add variable `bind_query_log` to enable query logging (credit: [Angel Barrera](https://github.com/angelbarrera92))
## Changed
- (GH-55) Fix issue with non-existing file when grepping domain (credit: [Tom Meinlschmidt](https://github.com/tmeinlschmidt))
- (GH-57) Fix issue with forwarding in subdomain delegations (credit: [Stuart Knight](https://github.com/blofeldthefish))
- (GH-66) Fix issue that causes playbook to fail when running in `--check` mode (credit: [Jörg Eichhorn](https://github.com/jeichhorn))
- (GH-67) Improved documentation with minimal slave configuration (credit: [Christopher Hicks](https://github.com/chicks-net))
- Add Ubuntu 18.04, Debian 8-9 and Arch Linux to list of supported distros.
## 4.0.1 - 2018-05-21
### Changed
- (GH-52) Move all zone specific configuration options to `bind_zones` (credit: [Stuart Knight](https://github.com/blofeldthefish))
## 4.0.0 - 2018-05-19
### Added
- (GH-50) Add support for multiple zones (credit: [Stuart Knight](https://github.com/blofeldthefish)). **This is a breaking change,** as it changes the syntax for specifying zones.
- Allow out-of-zone name server records
## 3.9.1 - 2018-04-22
## Changed
- Allow multi-line `ansible_managed` comment (credit: [Fazle Arefin](https://github.com/fazlearefin))
- Fix the atrocious implementation of (GH-35)
- Updated documentation for specifying hosts with multiple IP addresses
- Create serial as UTC UNIX time (credit: [David J. Haines](https://github.com/dhaines))
- Fix bugs, linter and deprecation warnings
## 3.9.0 - 2017-11-21
### Added
- (GH-35) Role variable `bind_check_names`, which adds support for check-names (e.g. `check-names master ignore;`)
- (GH-36) Role variable `bind_allow_recursion`, which adds support for allow-recursion (credit: [Loic Dachary](https://github.com/dachary))
- (GH-39) Role variable `bind_zone_delegate`, which adds support for zone delegation / NS records (credit: [Loic Dachary](https://github.com/dachary))
- (GH-40) Role variables `bind_dnssec_enable` and `bind_dnssec_validation`, which makes DNSSEC validation configurable (credit: [Guillaume Darmont](https://github.com/gdarmont)).
### Changed
- (GH-38) Only append domain to MX if it does not end with a dot (credit: [Loic Dachary](https://github.com/dachary))
## 3.8.0 - 2017-07-12
This release adds support for multiple TXT entries and fixes some bugs.
### Added
- (GH-31) Support for multiple TXT entries for the same name (credit: [Rafael Bodill](https://github.com/rafi))
### Changed
- (GH-31) Fixed ipv6 reverse zone hash calculation for complete idempotency (credit: [Stuart Knight](https://github.com/blofeldthefish))
- (GH-32, GH-33) Fix for bug where CNAMEs and Multi-IP entries weren't working (credit: [Greg Cockburn](https://github.com/gergnz))
## 3.7.1 - 2017-07-03
### Changed
- (GH-29) Zone files are fully idempotent, so are only changed when actual content changes (credit: [@Stuart Knight](https://github.com/blofeldthefish))
## 3.7.0 - 2017-06-01
### Added
- (GH-10) Implement reverse IPv6 lookups
- (GH-28) Add option `bind_forwarders` and `bind_forward_only`, which allows BIND to be set up as a caching name server.
## 3.6.1 - 2017-06-01
### Changed
- Fixed a bug with generating the reverse zone names.
## 3.6.0 - 2017-06-01
### Changed
- (GH-25) Allow slave log file to be set with variable `bind_log` instead of a hard coded value (credit @kartone).
- The alignment of columns in the reverse zone file are improved
### Added
- (GH-22, 23) Documentation improvements
- (GH-27) Allow dynamic updates (credit: @bverschueren)
### Removed
- The custom filter plugins were removed. The functionality has since been added to Ansible's built-in filter plugins. This does require `python-netaddr` to be installed on the management node.
## 3.5.2 - 2016-09-29
### Changed
* The call to `named-checkconf` was fixed. It had the full path to the binary, which is not the same on all distributions. (GH-20, credit @peterjanes)
## 3.5.1 - 2016-09-22
### Changed
* The check for master/slave server is improved (GH-19, credit @josetaas)
## 3.5.0 - 2016-07-28
### Added
* Introduced role variable `bind_log`, the path to the log file.
* Introduced role variable `bind_zone_also_notify`, a list of servers that will receive a notification when the master zone file is reloaded (GH-18, credit: Joanna Delaporte)
* Reverse zone files now handle the case with only a single host (GH-18, credit: Joanna Delaporte)
## 3.4.0 - 2016-05-26
### Added
* (GH-16) Support for service record (SRV) lookups
* Support for text record (TXT) lookups
### Changed
* Fixed Ansible 2.0 deprecation warnings
* Generating a serial is no longer considered a change
* Ensured that all role variables have a default value, e.g. empty list instead of undefined. This simplifies template logic (no `if defined` tests), and is considered [deprecated in playbooks within a *with_* loop](https://docs.ansible.com/ansible/porting_guide_2.0.html#deprecated).
## 3.3.1 - 2016-04-08
### Removed
* The `version:` field in `meta/main.yml`. This an unofficial field that is used by a third-party tool for managing role dependencies (librarian-ansible). Custom meta fields are no longer accepted in Ansible 2.0. See [ansible/ansible#13496](https://github.com/ansible/ansible/issues/13496) for more info. Unfortunately, this will break support for librarian-ansible. As a workaround, until this issue is resolved upstream, use version 3.3.0 of this role.
## 3.3.0 - 2016-04-08
### Added
* Added role variable `bind_other_name_servers` for adding NS records for DNS servers outside of the domain. (GH-12)
* Re-added `bind_recursion`, as it is needed in some cases. (GH-14)
### Removed
## 3.2.1 - 2015-12-15
### Added
* The domain name can now also point to an IP address, enabling e.g. "http://example.com/" (GH-11)
## 3.2.0 - 2015-12-07
### Added
* Add support for multiple IP addresses per host (GH-9)
* Allow setting `rrset-order` (for DNS round robin)
* Add support for (multiple) IPv6 (AAAA) records (GH-2). For now, only forward lookups are supported.
### Changed
* Test code is put into a separate branch. This means that test code is no longer included when installing the role from Ansible Galaxy.
## 3.1.0 - 2015-12-04
### Added
* Add support for zone transfers (GH-8)
* Check whether `bind_zone_master_server_ip` was set (GH-7)
### Removed
* Role variable `bind_recursion` was removed. This role is explicitly only suitable for an authoritative DNS server, and in this case, recursion should be off.
## 3.0.0 - 2015-06-14
### Added
* You can now set up a master and slave DNS server.
* The variable `bind_zone_master_server_ip` was added. This is a **required** variable, which makes this release not backwards compatible.
* Automated acceptance tests for the test playbook
## 2.0.0 - 2015-06-10
### Added
* Added EL6 to supported platforms. Thanks to @rilindo for verifying this.
### Changed
* Recursion is turned off by default, which fits an authoritative name server. This change is not backwards compatible, as the behaviour of BIND is different from before when you do not set the variable `bind_recursion` explicitly.
### Removed
* Firewall settings. This should not be a concern of this role. Configuring the firewall is functionality offered by other roles (e.g. [bertvv.bind](https://github.com/bertvv/ansible-role-el7))
## 1.0.0 - 2015-04-22
First release!
### Added
- Functionality for master DNS server
- Multiple reverse lookup zones

13
roles/bertvv.bind/LICENSE.md Normal file
View File

@@ -0,0 +1,13 @@
# BSD License
Copyright (c) 2014, Bert Van Vreckem, (bert.vanvreckem@gmail.com)
All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

