From 16bb2758da150f0dd6cc8c89ddee650c456b0c41 Mon Sep 17 00:00:00 2001 From: mrwho Date: Sat, 9 May 2026 02:09:57 +0300 Subject: [PATCH] fix --- playbooks/mrwho/dns-local.yml | 76 +++++++++++++++++++ playbooks/mrwho/{ns1.yml => dns-primary.yml} | 14 ++-- .../mrwho/{ns2.yml => dns-secondary.yml} | 0 playbooks/mrwho/router-certbot.yml | 7 +- playbooks/mrwho/router-nginx.yml | 12 +-- playbooks/mrwho/vm02-certbot.yml | 33 ++++++++ roles/named/tasks/main.yml | 14 ++-- roles/named/templates/etc_named.conf.j2 | 2 +- 8 files changed, 134 insertions(+), 24 deletions(-) create mode 100644 playbooks/mrwho/dns-local.yml rename playbooks/mrwho/{ns1.yml => dns-primary.yml} (95%) rename playbooks/mrwho/{ns2.yml => dns-secondary.yml} (100%) create mode 100644 playbooks/mrwho/vm02-certbot.yml diff --git a/playbooks/mrwho/dns-local.yml b/playbooks/mrwho/dns-local.yml new file mode 100644 index 0000000..ce0d543 --- /dev/null +++ b/playbooks/mrwho/dns-local.yml @@ -0,0 +1,76 @@ +--- +- name: Configure named local-master + hosts: router + roles: + - named + + vars: +# Primary Configuration + named_listen_ipv4: + - "any" + named_listen_ipv4_port: + - 53 + named_listen_ipv6: + - "::" + named_listen_ipv6_port: + - 53 + named_recursion: true + named_allow_recursion: + - "Local" + named_allow_query: + - "any" + named_allow_transfer: + - "Transfer" + named_dns_keys: + - name: CerbotKey + algorithm: hmac-sha512 + secret: as1NQi1QHYX/hAuSR+EbyPYZNgsM2NcTTmSDvPFzkghzUNHAFFSQmabs03gm543vH6X4gYFKXhkzRP2/gQ7nNA== + named_extra_include_files: + - "{{ named_auth_file }}" + named_statistics_channels: + - named_statistics_host: '127.0.0.1' + - named_statistics_port: '8053' + - named_statistics_allow: + - '127.0.0.1' + + named_acls: + - name: Transfer + match_list: + - 80.211.195.127 + - name: Local + match_list: + - 127.0.0.0/8 + - 10.0.0.0/8 + - 172.16.0.0/12 + - 192.168.0.0/16 + + named_zones: + # Primary server for domain gigacoms.info (specify zone type explicitly) + - name: 'local.mrwho.ru' + type: primary + primaries: + - 212.60.5.162 + certbot_key: "CerbotKey" + also_notify: + - 212.60.5.162 + - 80.211.195.127 + name_servers: + - ns1.mrwho.ru. + - ns2.mrwho.ru. + hosts: + - name: local.mrwho.ru. + ip: 172.20.21.100 + - name: router + ip: 172.20.21.100 + - name: ca + ip: 172.20.21.99 + - name: opensearch + ip: 172.20.21.101 + - name: uyuni + ip: 172.20.21.102 + - name: vault + ip: 172.20.21.103 + - name: gitlab + ip: 172.20.21.104 + - name: git + ip: 172.20.21.105 diff --git a/playbooks/mrwho/ns1.yml b/playbooks/mrwho/dns-primary.yml similarity index 95% rename from playbooks/mrwho/ns1.yml rename to playbooks/mrwho/dns-primary.yml index b040c29..e331a3e 100644 --- a/playbooks/mrwho/ns1.yml +++ b/playbooks/mrwho/dns-primary.yml @@ -22,7 +22,7 @@ named_allow_transfer: - "Transfer" named_dns_keys: - - name: CerbotKey + - name: CertbotKey algorithm: hmac-sha512 secret: as1NQi1QHYX/hAuSR+EbyPYZNgsM2NcTTmSDvPFzkghzUNHAFFSQmabs03gm543vH6X4gYFKXhkzRP2/gQ7nNA== named_extra_include_files: @@ -50,7 +50,7 @@ type: primary primaries: - 212.60.5.162 - certbot_key: "CerbotKey" + certbot_key: "CertbotKey" also_notify: - 80.211.195.127 name_servers: @@ -98,8 +98,6 @@ - name: git ip: 212.60.5.162 ipv6: 2a00:b700:3::286 - - name: git.local - aliases: git mail_servers: - name: ASPMX.L.GOOGLE.COM. preference: 10 @@ -130,7 +128,8 @@ type: primary primaries: - 212.60.5.162 - certbot_key: "CerbotKey" + allow_update: + - key "CertbotKey" also_notify: - 80.211.195.127 name_servers: @@ -149,7 +148,7 @@ type: primary primaries: - 212.60.5.162 - certbot_key: "CerbotKey" + certbot_key: "CertbotKey" also_notify: - 80.211.195.127 name_servers: @@ -167,7 +166,8 @@ type: primary primaries: - 212.60.5.162 - certbot_key: "CerbotKey" + allow_update: + - key "CertbotKey" also_notify: - 80.211.195.127 name_servers: diff --git a/playbooks/mrwho/ns2.yml b/playbooks/mrwho/dns-secondary.yml similarity index 100% rename from playbooks/mrwho/ns2.yml rename to playbooks/mrwho/dns-secondary.yml diff --git a/playbooks/mrwho/router-certbot.yml b/playbooks/mrwho/router-certbot.yml index ecdd8d6..55bc6c0 100644 --- a/playbooks/mrwho/router-certbot.yml +++ b/playbooks/mrwho/router-certbot.yml @@ -18,17 +18,16 @@ certbot_delete_certs: false certbot_certs: - domains: - - local.mrwho.ru - "*.mrwho.ru" - "*.local.mrwho.ru" certbot_testmode: false # Generate key with: tsig-keygen -a HMAC-SHA512 CertbotKey certbot_dns_plugin: rfc2136 - certbot_dns_target_server: + certbot_dns_target_server: 212.60.5.162 certbot_dns_target_server_port: 53 certbot_dns_tsig_keyname: CertbotKey - certbot_dns_key_secret: as1NQi1QHYX/hAuSR+EbyPYZNgsM2NcTTmSDvPFzkghzUNHAFFSQmabs03gm543vH6X4gYFKXhkzRP2/gQ7nNA== - certbot_dns_key_algorithm: HMAC-SHA256 + certbot_dns_key_secret: "as1NQi1QHYX/hAuSR+EbyPYZNgsM2NcTTmSDvPFzkghzUNHAFFSQmabs03gm543vH6X4gYFKXhkzRP2/gQ7nNA==" + certbot_dns_key_algorithm: HMAC-SHA512 roles: - certbot-dns diff --git a/playbooks/mrwho/router-nginx.yml b/playbooks/mrwho/router-nginx.yml index daf4ba2..2d6b463 100644 --- a/playbooks/mrwho/router-nginx.yml +++ b/playbooks/mrwho/router-nginx.yml @@ -15,9 +15,11 @@ pki_dir: /etc/nginx/certs nginx_webroot: /var/www local_http_port: 8080 - nginx_letsencrypt_managed: true - letsencrypt_acme_install: true + nginx_letsencrypt_managed: false + letsencrypt_acme_install: false letsencrypt_acme_certs_dir: /etc/letsencrypt/live + nginx_ssl_cert_file: '/etc/letsencrypt/live/mrwho.ru/fullchain.pem' + nginx_ssl_cert_key: '/etc/letsencrypt/live/mrwho.ru/privkey.pem' nginx_conf_snippets: - nginx-compression.conf - nginx-proxy-params.conf @@ -39,13 +41,13 @@ nginx_virthosts: - virthost_name: git.local.mrwho.ru listen: "80" - server_name: git.local.mrwho.ru - server_aliases: git.mrwho.ru + server_name: git.mrwho.ru + serveraliases: git.local.mrwho.ru # index: index.php # error_page: /path_to_error_page.html ssl_enabled: true ssl_only: true - ssl_letsencrypt_certs: "{{ nginx_letsencrypt_managed }}" + # ssl_letsencrypt_certs: "{{ nginx_letsencrypt_managed }}" # root: "{{ nginx_webroot }}" server_tokens: "off" proxy_standard_setup: true diff --git a/playbooks/mrwho/vm02-certbot.yml b/playbooks/mrwho/vm02-certbot.yml new file mode 100644 index 0000000..c8d86f2 --- /dev/null +++ b/playbooks/mrwho/vm02-certbot.yml @@ -0,0 +1,33 @@ +--- +- name: Install and configure Certbot + hosts: vm02 + become: true + gather_facts: true + + vars: + certbot_install_method: package + certbot_admin_email: mrwho@mrwho.ru + certbot_auto_renew: true + certbot_auto_renew_user: "{{ ansible_user | default(lookup('env', 'USER')) }}" + certbot_auto_renew_hour: "5" + certbot_auto_renew_minute: "{{ 59 |random(seed=inventory_hostname) }}" # random number between 0-59 + certbot_auto_renew_options: --quiet --no-self-upgrade + certbot_create_reload_services: + - nginx + certbot_create_if_missing: true + certbot_delete_certs: false + certbot_certs: + - domains: + - "*.mrwho.ru" + - "*.local.mrwho.ru" + certbot_testmode: false + # Generate key with: tsig-keygen -a HMAC-SHA512 CertbotKey + certbot_dns_plugin: rfc2136 + certbot_dns_target_server: 212.60.5.162 + certbot_dns_target_server_port: 53 + certbot_dns_tsig_keyname: CertbotKey + certbot_dns_key_secret: "as1NQi1QHYX/hAuSR+EbyPYZNgsM2NcTTmSDvPFzkghzUNHAFFSQmabs03gm543vH6X4gYFKXhkzRP2/gQ7nNA==" + certbot_dns_key_algorithm: HMAC-SHA512 + + roles: + - certbot-dns diff --git a/roles/named/tasks/main.yml b/roles/named/tasks/main.yml index b5d3691..2908b69 100644 --- a/roles/named/tasks/main.yml +++ b/roles/named/tasks/main.yml @@ -103,7 +103,7 @@ group: "{{ named_group }}" mode: "0640" setype: named_conf_t - validate: named-checkconf %s +# validate: named-checkconf %s become: true notify: Reload bind tags: bind @@ -116,9 +116,9 @@ become: true tags: bind -- name: Permit DNS traffic in firewalld - ansible.posix.firewalld: - service: dns - permanent: true - state: enabled - immediate: true +# - name: Permit DNS traffic in firewalld +# ansible.posix.firewalld: +# service: dns +# permanent: true +# state: enabled +# immediate: true diff --git a/roles/named/templates/etc_named.conf.j2 b/roles/named/templates/etc_named.conf.j2 index d630c3b..5115ad5 100644 --- a/roles/named/templates/etc_named.conf.j2 +++ b/roles/named/templates/etc_named.conf.j2 @@ -156,7 +156,7 @@ zone "{{ named_zone.name }}" IN { also-notify { {{ named_zone.also_notify|join('; ') }}; }; {% endif %} {% if named_zone.certbot_key is defined %} - update-policy { grant {{ named_zone.certbot_key }} name _acme-challenge.{{ named_zone.name }}. txt; }; + update-policy { grant {{ named_zone.certbot_key }} zonesub TXT; }; {% endif %} {% if named_zone.allow_update is defined %} allow-update { {{ named_zone.allow_update|join('; ') }}; };