From 17aadec9147ce38f6830929a7eea56b991b8c43f Mon Sep 17 00:00:00 2001 From: Kade Cole Date: Tue, 30 Jun 2015 16:54:46 +0000 Subject: [PATCH 1/7] Modified to work with FreeBSD and Template Changes --- defaults/main.yml | 8 ++++++ files/masters/db.siue.edu | 11 ++++++++ tasks/main.yml | 28 +++++++++++++++++--- templates/named.conf.j2 | 45 +++++++++++++++++++++++++++++++++ templates/named.conf.options.j2 | 4 ++- vars/main.yml | 5 ---- 6 files changed, 91 insertions(+), 10 deletions(-) create mode 100644 files/masters/db.siue.edu create mode 100644 templates/named.conf.j2 diff --git a/defaults/main.yml b/defaults/main.yml index 18a5541..55acbf3 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -1,13 +1,21 @@ --- +bind_config_basepath: /etc/bind bind_config_master_zones: [] bind_config_master_allow_transfer: [] bind_config_master_forwarders: [] bind_config_recursion: "no" bind_config_slave_zones: [] bind_config_forward_zones: [] +bind_service_name: bind9 bind_service_state: started bind_service_enabled: yes bind_pkg_state: installed +bind_root_filename: db.root +bind_pid_file_name: '/var/run/named/named.pid' +bind_cache_path: '/var/cache/bind' bind_base_zones_path: '/var/lib/bind' bind_masterzones_path: 'masters' bind_slavezones_path: 'slaves' +bind_pkgs: + - bind9 + - dnsutils diff --git a/files/masters/db.siue.edu b/files/masters/db.siue.edu new file mode 100644 index 0000000..f1ae7ad --- /dev/null +++ b/files/masters/db.siue.edu @@ -0,0 +1,11 @@ +$TTL 4h +$ORIGIN siue.edu. +@ IN SOA exdns1.isg.siue.edu. dchace.siue.edu. ( + 2013092801 ; Serial + 1d ; slave refresh (1 day) + 2h ; slave retry time in case of a problem (2 hours) + 2w ; slave expiration time (2 weeks) + 2d ; minimum caching time in case of failed lookups (2 days) + ) + IN NS exdns1.isg.siue.edu. + IN NS exdns2.isg.siue.edu. diff --git a/tasks/main.yml b/tasks/main.yml index 97bef9f..04be21f 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -1,8 +1,28 @@ --- -- name: install bind packages +- name: install bind packages (RedHat) + yum: pkg={{ item }} state={{ bind_pkg_state }} + with_items: bind_pkgs + tags: package + when: ansible_os_family == 'RedHat' + +- name: install bind packages (Debian) apt: pkg={{ item }} state={{ bind_pkg_state }} with_items: bind_pkgs tags: package + when: ansible_os_family == 'Debian' + +- name: install bind packages (FreeBSD) + pkgng: pkg={{ item }} state=present + with_items: bind_pkgs + tags: package + when: ansible_os_family == 'FreeBSD' + +- name: setup directories + file: dest={{ item }} state=directory owner={{ bind_user }} group={{ bind_group }} mode=0755 + with_items: + - "{{ bind_base_zones_path }}" + - "{{ bind_cache_path }}" + tags: configuration - name: setup zone directories file: dest={{ bind_base_zones_path }}/{{ item }} state=directory owner={{ bind_user }} group={{ bind_group }} mode=0755 @@ -12,7 +32,7 @@ tags: configuration - name: setup zones - action: template src=named.conf.local.{{ item }}.j2 dest={{ bind_config_basepath }}/named.conf.local.{{ item }} owner={{ bind_user }} group={{ bind_group }} mode=0600 + action: template src=named.conf.local.{{ item }}.j2 dest={{ bind_config_basepath }}/named.conf.local.{{ item }} owner={{ bind_user }} group={{ bind_group }} mode=0644 with_items: - master - slave @@ -21,12 +41,12 @@ tags: configuration - name: configure bind - copy: src=named.conf dest={{ bind_config_basepath }}/named.conf owner={{ bind_user }} group={{ bind_group }} mode=0600 validate='named-checkconf %s' + template: src=named.conf.j2 dest={{ bind_config_basepath }}/named.conf owner={{ bind_user }} group={{ bind_group }} mode=0644 validate='named-checkconf %s' notify: restart bind tags: configuration - name: configure bind options - template: src=named.conf.options.j2 dest={{ bind_config_basepath }}/named.conf.options owner={{ bind_user }} group={{ bind_group }} mode=0600 validate='named-checkconf %s' + template: src=named.conf.options.j2 dest={{ bind_config_basepath }}/named.conf.options owner={{ bind_user }} group={{ bind_group }} mode=0644 validate='named-checkconf %s' notify: restart bind tags: configuration diff --git a/templates/named.conf.j2 b/templates/named.conf.j2 new file mode 100644 index 0000000..ebcffb8 --- /dev/null +++ b/templates/named.conf.j2 @@ -0,0 +1,45 @@ +// {{ ansible_managed }} +// +// This is the primary configuration file for the BIND DNS server named. +// +// Please read /usr/share/doc/bind9/README.Debian.gz for information on the +// structure of BIND configuration files in Debian, *BEFORE* you customize +// this configuration file. +// +// If you are just adding zones, please do that in /etc/bind/named.conf.local + +include "{{ bind_config_basepath }}/named.conf.options"; + +// prime the server with knowledge of the root servers +zone "." { + type hint; + file "{{ bind_config_basepath }}/{{ bind_root_filename }}"; +}; + +// be authoritative for the localhost forward and reverse zones, and for +// broadcast zones as per RFC 1912 + +zone "localhost" { + type master; + file "{{ bind_config_basepath }}/db.local"; +}; + +zone "127.in-addr.arpa" { + type master; + file "{{ bind_config_basepath }}/db.127"; +}; + +zone "0.in-addr.arpa" { + type master; + file "{{ bind_config_basepath }}/db.0"; +}; + +zone "255.in-addr.arpa" { + type master; + file "{{ bind_config_basepath }}/db.255"; +}; + +//include "{{ bind_config_basepath }}/named.conf.local"; +include "{{ bind_config_basepath }}/named.conf.local.master"; +include "{{ bind_config_basepath }}/named.conf.local.slave"; +include "{{ bind_config_basepath }}/named.conf.local.forward"; diff --git a/templates/named.conf.options.j2 b/templates/named.conf.options.j2 index d62a30c..6c293d9 100644 --- a/templates/named.conf.options.j2 +++ b/templates/named.conf.options.j2 @@ -1,7 +1,9 @@ // {{ ansible_managed }} options { - directory "/var/cache/bind"; + directory "{{ bind_cache_path }}"; + + pid-file "{{ bind_pid_file_name }}"; // If there is a firewall between you and nameservers you want // to talk to, you might need to uncomment the query-source diff --git a/vars/main.yml b/vars/main.yml index cefd270..c4c18ea 100644 --- a/vars/main.yml +++ b/vars/main.yml @@ -1,8 +1,3 @@ --- -bind_config_basepath: /etc/bind bind_user: bind bind_group: bind -bind_service_name: bind9 -bind_pkgs: - - bind9 - - dnsutils From 819f7d5e55027d586c060b79fccb321d19fda735 Mon Sep 17 00:00:00 2001 From: Kade Cole Date: Tue, 30 Jun 2015 18:44:55 +0000 Subject: [PATCH 2/7] Changed order of tasks --- tasks/main.yml | 9 ++++----- templates/named.conf.options.j2 | 2 +- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/tasks/main.yml b/tasks/main.yml index 04be21f..e8a1a56 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -40,13 +40,12 @@ notify: reload bind tags: configuration -- name: configure bind - template: src=named.conf.j2 dest={{ bind_config_basepath }}/named.conf owner={{ bind_user }} group={{ bind_group }} mode=0644 validate='named-checkconf %s' - notify: restart bind +- name: configure bind options + template: src=named.conf.options.j2 dest={{ bind_config_basepath }}/named.conf.options owner={{ bind_user }} group={{ bind_group }} mode=0644 tags: configuration -- name: configure bind options - template: src=named.conf.options.j2 dest={{ bind_config_basepath }}/named.conf.options owner={{ bind_user }} group={{ bind_group }} mode=0644 validate='named-checkconf %s' +- name: configure bind + template: src=named.conf.j2 dest={{ bind_config_basepath }}/named.conf owner={{ bind_user }} group={{ bind_group }} mode=0644 validate='named-checkconf %s' notify: restart bind tags: configuration diff --git a/templates/named.conf.options.j2 b/templates/named.conf.options.j2 index 6c293d9..e7c8aa6 100644 --- a/templates/named.conf.options.j2 +++ b/templates/named.conf.options.j2 @@ -3,7 +3,7 @@ options { directory "{{ bind_cache_path }}"; - pid-file "{{ bind_pid_file_name }}"; + pid-file "{{ bind_pid_file_name }}"; // If there is a firewall between you and nameservers you want // to talk to, you might need to uncomment the query-source From 7369c0600f7bbeac8ccea15f01f4a4fc043862cc Mon Sep 17 00:00:00 2001 From: Kade Cole Date: Tue, 30 Jun 2015 19:02:32 +0000 Subject: [PATCH 3/7] Added allow-recursion option to template --- tasks/main.yml | 1 + templates/named.conf.options.j2 | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/tasks/main.yml b/tasks/main.yml index e8a1a56..f762e43 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -42,6 +42,7 @@ - name: configure bind options template: src=named.conf.options.j2 dest={{ bind_config_basepath }}/named.conf.options owner={{ bind_user }} group={{ bind_group }} mode=0644 + notify: restart bind tags: configuration - name: configure bind diff --git a/templates/named.conf.options.j2 b/templates/named.conf.options.j2 index e7c8aa6..d5a7931 100644 --- a/templates/named.conf.options.j2 +++ b/templates/named.conf.options.j2 @@ -25,6 +25,12 @@ options { {% endfor %} }; + allow-recursion { + {% for allow_recursion in bind_config_master_allow_recursion %} + {{ allow_recursion }}; + {% endfor %} + }; + notify yes; also-notify { From 3df54566a962d5c58f0c3d6f1a3553850cb8dcd8 Mon Sep 17 00:00:00 2001 From: Kade Cole Date: Tue, 30 Jun 2015 20:52:36 +0000 Subject: [PATCH 4/7] Added db.local file --- defaults/main.yml | 2 ++ files/db.local | 13 +++++++++++++ tasks/main.yml | 8 +++++++- templates/named.conf.j2 | 6 +++--- vars/main.yml | 2 -- 5 files changed, 25 insertions(+), 6 deletions(-) create mode 100644 files/db.local diff --git a/defaults/main.yml b/defaults/main.yml index 55acbf3..7e8091c 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -1,4 +1,6 @@ --- +bind_user: bind +bind_group: bind bind_config_basepath: /etc/bind bind_config_master_zones: [] bind_config_master_allow_transfer: [] diff --git a/files/db.local b/files/db.local new file mode 100644 index 0000000..a07a0df --- /dev/null +++ b/files/db.local @@ -0,0 +1,13 @@ +; +; BIND data file for local loopback interface +; +$TTL 604800 +@ IN SOA localhost. root.localhost. ( + 1 ; Serial + 604800 ; Refresh + 86400 ; Retry + 2419200 ; Expire + 604800 ) ; Negative Cache TTL +; +@ IN NS localhost. +@ IN A 127.0.0.1 diff --git a/tasks/main.yml b/tasks/main.yml index f762e43..3e70718 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -17,6 +17,12 @@ tags: package when: ansible_os_family == 'FreeBSD' +- name: setup files + copy: src={{ item }} dest={{ bind_config_basepath }}/{{ item }} owner={{ bind_user }} group={{ bind_group }} + with_items: + - db.local + tags: configuration + - name: setup directories file: dest={{ item }} state=directory owner={{ bind_user }} group={{ bind_group }} mode=0755 with_items: @@ -32,7 +38,7 @@ tags: configuration - name: setup zones - action: template src=named.conf.local.{{ item }}.j2 dest={{ bind_config_basepath }}/named.conf.local.{{ item }} owner={{ bind_user }} group={{ bind_group }} mode=0644 + template: src=named.conf.local.{{ item }}.j2 dest={{ bind_config_basepath }}/named.conf.local.