From 53be774189b5bdbcb2e5ddb455bdc5e3a48e5637 Mon Sep 17 00:00:00 2001
From: "a.kazantsev" <a.kazantsev@gigacoms.ru>
Date: Fri, 10 Jul 2026 12:23:46 +0300
Subject: [PATCH] update named from gigacoms

---
 roles/named/tasks/main.yml              | 35 ++++++++++++++++++-------
 roles/named/templates/etc_named.conf.j2 | 32 ++++++++++++++++------
 2 files changed, 50 insertions(+), 17 deletions(-)

diff --git a/roles/named/tasks/main.yml b/roles/named/tasks/main.yml
index 2908b69..e05d596 100644
--- a/roles/named/tasks/main.yml
+++ b/roles/named/tasks/main.yml
@@ -78,13 +78,19 @@
   check_mode: false
   tags: bind
 
+- name: Выполнение rndc sync -clean
+  ansible.builtin.command:
+    cmd: "rndc sync -clean"
+  register: rndc_output
+  changed_when: true # rndc всегда возвращает rc=0 без явного указания изменений
+
 # file to set keys for XFR authentication
 - name: Create extra config for authenticated XFR request
   ansible.builtin.template:
     src: auth_transfer.j2
     dest: "{{ named_conf_dir }}/{{ named_auth_filename }}"
     mode: "0640"
-    owner: root
+    owner: "{{ named_owner }}"
     group: "{{ named_group }}"
   become: true
   when: named_dns_keys is defined and named_dns_keys|length > 0
@@ -99,15 +105,21 @@
   ansible.builtin.template:
     src: etc_named.conf.j2
     dest: "{{ named_config }}"
-    owner: "{{ named_owner }}"
+    owner: root
     group: "{{ named_group }}"
     mode: "0640"
     setype: named_conf_t
-#    validate: named-checkconf %s
+    validate: named-checkconf %s
   become: true
   notify: Reload bind
   tags: bind
 
+- name: Disable IPv6
+  ansible.builtin.lineinfile:
+    path: /etc/sysconfig/named
+    line: 'OPTIONS="-4"'
+    state: present
+
 - name: Start BIND service
   ansible.builtin.service:
     name: "{{ named_service }}"
@@ -116,9 +128,14 @@
   become: true
   tags: bind
 
-# - name: Permit DNS traffic in firewalld
-#  ansible.posix.firewalld:
-#    service: dns
-#    permanent: true
-#    state: enabled
-#    immediate: true
+- name: Set crypto policy to LEGACY via command line
+  ansible.builtin.command: update-crypto-policies --set LEGACY
+  register: policy_update
+  changed_when: "'Setting system policy to LEGACY' in policy_update.stdout"
+
+- name: Permit DNS traffic in firewalld
+  ansible.posix.firewalld:
+    service: dns
+    permanent: true
+    state: enabled
+    immediate: true
diff --git a/roles/named/templates/etc_named.conf.j2 b/roles/named/templates/etc_named.conf.j2
index 5115ad5..541f945 100644
--- a/roles/named/templates/etc_named.conf.j2
+++ b/roles/named/templates/etc_named.conf.j2
@@ -18,6 +18,15 @@ options {
 {% for port in named_listen_ipv6_port %}
   listen-on-v6 port {{ port }} { {{ named_listen_ipv6|join('; ') }}; };
 {% endfor %}
+  max-cache-size 2048m;
+  minimal-responses no;
+  // Увеличиваем лимиты на количество записей одного типа для одного имени
+  max-records-per-type 10000;
+  // Увеличиваем общий лимит записей на одно имя (на всякий случай)
+  max-types-per-name 100;
+  // Отключает отправку и строгую проверку EDNS Cookies
+  send-cookie no;
+  answer-cookie no;
   directory   "{{ named_dir }}";
   dump-file   "{{ named_dir }}/data/cache_dump.db";
   statistics-file "{{ named_dir }}/data/named_stats.txt";
@@ -32,13 +41,16 @@ options {
 
   recursion {% if named_recursion %}yes{% else %}no{% endif %};
   {% if named_recursion %}allow-recursion { {{ named_allow_recursion|join('; ') }}; };
+  recursive-clients {{ named_recursive_clients }}; 
   {% endif %}
 {% if named_forwarders|length > 0 %}forwarders { {{ named_forwarders|join('; ') }}; };{% endif %}
   {% if named_forward_only %}forward only;{% endif %}
 
+//  edns-udp-size 1220;
+//  max-udp-size 1220;
   rrset-order { order {{ named_rrset_order }}; };
-
-{% if named_dnssec_enable %}  dnssec-enable {{ named_dnssec_enable }};{% endif %}
+// dnssec-enable is depricated
+//{% if named_dnssec_enable %}  dnssec-enable {{ named_dnssec_enable }};{% endif %}
 
   dnssec-validation {{ named_dnssec_validation }};
 
@@ -50,7 +62,6 @@ options {
   pid-file "{{ named_pid_file }}";
   session-keyfile "{{ named_session_keyfile }}";
 {% if named_query_log is defined %}
-
   querylog yes;
 {% endif %}
 {% if named_dns64 %}
@@ -60,6 +71,9 @@ options {
 {% endif %}
 };
 
+// disable ipv6 queries
+server ::/0 { bogus yes; };
+
 {% if named_statistics_channels %}
 statistics-channels {
   inet {{ named_statistics_host }} port {{ named_statistics_port }} allow { {{ named_statistics_allow|join('; ') }}; };
@@ -68,7 +82,7 @@ statistics-channels {
 
 logging {
   channel default_debug {
-    file "{{ named_log }}";
+    file "{{ named_log }}" versions 5 size 10m;
     severity dynamic;
     print-time yes;
   };
@@ -79,7 +93,7 @@ logging {
 {% else %}
     file "{{ named_query_log }}" versions 600 size 20m;
 {% endif %}
-    severity dynamic;
+    severity debug 1;
     print-time yes;
   };
   category queries { querylog; };
@@ -89,10 +103,12 @@ logging {
 {% for log in named_other_logs %}
   channel {{ log.name }} {
     file "{{ log.file }}" versions {{ log.versions }} size {{ log.size }};
-    severity dynamic;
+    severity debug 1;
     print-time yes;
   };
+
   category "{{ log.name }}" { "{{ log.name }}"; };
+
 {% endfor %}
 {% endif %}
 };
@@ -133,7 +149,7 @@ zone "{{ named_zone.name }}" IN {
   also-notify  { {{ named_zone.also_notify|join('; ') }}; };
 {% endif %}
 {% if named_zone.allow_update is defined %}
-  allow-update { {{ named_zone.allow_update|join('; ') }}; };
+  allow-update { {{ named_zone.allow_update|join('; ') }} };
 {% else %}
   allow-update { none; };
 {% endif %}
@@ -156,7 +172,7 @@ zone "{{ named_zone.name }}" IN {
   also-notify  { {{ named_zone.also_notify|join('; ') }}; };
 {% endif %}
 {% if named_zone.certbot_key is defined %}
-  update-policy { grant {{ named_zone.certbot_key }} zonesub TXT; };
+  update-policy { grant {{ named_zone.certbot_key }} name _acme-challenge.{{ named_zone.name }}. txt; };
 {% endif %}
 {% if named_zone.allow_update is defined %}
   allow-update { {{ named_zone.allow_update|join('; ') }}; };