317
roles/bertvv.bind/README.md Normal file
View File

@@ -0,0 +1,317 @@
# Ansible role `bind`
[![Build Status](https://travis-ci.org/bertvv/ansible-role-bind.svg?branch=master)](https://travis-ci.org/bertvv/ansible-role-bind)
An Ansible role for setting up BIND ISC as an **authoritative-only** DNS server for multiple domains. Specifically, the responsibilities of this role are to:
- install BIND
- set up the main configuration file
- master server
- slave server
- set up forward and reverse lookup zone files
This role supports multiple forward and reverse zones, including for IPv6. Although enabling recursion is supported (albeit *strongly* discouraged), consider using another role if you want to set up a caching or forwarding name server.
Configuring the firewall is not a concern of this role, so you should do this using another role (e.g. [bertvv.rh-base](https://galaxy.ansible.com/bertvv/rh-base/)).
If you like/use this role, please consider giving it a star and rating it on the role's [Ansible Galaxy page](https://galaxy.ansible.com/bertvv/bind). Thanks!
See the [change log](CHANGELOG.md) for notable changes between versions.
## Requirements
- **The package `python-ipaddr` should be installed on the management node** (since v3.7.0)
## Role Variables
Variables are not required, unless specified.
| Variable | Default | Comments (type) |
| :--- | :--- | :--- |
| `bind_acls` | `[]` | A list of ACL definitions, which are dicts with fields `name` and `match_list`. See below for an example. |
| `bind_allow_query` | `['localhost']` | A list of hosts that are allowed to query this DNS server. Set to ['any'] to allow all hosts |
| `bind_allow_recursion` | `['any']` | Similar to bind_allow_query, this option applies to recursive queries. |
| `bind_check_names` | `[]` | Check host names for compliance with RFC 952 and RFC 1123 and take the defined action (e.g. `warn`, `ignore`, `fail`). |
| `bind_dns_keys` | `[]` | A list of binding keys, which are dicts with fields `name` `algorithm` and `secret`. See below for an example. |
| `bind_dnssec_enable` | `true` | Is DNSSEC enabled |
| `bind_dnssec_validation` | `true` | Is DNSSEC validation enabled |
| `bind_extra_include_files` | `[]` | |
| `bind_forward_only` | `false` | If `true`, BIND is set up as a caching name server |
| `bind_forwarders` | `[]` | A list of name servers to forward DNS requests to. |
| `bind_listen_ipv4` | `['127.0.0.1']` | A list of the IPv4 address of the network interface(s) to listen on. Set to ['any'] to listen on all interfaces. |
| `bind_listen_ipv6` | `['::1']` | A list of the IPv6 address of the network interface(s) to listen on |
| `bind_log` | `data/named.run` | Path to the log file |
| `bind_other_logs` | - | A list of logging channels to configure, with a separate dict for each domain, with relevant details |
| `- allow_update` | `['none']` | A list of hosts that are allowed to dynamically update this DNS zone. |
| `- also_notify` | - | A list of servers that will receive a notification when the master zone file is reloaded. |
| `- delegate` | `[]` | Zone delegation. See below this table for examples. |
| `bind_query_log` | - | A dict with fields `file` (e.g. `data/query.log`), `versions`, `size`, when defined this will turn on the query log |
| `bind_recursion` | `false` | Determines whether requests for which the DNS server is not authoritative should be forwarded†. |
| `bind_rrset_order` | `random` | Defines order for DNS round robin (either `random` or `cyclic`) |
| `bind_statistcs_channels` | `false` | if `true`, BIND is configured with a statistics_channels clause (currently only supports a single inet) |
| `bind_zone_dir` | - | When defined, sets a custom absolute path to the server directory (for zone files, etc.) instead of the default. |
| `bind_zone_domains` | n/a | A list of domains to configure, with a separate dict for each domain, with relevant details |
| `- allow_update` | `['none']` | A list of hosts that are allowed to dynamically update this DNS zone. |
| `- also_notify` | - | A list of servers that will receive a notification when the master zone file is reloaded. |
| `- create_forward_zones` | - | When initialized and set to `false`, creation of forward zones will be skipped (resulting in a reverse only zone) |
| `- create_reverse_zones` | - | When initialized and set to `false`, creation of reverse zones will be skipped (resulting in a forward only zone) |
| `- delegate` | `[]` | Zone delegation. See below this table for examples. |
| `- hostmaster_email` | `hostmaster` | The e-mail address of the system administrator for the zone |
| `- hosts` | `[]` | Host definitions. See below this table for examples. |
| `- ipv6_networks` | `[]` | A list of the IPv6 networks that are part of the domain, in CIDR notation (e.g. 2001:db8::/48) |
| `- mail_servers` | `[]` | A list of dicts (with fields `name` and `preference`) specifying the mail servers for this domain. |
| `- name_servers` | `[ansible_hostname]` | A list of the DNS servers for this domain. |
| `- name` | `example.com` | The domain name |
| `- networks` | `['10.0.2']` | A list of the networks that are part of the domain |
| `- other_name_servers` | `[]` | A list of the DNS servers outside of this domain. |
| `- services` | `[]` | A list of services to be advertised by SRV records |
| `- text` | `[]` | A list of dicts with fields `name` and `text`, specifying TXT records. `text` can be a list or string. |
| `- naptr` | `[]` | A list of dicts with fields `name`, `order`, `pref`, `flags`, `service`, `regex` and `replacement` specifying NAPTR records. |
| `bind_zone_file_mode` | 0640 | The file permissions for the main config file (named.conf) |
| `bind_zone_master_server_ip` | - | **(Required)** The IP address of the master DNS server. |
| `bind_zone_minimum_ttl` | `1D` | Minimum TTL field in the SOA record. |
| `bind_zone_time_to_expire` | `1W` | Time to expire field in the SOA record. |
| `bind_zone_time_to_refresh` | `1D` | Time to refresh field in the SOA record. |
| `bind_zone_time_to_retry` | `1H` | Time to retry field in the SOA record. |
| `bind_zone_ttl` | `1W` | Time to Live field in the SOA record. |
† Best practice for an authoritative name server is to leave recursion turned off. However, [for some cases](http://www.zytrax.com/books/dns/ch7/queries.html#allow-query-cache) it may be necessary to have recursion turned on.
### Minimal variables for a working zone
Even though only variable `bind_zone_master_server_ip` is required for the role to run without errors, this is not sufficient to get a working zone. In order to set up an authoritative name server that is available to clients, you should also at least define the following variables:
| Variable | Master | Slave |
| :--- | :---: | :---: |
| `bind_zone_domains` | V | V |
| `- name` | V | V |
| `- networks` | V | V |
| `- name_servers` | V | -- |
| `- hosts` | V | -- |
| `bind_listen_ipv4` | V | V |
| `bind_allow_query` | V | V |
### Domain definitions
```Yaml
bind_zone_domains:
- name: mydomain.com # Domain name
create_reverse_zones: false # Skip creation of reverse zones
hosts:
- name: pub01
ip: 192.0.2.1
ipv6: 2001:db8::1
aliases:
- ns
- name: '@' # Enables "http://mydomain.com/"
ip:
- 192.0.2.2 # Multiple IP addresses for a single host
- 192.0.2.3 # results in DNS round robin
sshfp: # Secure shell fingerprint
- "3 1 1262006f9a45bb36b1aa14f45f354b694b77d7c3"
- "3 2 e5921564252fe10d2dbafeb243733ed8b1d165b8fa6d5a0e29198e5793f0623b"
ipv6:
- 2001:db8::2
- 2001:db8::3
aliases:
- www
- name: priv01 # This IP is in another subnet, will result in
ip: 10.0.0.1 # multiple reverse zones
- name: mydomain.net.
aliases:
- name: sub01
type: DNAME # Example of a DNAME alias record
networks:
- '192.0.2'
- '10'
- '172.16'
delegate:
- zone: foo
dns: 192.0.2.1
services:
- name: _ldap._tcp
weight: 100
port: 88
target: dc001
naptr: # Name Authority Pointer record, used for IP
- name: "sip" # telephony
order: 100
pref: 10
flags: "S"
service: "SIP+D2T"
regex: "!^.*$!sip:customer-service@example.com!"
replacement: "_sip._tcp.example.com."
```
### Minimal slave configuration
```Yaml
bind_listen_ipv4: ['any']
bind_allow_query: ['any']
bind_zone_master_server_ip: 192.168.111.222
bind_zone_domains:
- name: example.com
```
### Hosts
Host names that this DNS server should resolve can be specified in `hosts` as a list of dicts with fields `name`, `ip`, `aliases` and `sshfp`. Aliases can be CNAME (default) or DNAME records.
To allow to surf to `http://example.com/`, set the host name of your web server to `'@'` (must be quoted!). In BIND syntax, `@` indicates the domain name itself.
If you want to specify multiple IP addresses for a host, add entries to `bind_zone_hosts` with the same name (e.g. `priv01` in the code snippet). This results in multiple A/AAAA records for that host and allows [DNS round robin](http://www.zytrax.com/books/dns/ch9/rr.html), a simple load balancing technique. The order in which the IP addresses are returned can be configured with role variable `bind_rrset_order`.
### Networks
As you can see, not all hosts are in the same network. This is perfectly acceptable, and supported by this role. All networks should be specified in `networks` (part of bind_zone_domains.name dict), though, or the host will not get a PTR record for reverse lookup:
Remark that only the network part should be specified here! When specifying a class B IP address (e.g. "172.16") in a variable file, it must be quoted. Otherwise, the Yaml parser will interpret it as a float.
Based on the idea and examples detailed at <https://linuxmonk.ch/wordpress/index.php/2016/managing-dns-zones-with-ansible/> for the gdnsd package, the zonefiles are fully idempotent, and thus only get updated if "real" content changes.
### Zone delgation
To delegate a zone to a DNS, it is enough to create a `NS` record (under delegate) which is the equivalent of:
```text
foo IN NS 192.0.2.1
```
### Service records
Service (SRV) records can be added with the services. This should be a list of dicts with mandatory fields `name` (service name), `target` (host providing the service), `port` (TCP/UDP port of the service) and optional fields `priority` (default = 0) and `weight` (default = 0).
### ACLs
ACLs can be defined like this:
```Yaml
bind_acls:
- name: acl1
match_list:
- 192.0.2.0/24
- 10.0.0.0/8
```
The names of the ACLs will be added to the `allow-transfer` clause in global options.
### Binding Keys
Binding keys can be defined like this:
```Yaml
bind_dns_keys:
- name: master_key
algorithm: hmac-sha256
secret: "azertyAZERTY123456"
bind_extra_include_files:
- "{{ bind_auth_file }}"
```
**tip**: Extra include file must be set as an ansible variable because file is OS dependant
This will be set in a file *"{{ bind_auth_file }}* (e.g. /etc/bind/auth_transfer.conf for debian) which have to be added in the list variable **bind_extra_include_files**
## Dependencies
No dependencies.
## Example Playbook
See the test playbook [converge.yml](molecule/default/converge.yml) for an elaborate example that showcases most features.
## Testing
This role is tested using [Ansible Molecule](https://molecule.readthedocs.io/). Tests are launched automatically on [Travis CI](https://travis-ci.org/bertvv/ansible-role-bind) after each commit and PR.
This Molecule configuration will:
- Run Yamllint and Ansible Lint
- Create two Docker containers, one primary (`ns1`) and one secondary (`ns2`) DNS server
- Run a syntax check
- Apply the role with a [test playbook](molecule/default/converge.yml)
- Run acceptance tests with [BATS](https://github.com/bats-core/bats-core/)
This process is repeated for the supported Linux distributions.
### Local test environment
If you want to set up a local test environment, you can use this reproducible setup based on Vagrant+VirtualBox: <https://github.com/bertvv/ansible-testenv>. Steps to install the necessary tools manually:
1. Docker and BATS should be installed on your machine (assumed to run Linux). No Docker containers should be running when you start the test.
2. As recommended by Molecule, create a python virtual environment
3. Install the software tools `python3 -m pip install molecule docker netaddr yamllint ansible-lint`
4. Navigate to the root of the role directory and run `molecule test`
Molecule automatically deletes the containers after a test. If you would like to check out the containers yourself, run `molecule converge` followed by `molecule login --host HOSTNAME`.
The Docker containers are based on images created by [Jeff Geerling](https://hub.docker.com/u/geerlingguy), specifically for Ansible testing (look for images named `geerlingguy/docker-DISTRO-ansible`). You can use any of his images, but only the distributions mentioned in [meta/main.yml](meta/main.yml) are supported.
The default config will start two Centos 7 containers (the primary supported platform at this time). Choose another distro by setting the `MOLECULE_DISTRO` variable with the command, e.g.:
``` bash
MOLECULE_DISTRO=debian9 molecule test
```
or
``` bash
MOLECULE_DISTRO=debian9 molecule converge
```
You can run the acceptance tests on both servers with `molecule verify` or manually with
```console
SUT_IP=172.17.0.2 bats molecule/default/files/dns.bats
```
You need to initialise the variable `SUT_IP`, the system under test's IP address. The primary server, `ns1`, should have IP address 172.17.0.2 and the secondary server, `ns2` 172.17.0.3.
## License
BSD
## Contributors
This role could only have been realized thanks to the contributions of many. If you have an idea to improve it even further, don't hesitate to pitch in!
Issues, feature requests, ideas, suggestions, etc. can be posted in the Issues section.
Pull requests are also very welcome. Please create a topic branch for your proposed changes. If you don't, this will create conflicts in your fork after the merge. Don't hesitate to add yourself to the contributor list below in your PR!
Maintainers:
- [Bert Van Vreckem](https://github.com/bertvv/)
- [Stuart Knight](https://github.com/blofeldthefish)
Contributors:
- [Aido](https://github.com/aido)
- [Angel Barrera](https://github.com/angelbarrera92)
- [B. Verschueren](https://github.com/bverschueren)
- [Boris Momčilović](https://github.com/kornrunner)
- [Brad Durrow](https://github.com/bdurrow)
- [Christopher Hicks](http://www.chicks.net/)
- [David J. Haines](https://github.com/dhaines)
- [Fabio Rocha](https://github.com/frock81)
- [Fazle Arefin](https://github.com/fazlearefin)
- [Greg Cockburn](https://github.com/gergnz)
- [Guillaume Darmont](https://github.com/gdarmont)
- [jadjay](https://github.com/jadjay)
- [Jascha Sticher](https://github.com/itbane)
- [Joanna Delaporte](https://github.com/jdelaporte)
- [Jörg Eichhorn](https://github.com/jeichhorn)
- [Jose Taas](https://github.com/josetaas)
- [Lennart Weller](https://github.com/lhw)
- [Loic Dachary](http://dachary.org)
- [Mario Ciccarelli](https://github.com/kartone)
- [Otto Sabart](https://github.com/seberm)
- [Paulius Mazeika](https://github.com/pauliusm)
- [Paulo E. Castro](https://github.com/pecastro)
- [Peter Janes](https://github.com/peterjanes)
- [psa](https://github.com/psa)
- [Rafael Bodill](https://github.com/rafi)
- [Rayford Johnson](https://github.com/rayfordj)
- [Robin Ophalvens](https://github.com/RobinOphalvens)
- [Romuald](https://github.com/rds13)
- [Tom Meinlschmidt](https://github.com/tmeinlschmidt)

