mrwho/Ansible-Roles
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ns

Browse source
This commit is contained in:
mrwho 2026-05-08 23:48:41 +03:00
parent d2b3f8d612
commit a37ec1b5b7
4 changed files with 261 additions and 129 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

192
playbooks/mrwho/ns1.yml Normal file
View file

@ -0,0 +1,192 @@
---
- name: Configure named master
hosts: ns1
roles:
- named
vars:
# Primary Configuration
named_listen_ipv4:
- "any"
named_listen_ipv4_port:
- 53
named_listen_ipv6:
- "::"
named_listen_ipv6_port:
- 53
named_recursion: true
named_allow_recursion:
- "Local"
named_allow_query:
- "any"
named_allow_transfer:
- "Transfer"
named_dns_keys:
- name: CerbotKey
algorithm: hmac-sha512
secret: as1NQi1QHYX/hAuSR+EbyPYZNgsM2NcTTmSDvPFzkghzUNHAFFSQmabs03gm543vH6X4gYFKXhkzRP2/gQ7nNA==
named_extra_include_files:
- "{{ named_auth_file }}"
named_statistics_channels:
- named_statistics_host: '127.0.0.1'
- named_statistics_port: '8053'
- named_statistics_allow:
- '127.0.0.1'
named_acls:
- name: Transfer
match_list:
- 80.211.195.127
- name: Local
match_list:
- 127.0.0.0/8
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
named_zones:
# Primary server for domain gigacoms.info (specify zone type explicitly)
- name: 'mrwho.ru'
type: primary
primaries:
- 212.60.5.162
certbot_key: "CerbotKey"
also_notify:
- 80.211.195.127
name_servers:
- ns1.mrwho.ru.
- ns2.mrwho.ru.
# delegate:
# - zone: test.gigacoms.info.
# dns: ns3.gigacoms.info.
# - zone: test.gigacoms.info.
# dns: ns4.gigacoms.ru.
hosts:
- name: ns1
ip: 80.211.195.127
- name: ns2
ip: 212.60.5.162
- name: mrwho.ru
ip: 80.211.195.127
# ipv6: 2001:db8::1
aliases:
- www
- name: vm01
ip: 80.211.195.127
# ipv6: 2001:db8::2
- name: vm02
ip: 212.60.5.162
ipv6: 2a00:b700:3::286
- name: vpn
ip: 80.211.195.127
# ipv6: 2001:db8::d:1
- name: msk
ip: 212.60.5.162
ipv6: 2a00:b700:3::286
- name: sad
ip: 212.60.5.162
ipv6: 2a00:b700:3::286
- name: tun
ip: 212.60.5.162
ipv6: 2a00:b700:3::286
- name: mptcp
ip: 212.60.5.162
ipv6: 2a00:b700:3::286
- name: ca.local
ip: 212.60.5.162
ipv6: 2a00:b700:3::286
- name: git
ip: 212.60.5.162
ipv6: 2a00:b700:3::286
- name: git.local
aliases: git
mail_servers:
- name: ASPMX.L.GOOGLE.COM.
preference: 10
- name: ALT1.ASPMX.L.GOOGLE.COM.
preference: 20
- name: ASPMX2.L.GOOGLE.COM.
preference: 20
- name: ASPMX3.L.GOOGLE.COM.
preference: 30
- name: ASPMX4.L.GOOGLE.COM.
preference: 30
- name: ASPMX5.L.GOOGLE.COM.
preference: 30
# services:
# - name: _ldap._tcp
# weight: 100
# port: 88
# target: srv010
# text:
# - name: _kerberos
# text: KERBEROS.ACME-INC.COM
# - name: '@'
# text:
# - 'some text'
# - 'more text'
- name: 'nimfalida.ru'
type: primary
primaries:
- 212.60.5.162
certbot_key: "CerbotKey"
also_notify:
- 80.211.195.127
name_servers:
- ns1.mrwho.ru.
- ns2.mrwho.ru.
hosts:
- name: nimfalida.ru
ip: 212.60.5.162
ipv6: 2a00:b700:3::286
aliases: www
mail_servers:
- name: mx.yandex.net.
preference: 10
- name: 'nimfalida.ru'
type: primary
primaries:
- 212.60.5.162
certbot_key: "CerbotKey"
also_notify:
- 80.211.195.127
name_servers:
- ns1.mrwho.ru.
- ns2.mrwho.ru.
hosts:
- name: storagecat.ru.
ip: 80.211.195.127
aliases: www
mail_servers:
- name: mx.yandex.net.
preference: 10
- name: 'astracpa.com'
type: primary
primaries:
- 212.60.5.162
certbot_key: "CerbotKey"
also_notify:
- 80.211.195.127
name_servers:
- ns1.mrwho.ru.
- ns2.mrwho.ru.
mail_servers:
- name: ASPMX.L.GOOGLE.COM.
preference: 10
- name: ALT1.ASPMX.L.GOOGLE.COM.
preference: 20
- name: ASPMX2.L.GOOGLE.COM.
preference: 20
- name: ASPMX3.L.GOOGLE.COM.
preference: 30
- name: ASPMX4.L.GOOGLE.COM.
preference: 30
- name: ASPMX5.L.GOOGLE.COM.
preference: 30
hosts:
- name: astracpa.com.
ip: 80.211.195.127
aliases: www

