diff --git a/playbooks/mrwho/ns1.yml b/playbooks/mrwho/ns1.yml new file mode 100644 index 0000000..d7cf1c6 --- /dev/null +++ b/playbooks/mrwho/ns1.yml @@ -0,0 +1,192 @@ +--- +- name: Configure named master + hosts: ns1 + roles: + - named + + vars: +# Primary Configuration + named_listen_ipv4: + - "any" + named_listen_ipv4_port: + - 53 + named_listen_ipv6: + - "::" + named_listen_ipv6_port: + - 53 + named_recursion: true + named_allow_recursion: + - "Local" + named_allow_query: + - "any" + named_allow_transfer: + - "Transfer" + named_dns_keys: + - name: CerbotKey + algorithm: hmac-sha512 + secret: as1NQi1QHYX/hAuSR+EbyPYZNgsM2NcTTmSDvPFzkghzUNHAFFSQmabs03gm543vH6X4gYFKXhkzRP2/gQ7nNA== + named_extra_include_files: + - "{{ named_auth_file }}" + named_statistics_channels: + - named_statistics_host: '127.0.0.1' + - named_statistics_port: '8053' + - named_statistics_allow: + - '127.0.0.1' + + named_acls: + - name: Transfer + match_list: + - 80.211.195.127 + - name: Local + match_list: + - 127.0.0.0/8 + - 10.0.0.0/8 + - 172.16.0.0/12 + - 192.168.0.0/16 + + named_zones: + # Primary server for domain gigacoms.info (specify zone type explicitly) + - name: 'mrwho.ru' + type: primary + primaries: + - 212.60.5.162 + certbot_key: "CerbotKey" + also_notify: + - 80.211.195.127 + name_servers: + - ns1.mrwho.ru. + - ns2.mrwho.ru. +# delegate: +# - zone: test.gigacoms.info. +# dns: ns3.gigacoms.info. +# - zone: test.gigacoms.info. +# dns: ns4.gigacoms.ru. + hosts: + - name: ns1 + ip: 80.211.195.127 + - name: ns2 + ip: 212.60.5.162 + - name: mrwho.ru + ip: 80.211.195.127 + # ipv6: 2001:db8::1 + aliases: + - www + - name: vm01 + ip: 80.211.195.127 + # ipv6: 2001:db8::2 + - name: vm02 + ip: 212.60.5.162 + ipv6: 2a00:b700:3::286 + - name: vpn + ip: 80.211.195.127 + # ipv6: 2001:db8::d:1 + - name: msk + ip: 212.60.5.162 + ipv6: 2a00:b700:3::286 + - name: sad + ip: 212.60.5.162 + ipv6: 2a00:b700:3::286 + - name: tun + ip: 212.60.5.162 + ipv6: 2a00:b700:3::286 + - name: mptcp + ip: 212.60.5.162 + ipv6: 2a00:b700:3::286 + - name: ca.local + ip: 212.60.5.162 + ipv6: 2a00:b700:3::286 + - name: git + ip: 212.60.5.162 + ipv6: 2a00:b700:3::286 + - name: git.local + aliases: git + mail_servers: + - name: ASPMX.L.GOOGLE.COM. + preference: 10 + - name: ALT1.ASPMX.L.GOOGLE.COM. + preference: 20 + - name: ASPMX2.L.GOOGLE.COM. + preference: 20 + - name: ASPMX3.L.GOOGLE.COM. + preference: 30 + - name: ASPMX4.L.GOOGLE.COM. + preference: 30 + - name: ASPMX5.L.GOOGLE.COM. + preference: 30 + # services: + # - name: _ldap._tcp + # weight: 100 + # port: 88 + # target: srv010 + # text: + # - name: _kerberos + # text: KERBEROS.ACME-INC.COM + # - name: '@' + # text: + # - 'some text' + # - 'more text' + + - name: 'nimfalida.ru' + type: primary + primaries: + - 212.60.5.162 + certbot_key: "CerbotKey" + also_notify: + - 