70
roles/bertvv.bind/defaults/main.yml Normal file
View File

@@ -0,0 +1,70 @@
# roles/bind/defaults/main.yml
---
bind_log: "data/named.run"
bind_zone_domains:
- name: "example.com"
hostmaster_email: "hostmaster"
networks:
- "10.0.2"
# List of acls.
bind_acls: []
# Key binding for slaves
bind_dns_keys: []
# - name: master_key
# algorithm: hmac-sha256
# secret: "azertyAZERTY123456"
# List of IPv4 address of the network interface(s) to listen on. Set to "any"
# to listen on all interfaces
bind_listen_ipv4:
- "127.0.0.1"
# List of IPv6 address of the network interface(s) to listen on.
bind_listen_ipv6:
- "::1"
# List of hosts that are allowed to query this DNS server.
bind_allow_query:
- "localhost"
# Determines whether recursion should be allowed. Typically, an authoritative
# name server should have recursion turned OFF.
bind_recursion: false
bind_allow_recursion:
- "any"
# Allows BIND to be set up as a caching name server
bind_forward_only: false
# List of name servers to forward DNS requests to.
bind_forwarders: []
# DNS round robin order (random or cyclic)
bind_rrset_order: "random"
# statistics channels configuration
bind_statistics_channels: false
bind_statistics_port: 8053
bind_statistics_host: 127.0.0.1
bind_statistics_allow:
- "127.0.0.1"
# DNSSEC configuration
bind_dnssec_enable: true
bind_dnssec_validation: true
bind_extra_include_files: []
# SOA information
bind_zone_ttl: "1W"
bind_zone_time_to_refresh: "1D"
bind_zone_time_to_retry: "1H"
bind_zone_time_to_expire: "1W"
bind_zone_minimum_ttl: "1D"
# File mode for master zone files (needs to be something like 0660 for dynamic updates)
bind_zone_file_mode: "0640"

7
roles/bertvv.bind/handlers/main.yml Normal file
View File

@@ -0,0 +1,7 @@
# roles/bind/handlers/main.yml
---
- name: reload bind
service:
name: "{{ bind_service }}"
state: reloaded

2
roles/bertvv.bind/meta/.galaxy_install_info Normal file
View File

@@ -0,0 +1,2 @@
install_date: Sun Jun 28 14:49:10 2020
version: v4.2.0

34
roles/bertvv.bind/meta/main.yml Normal file
View File

@@ -0,0 +1,34 @@
---
galaxy_info:
author: Bert Van Vreckem
description: >
Sets up ISC BIND as an authoritative DNS server for one or more domains
(primary and/or secondary).
license: BSD
min_ansible_version: 2.7
platforms:
- name: ArchLinux
versions:
- any
- name: Debian
versions:
- jessie
- stretch
- buster
- name: FreeBSD
versions:
- any
- name: EL
versions:
- 7
- 8
- name: Ubuntu
versions:
- xenial
- bionic
- focal
galaxy_tags:
- dns
- networking
- system
dependencies: []

117
roles/bertvv.bind/molecule/default/converge.yml Normal file
View File

@@ -0,0 +1,117 @@
---
- name: Converge
hosts: all
vars:
bind_zone_dir: /var/local/named-zones
bind_zone_file_mode: '0660'
bind_allow_query:
- any
bind_listen_ipv4:
- any
bind_listen_ipv6:
- any
bind_acls:
- name: acl1
match_list:
- 172.17.0.0/16
bind_forwarders:
- '8.8.8.8'
- '8.8.4.4'
bind_recursion: true
bind_query_log: 'data/query.log'
bind_check_names: 'master ignore'
bind_zone_master_server_ip: 172.17.0.2
bind_zone_minimum_ttl: "2D"
bind_zone_ttl: "2W"
bind_zone_time_to_refresh: "2D"
bind_zone_time_to_retry: "2H"
bind_zone_time_to_expire: "2W"
bind_zone_domains:
- name: 'example.com'
networks:
- '192.0.2'
ipv6_networks:
- '2001:db9::/48'
name_servers:
- ns1.acme-inc.com.
- ns2.acme-inc.com.
hostmaster_email: admin
hosts:
- name: srv001
ip: 192.0.2.1
ipv6: '2001:db9::1'
aliases:
- www
- name: srv002
ip: 192.0.2.2
ipv6: '2001:db9::2'
- name: mail001
ip: 192.0.2.10
ipv6: '2001:db9::3'
mail_servers:
- name: mail001
preference: 10
- name: 'acme-inc.com'
networks:
- '172.17'
- '10'
ipv6_networks:
- '2001:db8::/48'
name_servers:
- ns1
- ns2
hosts:
- name: ns1
ip: 172.17.0.2
- name: ns2
ip: 172.17.0.3
- name: srv001
ip: 172.17.1.1
ipv6: 2001:db8::1
aliases:
- www
- name: srv002
ip: 172.17.1.2
ipv6: 2001:db8::2
aliases:
- mysql
- name: mail001
ip: 172.17.2.1
ipv6: 2001:db8::d:1
aliases:
- smtp
- mail-in
- name: mail002
ip: 172.17.2.2
ipv6: 2001:db8::d:2
- name: mail003
ip: 172.17.2.3
ipv6: 2001:db8::d:3
aliases:
- imap
- mail-out
- name: srv010
ip: 10.0.0.10
- name: srv011
ip: 10.0.0.11
- name: srv012
ip: 10.0.0.12
mail_servers:
- name: mail001
preference: 10
- name: mail002
preference: 20
services:
- name: _ldap._tcp
weight: 100
port: 88
target: srv010
text:
- name: _kerberos
text: KERBEROS.ACME-INC.COM
- name: '@'
text:
- 'some text'
- 'more text'
roles:
- role: bertvv.bind