67
playbooks/mrwho/ns2.yml Normal file
View file

@ -0,0 +1,67 @@
---
- name: Configure named secondary
hosts: ns2
roles:
- named
vars:
# secondary Configuration
named_listen_ipv4:
- "any"
named_listen_ipv4_port:
- 53
named_listen_ipv6:
- "::"
named_listen_ipv6_port:
- 53
named_recursion: true
named_allow_recursion:
- "Local"
named_allow_query:
- "any"
named_allow_transfer:
- "Transfer"
named_dns_keys:
- name: CerbotKey
algorithm: hmac-sha512
secret: as1NQi1QHYX/hAuSR+EbyPYZNgsM2NcTTmSDvPFzkghzUNHAFFSQmabs03gm543vH6X4gYFKXhkzRP2/gQ7nNA==
named_extra_include_files:
- "{{ named_auth_file }}"
named_statistics_channels:
- named_statistics_host: '127.0.0.1'
- named_statistics_port: '8053'
- named_statistics_allow:
- '127.0.0.1'
named_acls:
- name: Transfer
match_list:
- 80.211.195.127
- name: Local
match_list:
- 127.0.0.0/8
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
named_zones:
# secondary server for domain gigacoms.info (specify zone type explicitly)
- name: 'mrwho.ru'
type: secondary
primaries:
- 212.60.5.162
- name: 'nimfalida.ru'
type: secondary
primaries:
- 212.60.5.162
- name: 'nimfalida.ru'
type: secondary
primaries:
- 212.60.5.162
- name: 'astracpa.com'
type: secondary
primaries:
- 212.60.5.162

4
playbooks/mrwho/router-certbot.yml
View file

@ -26,8 +26,8 @@
certbot_dns_plugin: rfc2136
certbot_dns_target_server:
certbot_dns_target_server_port: 53
certbot_dns_tsig_keyname: certbot-key
certbot_dns_key_secret: YCUScDPbF9bscPFB0mLzRr2/V54FB7tcrifAdrrnlBI=
certbot_dns_tsig_keyname: CertbotKey
certbot_dns_key_secret: as1NQi1QHYX/hAuSR+EbyPYZNgsM2NcTTmSDvPFzkghzUNHAFFSQmabs03gm543vH6X4gYFKXhkzRP2/gQ7nNA==
certbot_dns_key_algorithm: HMAC-SHA256
roles:

127
playbooks/ns2.yml
View file

@ -1,127 +0,0 @@
---
- name: Configure named ns2
hosts: ns2
roles:
- routing-policy-dns-via-balancer
- named
vars:
policy_routing_local_routes:
- "10.203.2.0/24 dev ens192 scope link src {{ ansible_host }} metric 100"
policy_routing_balancers:
- ip: "{{ hostvars['vm01-balancer'].ansible_host }}"
mac: "{{ hostvars['vm01-balancer'].nic_ens192_mac }}"
table_id: 53
table_name: dns-via-vm01
fwmark: 53
- ip: "{{ hostvars['vm02-balancer'].ansible_host }}"
mac: "{{ hostvars['vm02-balancer'].nic_ens192_mac }}"
table_id: 54
table_name: dns-via-vm02
fwmark: 54
# Secondary Configuration
named_listen_ipv4:
- "any"
named_listen_ipv4_port:
- 53
named_listen_ipv6:
- "::"
named_listen_ipv6_port:
- 53
named_recursion: true
named_allow_recursion:
- "Local"
named_allow_query:
- "any"
named_allow_transfer:
- "Transfer"
named_extra_include_files:
- "{{ named_auth_file }}"
named_statistics_channels:
- named_statistics_host: '127.0.0.1'
- named_statistics_port: '8053'
- named_statistics_allow:
- '127.0.0.1'
named_acls:
- name: Transfer
match_list:
- 91.218.87.251
- 10.203.0.84
- 10.203.0.85
- name: Local
match_list:
- 127.0.0.1
- 127.0.0.0/8
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 100.64.0.0/10
- 91.218.84.0/22
- 91.236.140.0/22
- 91.197.57.0/24
- 213.109.201.0/24
- 46.255.25.0/24
- 2a13:af80::/29
named_zones:
# Primary server for domain gigacoms.info (specify zone type explicitly)
- name: 'gigacoms.info'
type: secondary
primaries:
- 10.203.2.11
- name: 'gigacoms.ru'
type: secondary
primaries:
- 10.203.2.11
- name: 'serverok.ru'
type: secondary
primaries:
- 10.203.2.11
- name: 'vermax.com'
type: secondary
primaries:
- 10.203.2.11
- name: '84.218.91.in-addr.arpa'
type: secondary
primaries:
- 10.203.2.11
- name: '85.218.91.in-addr.arpa'
type: secondary
primaries:
- 10.203.2.11
- name: '86.218.91.in-addr.arpa'
type: secondary
primaries:
- 10.203.2.11
- name: '87.218.91.in-addr.arpa'
type: secondary
primaries:
- 10.203.2.11
- name: '140.236.91.in-addr.arpa'
type: secondary
primaries:
- 10.203.2.11
- name: '141.236.91.in-addr.arpa'
type: secondary
primaries:
- 10.203.2.11
- name: '201.109.213.in-addr.arpa'
type: secondary
primaries:
- 10.203.2.11
- name: '0.203.10.in-addr.arpa'
type: secondary
primaries:
- 10.203.2.11