{{ item }} owner={{ bind_user }} group={{ bind_group }} mode=0644 with_items: - master - slave diff --git a/templates/named.conf.j2 b/templates/named.conf.j2 index ebcffb8..5e8cad5 100644 --- a/templates/named.conf.j2 +++ b/templates/named.conf.j2 @@ -26,17 +26,17 @@ zone "localhost" { zone "127.in-addr.arpa" { type master; - file "{{ bind_config_basepath }}/db.127"; + file "{{ bind_config_basepath }}/db.local"; }; zone "0.in-addr.arpa" { type master; - file "{{ bind_config_basepath }}/db.0"; + file "{{ bind_config_basepath }}/db.local"; }; zone "255.in-addr.arpa" { type master; - file "{{ bind_config_basepath }}/db.255"; + file "{{ bind_config_basepath }}/db.local"; }; //include "{{ bind_config_basepath }}/named.conf.local"; diff --git a/vars/main.yml b/vars/main.yml index c4c18ea..ed97d53 100644 --- a/vars/main.yml +++ b/vars/main.yml @@ -1,3 +1 @@ --- -bind_user: bind -bind_group: bind From eecd054cde58cf1c341b3a3416ddb0ea6f0fe087 Mon Sep 17 00:00:00 2001 From: kadecole Date: Sat, 18 Jul 2015 21:32:29 -0500 Subject: [PATCH 5/7] Removed file files/masters/db.siue.edu --- files/masters/db.siue.edu | 11 ----------- 1 file changed, 11 deletions(-) delete mode 100644 files/masters/db.siue.edu diff --git a/files/masters/db.siue.edu b/files/masters/db.siue.edu deleted file mode 100644 index f1ae7ad..0000000 --- a/files/masters/db.siue.edu +++ /dev/null @@ -1,11 +0,0 @@ -$TTL 4h -$ORIGIN siue.edu. -@ IN SOA exdns1.isg.siue.edu. dchace.siue.edu. ( - 2013092801 ; Serial - 1d ; slave refresh (1 day) - 2h ; slave retry time in case of a problem (2 hours) - 2w ; slave expiration time (2 weeks) - 2d ; minimum caching time in case of failed lookups (2 days) - ) - IN NS exdns1.isg.siue.edu. - IN NS exdns2.isg.siue.edu. From f6c6be094d4e7a195c1a46758a29af9f0de5eb42 Mon Sep 17 00:00:00 2001 From: Kade Cole Date: Wed, 2 Sep 2015 15:01:38 -0500 Subject: [PATCH 6/7] Updated defaults file --- defaults/main.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/defaults/main.yml b/defaults/main.yml index 7e8091c..a02b639 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -3,6 +3,7 @@ bind_user: bind bind_group: bind bind_config_basepath: /etc/bind bind_config_master_zones: [] +bind_config_master_allow_recursion: [] bind_config_master_allow_transfer: [] bind_config_master_forwarders: [] bind_config_recursion: "no" From de72be7ccbb47ab2e104886363fb49f6e2694939 Mon Sep 17 00:00:00 2001 From: kadecole Date: Wed, 20 Jan 2016 22:29:11 -0600 Subject: [PATCH 7/7] Merge remote-tracking branch 'resmo/master' into webdomains --- README.md | 6 ++++++ defaults/main.yml | 2 ++ templates/named.conf.options.j2 | 12 +++++++++++- 3 files changed, 19 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index b070399..fdfb239 100644 --- a/README.md +++ b/README.md @@ -47,6 +47,12 @@ Optionally: If you need to forward some zones directly to another nameserver, he *forward* should be either _first_ or _only_ + +Optionally: If you want to adjust the allow-query option globally, here is a sample: + + bind_config_allow_query: [ '127.1.0.1', '127.1.0.2' ] + + ## Dependencies None. diff --git a/defaults/main.yml b/defaults/main.yml index a02b639..a397be9 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -19,6 +19,8 @@ bind_cache_path: '/var/cache/bind' bind_base_zones_path: '/var/lib/bind' bind_masterzones_path: 'masters' bind_slavezones_path: 'slaves' +bind_config_listen_on: any +bind_config_allow_query: [] bind_pkgs: - bind9 - dnsutils diff --git a/templates/named.conf.options.j2 b/templates/named.conf.options.j2 index d5a7931..1c9063a 100644 --- a/templates/named.conf.options.j2 +++ b/templates/named.conf.options.j2 @@ -53,10 +53,20 @@ options { //dnssec-validation yes; auth-nxdomain no; # conform to RFC1035 - + + listen-on { {{ bind_config_listen_on }}; }; listen-on-v6 { any; }; + {% if bind_config_allow_query %} + allow-query { + {% for queries in bind_config_allow_query %} + {{ queries }}; + {% endfor %} + }; + {% else %} allow-query { any; }; // This is the default + {% endif %} + recursion {{ bind_config_recursion }}; // Do not provide recursive service zone-statistics yes; };