263
roles/bertvv.bind/molecule/default/files/dns.bats Normal file
View File

@@ -0,0 +1,263 @@
#! /usr/bin/env bats
#
# Functional tests for a DNS server set up as a test case for Ansible role
# bertvv.bind
#
# The variable SUT_IP, the IP address of the System Under Test must be set
# outside of the script.
#{{{ Helper functions
# Usage: assert_forward_lookup NAME DOMAIN IP
# Exits with status 0 if NAME.DOMAIN resolves to IP, a nonzero
# status otherwise
assert_forward_lookup() {
local name="$1"
local domain="$2"
local ip="$3"
local result
result=$(dig @"${SUT_IP}" "${name}.${domain}" +short)
echo "Expected: ${ip}"
echo "Actual : ${result}"
[ "${ip}" = "${result}" ]
}
# Usage: assert_forward_ipv6_lookup NAME DOMAIN IP
assert_forward_ipv6_lookup() {
local name="${1}"
local domain="${2}"
local ip="${3}"
local result
result=$(dig @"${SUT_IP}" AAAA "${name}.${domain}" +short)
echo "Expected: ${ip}"
echo "Actual : ${result}"
[ "${ip}" = "${result}" ]
}
# Usage: assert_reverse_lookup NAME DOMAIN IP
# Exits with status 0 if a reverse lookup on IP resolves to NAME,
# a nonzero status otherwise
assert_reverse_lookup() {
local name="$1"
local domain="$2"
local ip="$3"
local expected="${name}.${domain}."
local result
result=$(dig @"${SUT_IP}" -x "${ip}" +short)
echo "Expected: ${expected}"
echo "Actual : ${result}"
[ "${expected}" = "${result}" ]
}
# Usage: assert_alias_lookup ALIAS NAME DOMAIN IP
# Exits with status 0 if a forward lookup on NAME resolves to the
# host name NAME.DOMAIN and to IP, a nonzero status otherwise
assert_alias_lookup() {
local alias="$1"
local name="$2"
local domain="$3"
local ip="$4"
local result
result=$(dig @"${SUT_IP}" "${alias}.${domain}" +short)
grep "${name}\\.${domain}\\." <<< "${result}"
grep "${ip}" <<< "${result}"
}
# Usage: assert_ns_lookup DOMAIN NS_NAME...
# Exits with status 0 if all specified host names occur in the list of
# name servers for the domain.
assert_ns_lookup() {
local domain="${1}"
shift
local result
result=$(dig @"${SUT_IP}" "${domain}" NS +short)
[ -n "${result}" ] # the list of name servers should not be empty
while (( "$#" )); do
grep "$1\\." <<< "${result}"
shift
done
}
# Usage: assert_mx_lookup DOMAIN PREF1 NAME1 PREF2 NAME2...
# e.g. assert_mx_lookup example.com 10 mailsrv1 20 mailsrv2
# Exits with status 0 if all specified host names occur in the list of
# mail servers for the domain.
assert_mx_lookup() {
local domain="${1}"
shift
local result
result=$(dig @"${SUT_IP}" "${domain}" MX +short)
[ -n "${result}" ] # the list of name servers should not be empty
while (( "$#" )); do
grep "$1 $2\\.${domain}\\." <<< "${result}"
shift
shift
done
}
# Usage: assert_srv_lookup DOMAIN SERVICE WEIGHT PORT TARGET
# e.g. assert_srv_lookup example.com _ldap._tcp 0 100 88 ldapsrv
assert_srv_lookup() {
local domain="${1}"
shift
local service="${1}"
shift
local expected="${*}.${domain}."
local result
result=$(dig @"${SUT_IP}" SRV "${service}.${domain}" +short)
echo "expected: ${expected}"
echo "actual : ${result}"
[ "${result}" = "${expected}" ]
}
# Perform a TXT record lookup
# Usage: assert_txt_lookup NAME TEXT...
# e.g. assert_txt_lookup _kerberos.example.com KERBEROS.EXAMPLE.COM
assert_txt_lookup() {
local name="$1"
shift
local result
result=$(dig @"${SUT_IP}" TXT "${name}" +short)
echo "expected: ${*}"
echo "actual : ${result}"
while [ "$#" -ne "0" ]; do
grep "${1}" <<< "${result}"
shift
done
}
#}}}
@test "Forward lookups acme-inc.com" {
# host name domain IP
assert_forward_lookup ns1 acme-inc.com 172.17.0.2
assert_forward_lookup ns2 acme-inc.com 172.17.0.3
assert_forward_lookup srv001 acme-inc.com 172.17.1.1
assert_forward_lookup srv002 acme-inc.com 172.17.1.2
assert_forward_lookup mail001 acme-inc.com 172.17.2.1
assert_forward_lookup mail002 acme-inc.com 172.17.2.2
assert_forward_lookup mail003 acme-inc.com 172.17.2.3
assert_forward_lookup srv010 acme-inc.com 10.0.0.10
assert_forward_lookup srv011 acme-inc.com 10.0.0.11
assert_forward_lookup srv012 acme-inc.com 10.0.0.12
}
@test "Reverse lookups acme-inc.com" {
# host name domain IP
assert_reverse_lookup ns1 acme-inc.com 172.17.0.2
assert_reverse_lookup ns2 acme-inc.com 172.17.0.3
assert_reverse_lookup srv001 acme-inc.com 172.17.1.1
assert_reverse_lookup srv002 acme-inc.com 172.17.1.2
assert_reverse_lookup mail001 acme-inc.com 172.17.2.1
assert_reverse_lookup mail002 acme-inc.com 172.17.2.2
assert_reverse_lookup mail003 acme-inc.com 172.17.2.3
assert_reverse_lookup srv010 acme-inc.com 10.0.0.10
assert_reverse_lookup srv011 acme-inc.com 10.0.0.11
assert_reverse_lookup srv012 acme-inc.com 10.0.0.12
}
@test "Alias lookups acme-inc.com" {
# alias hostname domain IP
assert_alias_lookup www srv001 acme-inc.com 172.17.1.1
assert_alias_lookup mysql srv002 acme-inc.com 172.17.1.2
assert_alias_lookup smtp mail001 acme-inc.com 172.17.2.1
assert_alias_lookup mail-in mail001 acme-inc.com 172.17.2.1
assert_alias_lookup imap mail003 acme-inc.com 172.17.2.3
assert_alias_lookup mail-out mail003 acme-inc.com 172.17.2.3
}
@test "IPv6 forward lookups acme-inc.com" {
# hostname domain IPv6
assert_forward_ipv6_lookup srv001 acme-inc.com 2001:db8::1
assert_forward_ipv6_lookup srv002 acme-inc.com 2001:db8::2
assert_forward_ipv6_lookup mail001 acme-inc.com 2001:db8::d:1
assert_forward_ipv6_lookup mail002 acme-inc.com 2001:db8::d:2
assert_forward_ipv6_lookup mail003 acme-inc.com 2001:db8::d:3
}
@test "IPv6 reverse lookups acme-inc.com" {
# hostname domain IPv6
assert_forward_ipv6_lookup srv001 acme-inc.com 2001:db8::1
assert_forward_ipv6_lookup srv002 acme-inc.com 2001:db8::2
assert_forward_ipv6_lookup mail001 acme-inc.com 2001:db8::d:1
assert_forward_ipv6_lookup mail002 acme-inc.com 2001:db8::d:2
assert_forward_ipv6_lookup mail003 acme-inc.com 2001:db8::d:3
}
@test "NS record lookup acme-inc.com" {
assert_ns_lookup acme-inc.com \
ns1.acme-inc.com \
ns2.acme-inc.com
}
@test "Mail server lookup acme-inc.com" {
assert_mx_lookup acme-inc.com \
10 mail001 \
20 mail002
}
@test "Service record lookup acme-inc.com" {
assert_srv_lookup acme-inc.com _ldap._tcp 0 100 88 srv010
}
@test "TXT record lookup acme-inc.com" {
assert_txt_lookup _kerberos.acme-inc.com KERBEROS.ACME-INC.COM
assert_txt_lookup acme-inc.com "some text" "more text"
}
# Tests for domain example.com
@test "Forward lookups example.com" {
# host name domain IP
assert_forward_lookup srv001 example.com 192.0.2.1
assert_forward_lookup srv002 example.com 192.0.2.2
assert_forward_lookup mail001 example.com 192.0.2.10
}
@test "Reverse lookups example.com" {
# host name domain IP
assert_reverse_lookup srv001 example.com 192.0.2.1
assert_reverse_lookup srv002 example.com 192.0.2.2
assert_reverse_lookup mail001 example.com 192.0.2.10
}
@test "Alias lookups example.com" {
# alias hostname domain IP
assert_alias_lookup www srv001 example.com 192.0.2.1
}
@test "IPv6 forward lookups example.com" {
# hostname domain IPv6
assert_forward_ipv6_lookup srv001 example.com 2001:db9::1
}
@test "IPv6 reverse lookups example.com" {
# hostname domain IPv6
assert_reverse_lookup srv001 example.com 2001:db9::1
}
@test "NS record lookup example.com" {
assert_ns_lookup example.com \
ns1.acme-inc.com \
ns2.acme-inc.com
}
@test "Mail server lookup example.com" {
assert_mx_lookup example.com \
10 mail001
}

117
roles/bertvv.bind/molecule/default/files/functional-tests.sh Executable file
View File

@@ -0,0 +1,117 @@
#! /usr/bin/env bash
#
# Author: Bert Van Vreckem <bert.vanvreckem@gmail.com>
#
# Run BATS test files in the current directory, and the ones in the subdirectory
# matching the host name.
#
# The script installs BATS if needed. It's best to put ${bats_install_dir} in
# your .gitignore.
set -o errexit # abort on nonzero exitstatus
set -o nounset # abort on unbound variable
#{{{ Variables
test_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
bats_archive="v0.4.0.tar.gz"
bats_url="https://github.com/sstephenson/bats/archive/${bats_archive}"
bats_install_dir="/opt"
bats_default_location="${bats_install_dir}/bats/libexec/bats"
test_file_pattern="*.bats"
# Color definitions
readonly reset='\e[0m'
readonly black='\e[0;30m'
readonly red='\e[0;31m'
readonly green='\e[0;32m'
readonly yellow='\e[0;33m'
readonly blue='\e[0;34m'
readonly purple='\e[0;35m'
readonly cyan='\e[0;36m'
readonly white='\e[0;37m'
#}}}
main() {
bats=$(find_bats_executable)
if [ -z "${bats}" ]; then
install_bats
bats="${bats_default_location}"
fi
debug "Using BATS executable at: ${bats}"
# List all test cases (i.e. files in the test dir matching the test file
# pattern)
# Tests to be run on all hosts
global_tests=$(find_tests "${test_dir}" 1)
# Tests for individual hosts
host_tests=$(find_tests "${test_dir}/${HOSTNAME}")
# Loop over test files
for test_case in ${global_tests} ${host_tests}; do
info "Running test ${test_case}"
${bats} "${test_case}"
done
}
#{{{ Functions
# Tries to find BATS executable in the PATH or the place where this script
# installs it.
find_bats_executable() {
if which bats > /dev/null; then
which bats
elif [ -x "${bats_default_location}" ]; then
echo "${bats_default_location}"
else
echo ""
fi
}
# Usage: install_bats
install_bats() {
pushd "${bats_install_dir}" > /dev/null 2>&1
curl --location --remote-name "${bats_url}"
tar xzf "${bats_archive}"
mv bats-* bats
rm "${bats_archive}"
popd > /dev/null 2>&1
}
# Usage: find_tests DIR [MAX_DEPTH]
#
# Finds BATS test suites in the specified directory
find_tests() {
local max_depth=""
if [ "$#" -eq "2" ]; then
max_depth="-maxdepth $2"
fi
local tests
tests=$(find "$1" ${max_depth} -type f -name "${test_file_pattern}" -printf '%p\n' 2> /dev/null)
echo "${tests}"
}
# Usage: info [ARG]...
#
# Prints all arguments on the standard output stream
info() {
printf "${yellow}### %s${reset}\n" "${*}"
}
# Usage: debug [ARG]...
#
# Prints all arguments on the standard output stream
debug() {
printf "${cyan}### %s${reset}\n" "${*}"
}
#}}}
main

53
roles/bertvv.bind/molecule/default/molecule.yml Normal file
View File

@@ -0,0 +1,53 @@
---
dependency:
name: galaxy
driver:
# Specifies the driver that should be used. Podman should also work
name: docker
# Linting with yamllint and ansible-lint
# verify.yml is skipped because it uses the shell: module, which would trigger
# a linting error.
lint: |
yamllint .
ansible-lint --exclude=molecule/default/verify.yml
platforms:
# Set name and hostname
- name: ns1
hostname: ns1
# Specify which image should be used. Geerlingguys images are Ansible
# compatible and have Systemd installed
image: "geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible:latest"
# Command to execute when the container starts
command: ${MOLECULE_DOCKER_COMMAND:-""}
# Volumes to mount within the container. Important to enable systemd
volumes:
- /sys/fs/cgroup:/sys/fs/cgroup:rw
# Give extended privileges to the container. Necessary for Systemd to
# operate within the container. DO NOT use extended privileges in a
# production environment!
privileged: true
# Allocate pseudo-TTY
tty: true
environment:
container: docker
- name: ns2
hostname: ns2
image: "geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible:latest"
command: ${MOLECULE_DOCKER_COMMAND:-""}
volumes:
- /sys/fs/cgroup:/sys/fs/cgroup:rw
privileged: true
tty: true
environment:
container: docker
provisioner:
name: ansible
# Runs the verify.yml playbook
verifier:
name: ansible

9
roles/bertvv.bind/molecule/default/verify.yml Normal file
View File

@@ -0,0 +1,9 @@
---
- name: Verify
hosts: all
tasks:
# We run the BATS tests from the localhost, since they are black box tests
- name: "Run BATS tests for {{ ansible_hostname }}"
shell: SUT_IP={{ ansible_default_ipv4.address }} bats {{ playbook_dir }}/files/dns.bats
delegate_to: localhost
changed_when: false

69
roles/bertvv.bind/tasks/main.yml Normal file
View File

@@ -0,0 +1,69 @@
# roles/bind/tasks/main.yml
---
# Initialise distribution-specific variables
- name: Source specific variables
include_vars: "{{ item }}"
with_first_found:
- "{{ ansible_distribution }}.yml"
- "{{ ansible_os_family }}.yml"
tags: bind,pretask
- name: Check whether `bind_zone_master_server_ip` was set
assert:
that: bind_zone_master_server_ip is defined
- name: Install BIND
package:
pkg: "{{ item }}"
state: present
with_items:
- "{{ bind_packages }}"
tags: bind
- name: Ensure runtime directories referenced in config exist
file:
path: "{{ item }}"
state: directory
owner: root
group: "{{ bind_group }}"
mode: 0770
with_items:
- "{{ bind_dir }}/dynamic"
- "{{ bind_dir }}/data"
- "{{ bind_zone_dir }}"
tags: bind
- name: Create serial, based on UTC UNIX time
command: date -u +%s
register: timestamp
changed_when: false
run_once: true
check_mode: false
tags: bind
# file to set keys for XFR authentication
- name: create extra config file for authenticated XFR request
tags: pretask
template:
src: auth_transfer.j2
dest: "{{ bind_conf_dir }}/{{ auth_file }}"
mode: 0640
owner: root
group: "{{ bind_group }}"
when: bind_dns_keys is defined and bind_dns_keys|length > 0
- name: Set up the machine as a master DNS server
include_tasks: master.yml
when: bind_zone_master_server_ip in ansible_all_ipv4_addresses
- name: Set up the machine as a slave DNS server
include_tasks: slave.yml
when: bind_zone_master_server_ip not in ansible_all_ipv4_addresses
- name: Start BIND service
service:
name: "{{ bind_service }}"
state: started
enabled: true
tags: bind

140
roles/bertvv.bind/tasks/master.yml Normal file
View File

@@ -0,0 +1,140 @@
# roles/bind/tasks/master.yml
# Set up a BIND master server
---
- name: Read forward zone hashes
shell: 'grep -s "^; Hash:" {{ bind_zone_dir }}/{{ item.name }} || true'
changed_when: false
check_mode: false
register: forward_hashes_temp
with_items:
- "{{ bind_zone_domains }}"
run_once: true
loop_control:
label: "{{ item.name }}"
- name: create dict of forward hashes
set_fact:
forward_hashes: "{{ forward_hashes|default([]) + [ {'hash': item.stdout|default(), 'name': item.item.name} ] }}"
with_items:
- "{{ forward_hashes_temp.results }}"
run_once: true
loop_control:
label: "{{ item.item.name }}"
- name: Read reverse ipv4 zone hashes
shell: "grep -s \"^; Hash:\" {{ bind_zone_dir }}/{{ ('.'.join(item.1.replace(item.1+'.','').split('.')[::-1])) }}.in-addr.arpa || true"
changed_when: false
check_mode: false
register: reverse_hashes_temp
with_subelements:
- "{{ bind_zone_domains }}"
- networks
- flags:
skip_missing: true
run_once: true
loop_control:
label: "{{ item.1 }}"
- name: create dict of reverse hashes
set_fact:
reverse_hashes: "{{ reverse_hashes|default([]) + [ {'hash': item.0.stdout|default(), 'network': item.1} ] }}"
with_subelements:
- "{{ reverse_hashes_temp.results }}"
- item
run_once: true
loop_control:
label: "{{ item.1.name |default(item.0.cmd.split(' ')[4]) }}"
- name: Read reverse ipv6 zone hashes
shell: "grep -s \"^; Hash:\" {{ bind_zone_dir }}/{{ (item.1 | ipaddr('revdns'))[-(9+(item.1|regex_replace('^.*/','')|int)//2):-1] }} || true"
changed_when: false
check_mode: false
register: reverse_hashes_ipv6_temp
with_subelements:
- "{{ bind_zone_domains }}"
- ipv6_networks
- flags:
skip_missing: true
run_once: true
loop_control:
label: "{{ item.1 }}"
- name: create dict of reverse ipv6 hashes
set_fact:
reverse_hashes_ipv6: "{{ reverse_hashes_ipv6|default([]) + [ {'hash': item.0.stdout|default(), 'network': item.1} ] }}"
with_subelements:
- "{{ reverse_hashes_ipv6_temp.results }}"
- item
run_once: true
loop_control:
label: "{{ item.1.name |default(item.0.cmd.split(' ')[4]) }}"
- name: Master | Main BIND config file (master)
template:
src: master_etc_named.conf.j2
dest: "{{ bind_config }}"
owner: "{{ bind_owner }}"
group: "{{ bind_group }}"
mode: '0640'
setype: named_conf_t
validate: 'named-checkconf %s'
notify: reload bind
tags: bind
- name: Master | Create forward lookup zone file
template:
src: bind_zone.j2
dest: "{{ bind_zone_dir }}/{{ item.name }}"
owner: "{{ bind_owner }}"
group: "{{ bind_group }}"
mode: "{{ bind_zone_file_mode }}"
setype: named_zone_t
validate: 'named-checkzone -d {{ item.name }} %s'
with_items:
- "{{ bind_zone_domains }}"
loop_control:
label: "{{ item.name }}"
when: item.create_forward_zones is not defined or item.create_forward_zones
notify: reload bind
tags: bind
- name: Master | Create reverse lookup zone file
template:
src: reverse_zone.j2
dest: "{{ bind_zone_dir }}/{{ ('.'.join(item.1.replace(item.1+'.','').split('.')[::-1])) }}.in-addr.arpa"
owner: "{{ bind_owner }}"
group: "{{ bind_group }}"
mode: "{{ bind_zone_file_mode }}"
setype: named_zone_t
validate: "named-checkzone {{ ('.'.join(item.1.replace(item.1+'.','').split('.')[::-1])) }}.in-addr.arpa %s"
with_subelements:
- "{{ bind_zone_domains }}"
- networks
- flags:
skip_missing: true
loop_control:
label: "{{ item.1 }}"
when: item.create_reverse_zones is not defined or item.create_reverse_zones
notify: reload bind
tags: bind
- name: Master | Create reverse IPv6 lookup zone file
template:
src: reverse_zone_ipv6.j2
dest: "{{ bind_zone_dir }}/{{ (item.1 | ipaddr('revdns'))[-(9+(item.1|regex_replace('^.*/','')|int)//2):-1] }}"
owner: "{{ bind_owner }}"
group: "{{ bind_group }}"
mode: "{{ bind_zone_file_mode }}"
setype: named_zone_t
validate: "named-checkzone {{ (item.1 | ipaddr('revdns'))[-(9+(item.1|regex_replace('^.*/','')|int)//2):] }} %s"
with_subelements:
- "{{ bind_zone_domains }}"
- ipv6_networks
- flags:
skip_missing: true
loop_control:
label: "{{ item.1 }}"
when: item.create_reverse_zones is not defined or item.create_reverse_zones
notify: reload bind
tags: bind

24
roles/bertvv.bind/tasks/slave.yml Normal file
View File

@@ -0,0 +1,24 @@
# roles/bind/tasks/master.yml
# Set up a BIND slave server
---
- name: Slave | Main BIND config file (slave)
template:
src: slave_etc_named.conf.j2
dest: "{{ bind_config }}"
owner: "{{ bind_owner }}"
group: "{{ bind_group }}"
mode: '0640'
setype: named_conf_t
validate: 'named-checkconf %s'
notify: reload bind
tags: bind
- name: Slave | ensure directory for cached slaves zones
file:
path: "{{ bind_dir }}/slaves"
state: directory
owner: "{{ bind_owner }}"
group: "{{ bind_group }}"
mode: '0770'
setype: named_cache_t

12
roles/bertvv.bind/templates/auth_transfer.j2 Normal file
View File

@@ -0,0 +1,12 @@
server {{ ansible_default_ipv4.address }} {
keys { {% for mykey in bind_dns_keys %} {{ mykey.name }}; {% endfor %} };
};
{% for mykey in bind_dns_keys %}
key {{ mykey.name }} {
algorithm {{ mykey.algorithm }};
secret "{{ mykey.secret }}";
{% endfor %}
};

140
roles/bertvv.bind/templates/bind_zone.j2 Normal file
View File

@@ -0,0 +1,140 @@
{#
# First create a dict holding the entire zone information and create a hash
# from it, that it can be compared with subsequent task executions. In this
# way the serial will only be updated if there are some content changes.
#}
{% set _zone_data = {} %}
{% set _ = _zone_data.update({'ttl': bind_zone_ttl}) %}
{% set _ = _zone_data.update({'domain': item.name}) %}
{% set _ = _zone_data.update({'mname': item.name_servers|default([])}) %}
{% set _ = _zone_data.update({'aname': item.other_name_servers|default([])}) %}
{% set _ = _zone_data.update({'mail': item.mail_servers|default([])}) %}
{% if item.hostmaster_email is defined %}
{% set _ = _zone_data.update({'rname': (( item.hostmaster_email )) + ('' if (item.hostmaster_email is search('\.')) else ('.' + _zone_data['domain']))}) %}
{% else %}
{% set _ = _zone_data.update({'rname': 'hostmaster.' + _zone_data['domain']}) %}
{% endif %}
{% set _ = _zone_data.update({'refresh': bind_zone_time_to_refresh}) %}
{% set _ = _zone_data.update({'retry': bind_zone_time_to_retry}) %}
{% set _ = _zone_data.update({'expire': bind_zone_time_to_expire}) %}
{% set _ = _zone_data.update({'minimum': bind_zone_minimum_ttl}) %}
{% set _ = _zone_data.update({'hosts': item.hosts|default([])}) %}
{% set _ = _zone_data.update({'delegate': item.delegate|default([])}) %}
{% set _ = _zone_data.update({'services': item.services|default([])}) %}
{% set _ = _zone_data.update({'text': item.text|default([])}) %}
{% set _ = _zone_data.update({'naptr': item.naptr|default([])}) %}
{#
# Compare the zone file hash with the current zone data hash and set serial
# accordingly
#}
{% set _zone = {'hash': _zone_data | string | hash('md5')} %}
{% for _result in forward_hashes if _result.name == item.name %}
{% set _hash_serial = _result.hash.split(' ')[2:] %}
{% if _hash_serial and _hash_serial[0] == _zone['hash'] %}
{% set _ = _zone.update({'serial': _hash_serial[1]}) %}
{% else %}
{% set _ = _zone.update({'serial': timestamp.stdout}) %}
{% endif %}
{% endfor %}
{#
# Eventually output the zone data
#}
; Hash: {{ _zone['hash'] }} {{ _zone['serial'] }}
; Zone file for {{ _zone_data['domain'] }}
{{ ansible_managed | comment(decoration='; ') }}
$ORIGIN {{ _zone_data['domain'] }}.
$TTL {{ _zone_data['ttl'] }}
{% if _zone_data['mname']|length > 0 %}
@ IN SOA {{ _zone_data['mname']|first }}{% if not _zone_data['mname']|first|regex_search('\.$') %}.{{ _zone_data['domain'] }}.{% endif %} {{ _zone_data['rname'] }}. (
{% else %}
@ IN SOA {{ ansible_hostname }}.{{ _zone_data['domain'] }}. {{ _zone_data['rname'] }}. (
{% endif %}
{{ _zone['serial'] }}
{{ _zone_data['refresh'] }}
{{ _zone_data['retry'] }}
{{ _zone_data['expire'] }}
{{ _zone_data['minimum'] }} )
{% if _zone_data['mname']|length > 0 %}
{% for ns in _zone_data['mname'] %}
IN NS {{ ns }}{% if not ns|regex_search('\.$') %}.{{ _zone_data['domain'] }}.{% endif %}
{% endfor %}
{% else %}
IN NS {{ ansible_hostname }}.{{ _zone_data['domain'] }}.
{% endif %}
{% for ns in _zone_data['aname'] %}
IN NS {{ ns }}.
{% endfor %}
{% for mail in _zone_data['mail'] %}
{% if loop.first %}@{% else %} {% endif %} IN MX {{ mail.preference}} {{ mail.name }}{% if not mail.name.endswith('.') %}.{{ _zone_data['domain'] }}.{% endif %}
{% endfor %}
{% if _zone_data['delegate']|length > 0 %}
{% for host in _zone_data['delegate'] %}
{{ host.zone.ljust(20) }} IN NS {{ host.dns }}
{% endfor %}
{% endif %}
{% if _zone_data['hosts']|length > 0 %}
{% for host in _zone_data['hosts'] %}
{% if host.ip is defined %}
{% if host.ip is string %}
{% if "$GENERATE" not in host.name.upper() %}
{{ host.name.ljust(20) }}{{ (host.ttl|string).rjust(6) if host.ttl is defined else ''.ljust(6) }} IN A {{ host.ip }}
{% endif %}
{% if "$GENERATE" in host.name.upper() %}
{{ host.name.ljust(20) }}{{ (host.ttl|string).rjust(6) if host.ttl is defined else ''.ljust(6) }} IN A {{ host.ip }}
{% endif %}
{% else %}
{% for ip in host.ip %}
{{ host.name.ljust(20) }}{{ (host.ttl|string).rjust(6) if host.ttl is defined else ''.ljust(6) }} IN A {{ ip }}
{% endfor %}
{% endif %}
{% endif %}
{% if host.ipv6 is defined %}
{% if host.ipv6 is string %}
{{ host.name.ljust(20) }}{{ (host.ttl|string).rjust(6) if host.ttl is defined else ''.ljust(6) }} IN AAAA {{ host.ipv6 }}
{% else %}
{% for ip6 in host.ipv6 %}
{{ host.name.ljust(20) }}{{ (host.ttl|string).rjust(6) if host.ttl is defined else ''.ljust(6) }} IN AAAA {{ ip6 }}
{% endfor %}
{% endif %}
{% endif %}
{% if host.aliases is defined %}
{% for alias in host.aliases %}
{% if "$GENERATE" not in host.name.upper() %}
{{ (alias.name|default(alias)).ljust(20) }}{{ (host.ttl|string).rjust(6) if host.ttl is defined else ''.ljust(6) }} IN {{ alias.type|default('cname')|upper}} {{ host.name }}
{% endif %}
{% if "$GENERATE" in host.name.upper() %}
{{ alias.ljust(20) }} IN CNAME {{ host.name.rsplit(None, 1)[1] }}
{% endif %}
{% endfor %}
{% endif %}
{% if host.sshfp is defined %}
{% for sshfp in host.sshfp %}
{{ host.name.ljust(20) }} IN SSHFP {{ sshfp}}
{% endfor %}
{% endif %}
{% endfor %}
{% else %}
{{ ansible_hostname.ljust(26) }} IN A {{ ansible_default_ipv4.address }}
{% endif %}
{% for service in _zone_data['services'] %}
{{ service.name.ljust(20) }}{{ (service.ttl|string).rjust(6) if service.ttl is defined else ''.ljust(6) }} IN SRV {{ service.priority|default('0') }} {{ service.weight|default('0') }} {{ service.port }} {{ service.target }}
{% endfor %}
{% for text in _zone_data['text'] %}
{% if text.text is string %}
{{ text.name.ljust(20) }} IN TXT "{{ text.text }}"
{% else %}
{% for entry in text.text %}
{{ text.name.ljust(20) }} IN TXT "{{ entry }}"
{% endfor %}
{% endif %}
{% endfor %}
{% for naptr in _zone_data['naptr'] %}
{{ naptr.name.ljust(20) }} IN NAPTR {{ naptr.order|default('100') }} {{ naptr.pref|default('10') }} "{{ naptr.flags }}" "{{ naptr.service }}" "{{ naptr.regex }}" {{ naptr.replacement }}
{% endfor %}

158
roles/bertvv.bind/templates/master_etc_named.conf.j2 Normal file
View File

@@ -0,0 +1,158 @@
//
// named.conf
//
{{ ansible_managed | comment('c') }}
//
{% for acl in bind_acls %}
acl "{{ acl.name }}" {
{% for match in acl.match_list %}
{{ match }};
{% endfor %}
};
{% endfor %}
options {
listen-on port 53 { {{ bind_listen_ipv4|join('; ') }}; };
listen-on-v6 port 53 { {{ bind_listen_ipv6|join('; ') }}; };
directory "{{ bind_dir }}";
dump-file "{{ bind_dir }}/data/cache_dump.db";
statistics-file "{{ bind_dir }}/data/named_stats.txt";
memstatistics-file "{{ bind_dir }}/data/named_mem_stats.txt";
allow-query { {{ bind_allow_query|join('; ') }}; };
{% if bind_acls|length != 0 %}
allow-transfer { {% for acl in bind_acls %}"{{ acl.name }}"; {% endfor %}};
{% endif %}
{% if bind_check_names is defined %}
check-names {{ bind_check_names }};
{% endif %}
recursion {% if bind_recursion %}yes{% else %}no{% endif %};
{% if bind_recursion %}allow-recursion { {{ bind_allow_recursion|join('; ') }}; };
{% endif %}
{% if bind_forwarders|length > 0 %}forwarders { {{ bind_forwarders|join('; ') }}; };{% endif %}
{% if bind_forward_only %}forward only;{% endif %}
rrset-order { order {{ bind_rrset_order }}; };
dnssec-enable {{ bind_dnssec_enable }};
dnssec-validation {{ bind_dnssec_validation }};
/* Path to ISC DLV key */
bindkeys-file "{{ bind_bindkeys_file }}";
managed-keys-directory "{{ bind_dir }}/dynamic";
pid-file "{{ bind_pid_file }}";
session-keyfile "{{ bind_session_keyfile }}";
{% if bind_query_log is defined %}
querylog yes;
{% endif %}
};
{% if bind_statistics_channels %}
statistics-channels {
inet {{ bind_statistics_host }} port {{ bind_statistics_port }} allow { {{ bind_statistics_allow|join('; ') }}; };
};
{% endif %}
logging {
channel default_debug {
file "{{ bind_log }}";
severity dynamic;
print-time yes;
};
{% if bind_query_log is defined %}
channel querylog {
{% if bind_query_log.file is defined %}
file "{{ bind_query_log.file }}" versions {{ bind_query_log.versions }} size {{ bind_query_log.size }};
{% else %}
file "{{ bind_query_log }}" versions 600 size 20m;
{% endif %}
severity dynamic;
print-time yes;
};
category queries { querylog; };
{% endif %}
{% if bind_other_logs is defined %}
{% for log in bind_other_logs %}
channel {{ log.name }} {
file "{{ log.file }}" versions {{ log.versions }} size {{ log.size }};
severity dynamic;
print-time yes;
};
category "{{ log.name }}" { "{{ log.name }}"; };
{% endfor %}
{% endif %}
};
{% for file in bind_default_zone_files %}
include "{{ file }}";
{% endfor %}
{% for file in bind_extra_include_files %}
include "{{ file }}";
{% endfor %}
{% if bind_zone_domains is defined %}
{% for bind_zone in bind_zone_domains %}
{% if bind_zone.create_forward_zones is not defined or bind_zone.create_forward_zones %}
zone "{{ bind_zone.name }}" IN {
type master;
file "{{ bind_zone_dir }}/{{ bind_zone.name }}";
notify yes;
{% if bind_zone.also_notify is defined %}
also-notify { {{ bind_zone.also_notify|join('; ') }}; };
{% endif %}
{% if bind_zone.allow_update is defined %}
allow-update { {{ bind_zone.allow_update|join('; ') }}; };
{% else %}
allow-update { none; };
{% endif %}
{% if bind_zone.delegate is defined %}
forwarders {};
{% endif %}
};
{% endif %}
{% if bind_zone.networks is defined %}
{% if bind_zone.create_reverse_zones is not defined or bind_zone.create_reverse_zones %}
{% for network in bind_zone.networks %}
zone "{{ ('.'.join(network.replace(network+'.','').split('.')[::-1])) }}.in-addr.arpa" IN {
type master;
file "{{ bind_zone_dir }}/{{ ('.'.join(network.replace(network+'.','').split('.')[::-1])) }}.in-addr.arpa";
notify yes;
{% if bind_zone.also_notify is defined %}
also-notify { {{ bind_zone.also_notify|join('; ') }}; };
{% endif %}
{% if bind_zone.allow_update is defined %}
allow-update { {{ bind_zone.allow_update|join('; ') }}; };
{% else %}
allow-update { none; };
{% endif %}
};
{% endfor %}
{% endif %}
{% endif %}
{% if bind_zone.ipv6_networks is defined %}
{% if bind_zone.create_reverse_zones is not defined or bind_zone.create_reverse_zones %}
{% for network in bind_zone.ipv6_networks %}
zone "{{ (network | ipaddr('revdns'))[-(9+(network|regex_replace('^.*/','')|int)//2):] }}" IN {
type master;
file "{{ bind_zone_dir }}/{{ (network | ipaddr('revdns'))[-(9+(network|regex_replace('^.*/','')|int)//2):-1] }}";
notify yes;
{% if bind_zone.also_notify is defined %}
also-notify { {{ bind_zone.also_notify|join('; ') }}; };
{% endif %}
{% if bind_zone.allow_update is defined %}
allow-update { {{ bind_zone.allow_update|join('; ') }}; };
{% else %}
allow-update { none; };
{% endif %}
};
{% endfor %}
{% endif %}
{% endif %}
{% endfor %}
{% endif %}

101
roles/bertvv.bind/templates/reverse_zone.j2 Normal file
View File

@@ -0,0 +1,101 @@
{#
# First create a dict holding the entire zone information and create a hash
# from it, that it can be compared with subsequent task executions. In this
# way the serial will only be updated if there are some content changes.
#}
{% set _zone_data = {} %}
{% set _ = _zone_data.update({'ttl': bind_zone_ttl}) %}
{% set _ = _zone_data.update({'domain': item.0.name}) %}
{% set _ = _zone_data.update({'mname': item.0.name_servers|default([])}) %}
{% set _ = _zone_data.update({'aname': item.0.other_name_servers|default([])}) %}
{% if item.0.hostmaster_email is defined %}
{% set _ = _zone_data.update({'rname': (( item.0.hostmaster_email )) + ('' if (item.0.hostmaster_email is search('\.')) else ('.' + _zone_data['domain']))}) %}
{% else %}
{% set _ = _zone_data.update({'rname': 'hostmaster.' + _zone_data['domain']}) %}
{% endif %}
{% set _ = _zone_data.update({'refresh': bind_zone_time_to_refresh}) %}
{% set _ = _zone_data.update({'retry': bind_zone_time_to_retry}) %}
{% set _ = _zone_data.update({'expire': bind_zone_time_to_expire}) %}
{% set _ = _zone_data.update({'minimum': bind_zone_minimum_ttl}) %}
{% set _ = _zone_data.update({'hosts': item.0.hosts|default([]) | selectattr('ip', 'defined') | selectattr('ip', 'string') | selectattr('ip', 'search', '^'+item.1) | list}) %}
{% set _ = _zone_data.update({'revip': ('.'.join(item.1.replace(item.1+'.','').split('.')[::-1]))}) %}
{#
# Compare the zone file hash with the current zone data hash and set serial
# accordingly
#}
{% set _zone = {'hash': _zone_data | string | hash('md5')} %}
{% for _result in reverse_hashes if _result.network == item.1 %}
{% set _hash_serial = _result.hash.split(' ')[2:] %}
{% if _hash_serial and _hash_serial[0] == _zone['hash'] %}
{% set _ = _zone.update({'serial': _hash_serial[1]}) %}
{% else %}
{% set _ = _zone.update({'serial': timestamp.stdout}) %}
{% endif %}
{% endfor %}
{#
# Eventually output the zone data
#}
; Hash: {{ _zone['hash'] }} {{ _zone['serial'] }}
; Reverse zone file for {{ _zone_data['domain'] }}
{{ ansible_managed | comment(decoration='; ') }}
$TTL {{ _zone_data['ttl'] }}
$ORIGIN {{ ('.'.join(item.1.replace(item.1+'.','').split('.')[::-1])) }}.in-addr.arpa.
{% if _zone_data['mname']|length > 0 %}
@ IN SOA {{ _zone_data['mname']|first }}{% if not _zone_data['mname']|first|regex_search('\.$') %}.{{ _zone_data['domain'] }}.{% endif %} {{ _zone_data['rname'] }}. (
{% else %}
@ IN SOA {{ ansible_hostname }}.{{ _zone_data['domain'] }}. {{ _zone_data['rname'] }}. (
{% endif %}
{{ _zone['serial'] }}
{{ _zone_data['refresh'] }}
{{ _zone_data['retry'] }}
{{ _zone_data['expire'] }}
{{ _zone_data['minimum'] }} )
{% if _zone_data['mname']|length > 0 %}
{% for ns in _zone_data['mname'] %}
IN NS {{ ns }}{% if not ns|regex_search('\.$') %}.{{ _zone_data['domain'] }}.{% endif %}
{% endfor %}
{% else %}
IN NS {{ ansible_hostname }}.{{ _zone_data['domain'] }}.
{% endif %}
{% for ns in _zone_data['aname'] %}
IN NS {{ ns }}.
{% endfor %}
{% if _zone_data['hosts']|length > 0 %}
{% for host in _zone_data['hosts'] %}
{% if host.ip is defined %}
{% if host.ip == item.1 %}
@ IN PTR {{ host.name }}.{{ _zone_data['domain'] }}.
{% else %}
{% if host.ip is string and host.ip.startswith(item.1) %}
{% if host.name == '@' %}
{{ ('.'.join(host.ip.replace(item.1+'.','').split('.')[::-1])).ljust(16) }}{{ (host.ttl|string).rjust(6) if host.ttl is defined else ''.ljust(6) }} IN PTR {{ _zone_data['domain'] }}.
{% else %}
{% if "$GENERATE" not in host.name.upper() %}
{{ ('.'.join(host.ip.replace(item.1+'.','').split('.')[::-1])).ljust(16) }}{{ (host.ttl|string).rjust(6) if host.ttl is defined else ''.ljust(6) }} IN PTR {{ host.name }}.{{ _zone_data['domain'] }}.
{% endif %}
{% if "$GENERATE" in host.name.upper() %}
{{ host.name.rsplit(None, 1)[0] }} {{ ('.'.join(host.ip.replace(item.1+'.','').split('.')[::-1])).ljust(16) }} IN PTR {{ host.name.rsplit(None, 1)[1] }}.{{ _zone_data['domain'] }}.
{% endif %}
{% endif %}
{% else %}
{% for ip in host.ip %}
{% if ip.startswith(item.1) %}
{{ ('.'.join(ip.replace(item.1+'.','').split('.')[::-1])).ljust(16) }}{{ (host.ttl|string).rjust(6) if host.ttl is defined else ''.ljust(6) }} IN PTR {{ _zone_data['domain'] }}.
{% if host.name == '@' %}
{% else %}
{{ ('.'.join(ip.replace(item.1+'.','').split('.')[::-1])).ljust(16) }}{{ (host.ttl|string).rjust(6) if host.ttl is defined else ''.ljust(6) }} IN PTR {{ host.name }}.{{ _zone_data['domain'] }}.
{% endif %}
{% endif %}
{% endfor %}
{% endif %}
{% endif %}
{% endif %}
{% endfor %}
{% else %}
{{ ('.'.join(ansible_default_ipv4.address.replace(item.1+'.','').split('.')[::-1])).ljust(16) }}{{ (host.ttl|string).rjust(6) if host.ttl is defined else ''.ljust(6) }} IN PTR {{ ansible_hostname }}.{{ _zone_data['domain'] }}.
{% endif %}

96
roles/bertvv.bind/templates/reverse_zone_ipv6.j2 Normal file
View File

@@ -0,0 +1,96 @@
{#
# First create a dict holding the entire zone information and create a hash
# from it, that it can be compared with subsequent task executions. In this
# way the serial will only be updated if there are some content changes.
#}
{% set _zone_data = {} %}
{% set _ = _zone_data.update({'ttl': bind_zone_ttl}) %}
{% set _ = _zone_data.update({'domain': item.0.name}) %}
{% set _ = _zone_data.update({'mname': item.0.name_servers|default([])}) %}
{% set _ = _zone_data.update({'aname': item.0.other_name_servers|default([])}) %}
{% if item.0.hostmaster_email is defined %}
{% set _ = _zone_data.update({'rname': (( item.0.hostmaster_email )) + ('' if (item.0.hostmaster_email is search('\.')) else ('.' + _zone_data['domain']))}) %}
{% else %}
{% set _ = _zone_data.update({'rname': 'hostmaster.' + _zone_data['domain']}) %}
{% endif %}
{% set _ = _zone_data.update({'refresh': bind_zone_time_to_refresh}) %}
{% set _ = _zone_data.update({'retry': bind_zone_time_to_retry}) %}
{% set _ = _zone_data.update({'expire': bind_zone_time_to_expire}) %}
{% set _ = _zone_data.update({'minimum': bind_zone_minimum_ttl}) %}
{% set _ = _zone_data.update({'hosts': item.0.hosts|default([]) | selectattr('ipv6','defined') | selectattr('ipv6','string') | selectattr('ipv6', 'search', '^'+item.1|regex_replace('/.*$','')) | list }) %}
{% set _ = _zone_data.update({'revip': (item.1 | ipaddr('revdns'))[-(9+(item.1|regex_replace('^.*/','')|int)//2):] }) %}
{#
# Compare the zone file hash with the current zone data hash and set serial
# accordingly
#}
{% set _zone = {'hash': _zone_data | string | hash('md5')} %}
{% for _result in reverse_hashes_ipv6 if _result.network == item.1 %}
{% set _hash_serial = _result.hash.split(' ')[2:] %}
{% if _hash_serial and _hash_serial[0] == _zone['hash'] %}
{% set _ = _zone.update({'serial': _hash_serial[1]}) %}
{% else %}
{% set _ = _zone.update({'serial': timestamp.stdout}) %}
{% endif %}
{% endfor %}
{#
# Eventually output the zone data
#}
; Hash: {{ _zone['hash'] }} {{ _zone['serial'] }}
; Reverse zone file for {{ _zone_data['domain'] }}
{{ ansible_managed | comment(decoration='; ') }}
$TTL {{ _zone_data['ttl'] }}
$ORIGIN {{ (item.1 | ipaddr('revdns'))[-(9+(item.1|regex_replace('^.*/','')|int)//2):] }}
{% if _zone_data['mname']|length > 0 %}
@ IN SOA {{ _zone_data['mname']|first }}{% if not _zone_data['mname']|first|regex_search('\.$') %}.{{ _zone_data['domain'] }}.{% endif %} {{ _zone_data['rname'] }}. (
{% else %}
@ IN SOA {{ ansible_hostname }}.{{ _zone_data['domain'] }}. {{ _zone_data['rname'] }}. (
{% endif %}
{{ _zone['serial'] }}
{{ _zone_data['refresh'] }}
{{ _zone_data['retry'] }}
{{ _zone_data['expire'] }}
{{ _zone_data['minimum'] }} )
{% if _zone_data['mname']|length > 0 %}
{% for ns in _zone_data['mname'] %}
IN NS {{ ns }}{% if not ns|regex_search('\.$') %}.{{ _zone_data['domain'] }}.{% endif %}
{% endfor %}
{% else %}
IN NS {{ ansible_hostname }}.{{ _zone_data['domain'] }}.
{% endif %}
{% for ns in _zone_data['aname'] %}
IN NS {{ ns }}.
{% endfor %}
{% if _zone_data['hosts']|length > 0 %}
{% for host in _zone_data['hosts'] %}
{% if host.ipv6 is defined %}
{% if host.ipv6 == item.1 %}
@ IN PTR {{ host.name }}.{{ _zone_data['domain'] }}.
{% else %}
{% if host.ipv6 is string and host.ipv6.startswith(item.1|regex_replace('/.*$','')) %}
{% if host.name == '@' %}
{{ host.ipv6 | ipaddr('revdns') }}{{ (host.ttl|string).rjust(6) if host.ttl is defined else ''.ljust(6) }} IN PTR {{ _zone_data['domain'] }}.
{% else %}
{{ host.ipv6 | ipaddr('revdns') }}{{ (host.ttl|string).rjust(6) if host.ttl is defined else ''.ljust(6) }} IN PTR {{ host.name }}.{{ _zone_data['domain'] }}.
{% endif %}
{% else %}
{% for ip in host.ipv6 %}
{% if ip.startswith(item.1|regex_replace('/.*$','')) %}
{{ ip | ipaddr('revdns') }}{{ (host.ttl|string).rjust(6) if host.ttl is defined else ''.ljust(6) }} IN PTR {{ _zone_data['domain'] }}.
{% if host.name == '@' %}
{% else %}
{{ ip | ipaddr('revdns') }}{{ (host.ttl|string).rjust(6) if host.ttl is defined else ''.ljust(6) }} IN PTR {{ host.name }}.{{ _zone_data['domain'] }}.
{% endif %}
{% endif %}
{% endfor %}
{% endif %}
{% endif %}
{% endif %}
{% endfor %}
{% else %}
{{ ansible_default_ipv6.address | ipaddr('revdns') }}{{ (host.ttl|string).rjust(6) if host.ttl is defined else ''.ljust(6) }} IN PTR {{ ansible_hostname }}.{{ _zone_data['domain'] }}.
{% endif %}

120
roles/bertvv.bind/templates/slave_etc_named.conf.j2 Normal file
View File

@@ -0,0 +1,120 @@
//
// named.conf
//
{{ ansible_managed | comment('c') }}
//
{% for acl in bind_acls %}
acl "{{ acl.name }}" {
{% for match in acl.match_list %}
{{ match }};
{% endfor %}
};
{% endfor %}
options {
listen-on port 53 { {{ bind_listen_ipv4|join(';') }}; };
listen-on-v6 port 53 { {{ bind_listen_ipv6|join(';') }}; };
directory "{{ bind_dir }}";
dump-file "{{ bind_dir }}/data/cache_dump.db";
statistics-file "{{ bind_dir }}/data/named_stats.txt";
memstatistics-file "{{ bind_dir }}/data/named_mem_stats.txt";
allow-query { {{ bind_allow_query|join(';') }}; };
{% if bind_acls|length != 0 %}
allow-transfer { {% for acl in bind_acls %}"{{ acl.name }}"; {% endfor %}};
{% endif %}
recursion {% if bind_recursion %}yes{% else %}no{% endif %};
{% if bind_recursion %}allow-recursion { {{ bind_allow_recursion|join('; ') }}; };
{% endif %}
{% if bind_forwarders|length > 0 %}forwarders { {{ bind_forwarders|join('; ') }}; };{% endif %}
{% if bind_forward_only %}forward only;{% endif %}
rrset-order { order {{ bind_rrset_order }}; };
dnssec-enable {{ bind_dnssec_enable }};
dnssec-validation {{ bind_dnssec_validation }};
/* Path to ISC DLV key */
bindkeys-file "{{ bind_bindkeys_file }}";
managed-keys-directory "{{ bind_dir }}/dynamic";
pid-file "{{ bind_pid_file }}";
session-keyfile "{{ bind_session_keyfile }}";
{% if bind_query_log is defined %}
querylog yes;
{% endif %}
};
{% if bind_statistics_channels %}
statistics-channels {
inet {{ bind_statistics_host }} port {{ bind_statistics_port }} allow { {{ bind_statistics_allow|join('; ') }}; };
};
{% endif %}
logging {
channel default_debug {
file "{{ bind_log }}";
severity dynamic;
print-time yes;
};
{% if bind_query_log is defined %}
channel querylog {
{% if bind_query_log.file is defined %}
file "{{ bind_query_log.file }}" versions {{ bind_query_log.versions }} size {{ bind_query_log.size }};
{% else %}
file "{{ bind_query_log }}" versions 600 size 20m;
{% endif %}
severity dynamic;
print-time yes;
};
category queries { querylog; };
{% endif %}
};
{% for file in bind_default_zone_files %}
include "{{ file }}";
{% endfor %}
{% for file in bind_extra_include_files %}
include "{{ file }}";
{% endfor %}
{% if bind_zone_domains is defined %}
{% for bind_zone in bind_zone_domains %}
{% if bind_zone.create_forward_zones is not defined or bind_zone.create_forward_zones %}
zone "{{ bind_zone.name }}" IN {
type slave;
masters { {{ bind_zone_master_server_ip }}; };
file "{{ bind_slave_dir }}/{{ bind_zone.name }}";
{% if bind_zone.delegate is defined %}
forwarders {};
{% endif %}
};
{% endif %}
{% if bind_zone.create_reverse_zones is not defined or bind_zone.create_reverse_zones %}
{% if bind_zone.networks is defined %}
{% for network in bind_zone.networks %}
zone "{{ ('.'.join(network.replace(network+'.','').split('.')[::-1])) }}.in-addr.arpa" IN {
type slave;
masters { {{ bind_zone_master_server_ip }}; };
file "{{ bind_slave_dir }}/{{ ('.'.join(network.replace(network+'.','').split('.')[::-1])) }}.in-addr.arpa";
};
{% endfor %}
{% endif %}
{% endif %}
{% if bind_zone.create_reverse_zones is not defined or bind_zone.create_reverse_zones %}
{% if bind_zone.ipv6_networks is defined %}
{% for network in bind_zone.ipv6_networks %}
zone "{{ (network | ipaddr('revdns'))[-(9+(network|regex_replace('^.*/','')|int)//2):] }}" IN {
type slave;
masters { {{ bind_zone_master_server_ip }}; };
file "{{ bind_slave_dir }}/{{ (network | ipaddr('revdns'))[-(9+(network|regex_replace('^.*/','')|int)//2):-1] }}";
};
{% endfor %}
{% endif %}
{% endif %}
{% endfor %}
{% endif %}

32
roles/bertvv.bind/vars/Archlinux.yml Normal file
View File

@@ -0,0 +1,32 @@
# roles/bind/vars/RedHat.yml
---
bind_packages:
- python-netaddr
- bind
- bind-tools
bind_service: named
# Main config file
bind_config: /etc/named.conf
# Zone files included in the installation
bind_default_zone_files: []
# Directory with run-time stuff
bind_dir: /var/named
bind_conf_dir: "{{ bind_dir }}"
auth_file: "auth_transfer.conf"
bind_auth_file: "{{ bind_conf_dir }}/{{ auth_file }}"
bind_owner: root
bind_group: named
bind_bindkeys_file: "/etc/named.iscdlv.key"
bind_pid_file: "/run/named/named.pid"
bind_session_keyfile: "/run/named/session.key"
# Custom location for zone files
bind_zone_dir: "{{ bind_dir }}"
bind_slave_dir: "{{ bind_dir }}/slaves"

33
roles/bertvv.bind/vars/Debian.yml Normal file
View File

@@ -0,0 +1,33 @@
# roles/bind/vars/Debian.yml
---
bind_packages:
- python-netaddr
- bind9
- bind9utils
bind_service: bind9
# Main config file
bind_config: /etc/bind/named.conf
# Localhost zone
bind_default_zone_files:
- /etc/bind/named.conf.default-zones
# Directory with run-time stuff
bind_dir: /var/cache/bind
bind_conf_dir: "/etc/bind"
auth_file: "auth_transfer.conf"
bind_auth_file: "{{ bind_conf_dir }}/{{ auth_file }}"
bind_owner: root
bind_group: bind
bind_bindkeys_file: "/etc/named.iscdlv.key"
bind_pid_file: "/run/named/named.pid"
bind_session_keyfile: "/run/named/session.key"
# Custom location for master zone files
bind_zone_dir: "{{ bind_dir }}"
bind_slave_dir: "{{ bind_dir }}/slaves"

32
roles/bertvv.bind/vars/FreeBSD.yml Normal file
View File

@@ -0,0 +1,32 @@
# roles/bind/vars/Debian.yml
---
bind_packages:
- py36-netaddr
- bind911
bind_service: named
# Main config file
bind_config: /usr/local/etc/namedb/named.conf
# Localhost zone
bind_default_zone_files:
- /usr/local/etc/namedb/named.conf.default-zones
# Directory with run-time stuff
bind_dir: /var/cache/named
bind_conf_dir: "/usr/local/etc/namedb/"
auth_file: "auth_transfer.conf"
bind_auth_file: "{{ bind_conf_dir }}/{{ auth_file }}"
bind_owner: bind
bind_group: bind
bind_bindkeys_file: "/usr/local/etc/namedb/bind.keys"
bind_pid_file: "/var/run/named/named.pid"
bind_session_keyfile: "/var/run/named/session.key"
# Custom location for master zone files
bind_zone_dir: "{{ bind_dir }}/master"
bind_slave_dir: "{{ bind_dir }}/slave"

34
roles/bertvv.bind/vars/RedHat.yml Normal file
View File

@@ -0,0 +1,34 @@
# roles/bind/vars/RedHat.yml
---
bind_packages:
- "{{ ( ansible_distribution_major_version == '8' ) | ternary( 'python3-netaddr', 'python-netaddr' ) }}"
- bind
- bind-utils
bind_service: named
# Main config file
bind_config: /etc/named.conf
# Zone files included in the installation
bind_default_zone_files:
- /etc/named.root.key
- /etc/named.rfc1912.zones
# Directory with run-time stuff
bind_dir: /var/named
bind_conf_dir: "/etc/named"
auth_file: "auth_transfer.conf"
bind_auth_file: "{{ bind_conf_dir }}/{{ auth_file }}"
bind_owner: root
bind_group: named
bind_bindkeys_file: "/etc/named.iscdlv.key"
bind_pid_file: "/run/named/named.pid"
bind_session_keyfile: "/run/named/session.key"
# Custom location for master zone files
bind_zone_dir: "{{ bind_dir }}"
bind_slave_dir: "{{ bind_dir }}/slaves"