80.211.195.127 + name_servers: + - ns1.mrwho.ru. + - ns2.mrwho.ru. + hosts: + - name: nimfalida.ru + ip: 212.60.5.162 + ipv6: 2a00:b700:3::286 + aliases: www + mail_servers: + - name: mx.yandex.net. + preference: 10 + + - name: 'nimfalida.ru' + type: primary + primaries: + - 212.60.5.162 + certbot_key: "CerbotKey" + also_notify: + - 80.211.195.127 + name_servers: + - ns1.mrwho.ru. + - ns2.mrwho.ru. + hosts: + - name: storagecat.ru. + ip: 80.211.195.127 + aliases: www + mail_servers: + - name: mx.yandex.net. + preference: 10 + + - name: 'astracpa.com' + type: primary + primaries: + - 212.60.5.162 + certbot_key: "CerbotKey" + also_notify: + - 80.211.195.127 + name_servers: + - ns1.mrwho.ru. + - ns2.mrwho.ru. + mail_servers: + - name: ASPMX.L.GOOGLE.COM. + preference: 10 + - name: ALT1.ASPMX.L.GOOGLE.COM. + preference: 20 + - name: ASPMX2.L.GOOGLE.COM. + preference: 20 + - name: ASPMX3.L.GOOGLE.COM. + preference: 30 + - name: ASPMX4.L.GOOGLE.COM. + preference: 30 + - name: ASPMX5.L.GOOGLE.COM. + preference: 30 + hosts: + - name: astracpa.com. + ip: 80.211.195.127 + aliases: www diff --git a/playbooks/mrwho/ns2.yml b/playbooks/mrwho/ns2.yml new file mode 100644 index 0000000..abf9487 --- /dev/null +++ b/playbooks/mrwho/ns2.yml @@ -0,0 +1,67 @@ +--- +- name: Configure named secondary + hosts: ns2 + roles: + - named + + vars: +# secondary Configuration + named_listen_ipv4: + - "any" + named_listen_ipv4_port: + - 53 + named_listen_ipv6: + - "::" + named_listen_ipv6_port: + - 53 + named_recursion: true + named_allow_recursion: + - "Local" + named_allow_query: + - "any" + named_allow_transfer: + - "Transfer" + named_dns_keys: + - name: CerbotKey + algorithm: hmac-sha512 + secret: as1NQi1QHYX/hAuSR+EbyPYZNgsM2NcTTmSDvPFzkghzUNHAFFSQmabs03gm543vH6X4gYFKXhkzRP2/gQ7nNA== + named_extra_include_files: + - "{{ named_auth_file }}" + named_statistics_channels: + - named_statistics_host: '127.0.0.1' + - named_statistics_port: '8053' + - named_statistics_allow: + - '127.0.0.1' + + named_acls: + - name: Transfer + match_list: + - 80.211.195.127 + - name: Local + match_list: + - 127.0.0.0/8 + - 10.0.0.0/8 + - 172.16.0.0/12 + - 192.168.0.0/16 + + named_zones: + # secondary server for domain gigacoms.info (specify zone type explicitly) + - name: 'mrwho.ru' + type: secondary + primaries: + - 212.60.5.162 + + - name: 'nimfalida.ru' + type: secondary + primaries: + - 212.60.5.162 + + - name: 'nimfalida.ru' + type: secondary + primaries: + - 212.60.5.162 + + - name: 'astracpa.com' + type: secondary + primaries: + - 212.60.5.162 diff --git a/playbooks/mrwho/router-certbot.yml b/playbooks/mrwho/router-certbot.yml index 21e4e45..ecdd8d6 100644 --- a/playbooks/mrwho/router-certbot.yml +++ b/playbooks/mrwho/router-certbot.yml @@ -26,8 +26,8 @@ certbot_dns_plugin: rfc2136 certbot_dns_target_server: certbot_dns_target_server_port: 53 - certbot_dns_tsig_keyname: certbot-key - certbot_dns_key_secret: YCUScDPbF9bscPFB0mLzRr2/V54FB7tcrifAdrrnlBI= + certbot_dns_tsig_keyname: CertbotKey + certbot_dns_key_secret: as1NQi1QHYX/hAuSR+EbyPYZNgsM2NcTTmSDvPFzkghzUNHAFFSQmabs03gm543vH6X4gYFKXhkzRP2/gQ7nNA== certbot_dns_key_algorithm: HMAC-SHA256 roles: diff --git a/playbooks/ns2.yml b/playbooks/ns2.yml deleted file mode 100644 index fbff5c6..0000000 --- a/playbooks/ns2.yml +++ /dev/null @@ -1,127 +0,0 @@ ---- -- name: Configure named ns2 - hosts: ns2 - roles: - - routing-policy-dns-via-balancer - - named - vars: - policy_routing_local_routes: - - "10.203.2.0/24 dev ens192 scope link src {{ ansible_host }} metric 100" - - policy_routing_balancers: - - ip: "{{ hostvars['vm01-balancer'].ansible_host }}" - mac: "{{ hostvars['vm01-balancer'].nic_ens192_mac }}" - table_id: 53 - table_name: dns-via-vm01 - fwmark: 53 - - ip: "{{ hostvars['vm02-balancer'].ansible_host }}" - mac: "{{ hostvars['vm02-balancer'].nic_ens192_mac }}" - table_id: 54 - table_name: dns-via-vm02 - fwmark: 54 -# Secondary Configuration - named_listen_ipv4: - - "any" - named_listen_ipv4_port: - - 53 - named_listen_ipv6: - - "::" - named_listen_ipv6_port: - - 53 - named_recursion: true - named_allow_recursion: - - "Local" - named_allow_query: - - "any" - named_allow_transfer: - - "Transfer" - named_extra_include_files: - - "{{ named_auth_file }}" - named_statistics_channels: - - named_statistics_host: '127.0.0.1' - - named_statistics_port: '8053' - - named_statistics_allow: - - '127.0.0.1' - - named_acls: - - name: Transfer - match_list: - - 91.218.87.251 - - 10.203.0.84 - - 10.203.0.85 - - name: Local - match_list: - - 127.0.0.1 - - 127.0.0.0/8 - - 10.0.0.0/8 - - 172.16.0.0/12 - - 192.168.0.0/16 - - 100.64.0.0/10 - - 91.218.84.0/22 - - 91.236.140.0/22 - - 91.197.57.0/24 - - 213.109.201.0/24 - - 46.255.25.0/24 - - 2a13:af80::/29 - - named_zones: - # Primary server for domain gigacoms.info (specify zone type explicitly) - - name: 'gigacoms.info' - type: secondary - primaries: - - 10.203.2.11 - - - name: 'gigacoms.ru' - type: secondary - primaries: - - 10.203.2.11 - - - name: 'serverok.ru' - type: secondary - primaries: - - 10.203.2.11 - - - name: 'vermax.com' - type: secondary - primaries: - - 10.203.2.11 - - - name: '84.218.91.in-addr.arpa' - type: secondary - primaries: - - 10.203.2.11 - - - name: '85.218.91.in-addr.arpa' - type: secondary - primaries: - - 10.203.2.11 - - - name: '86.218.91.in-addr.arpa' - type: secondary - primaries: - - 10.203.2.11 - - - name: '87.218.91.in-addr.arpa' - type: secondary - primaries: - - 10.203.2.11 - - - name: '140.236.91.in-addr.arpa' - type: secondary - primaries: - - 10.203.2.11 - - - name: '141.236.91.in-addr.arpa' - type: secondary - primaries: - - 10.203.2.11 - - - name: '201.109.213.in-addr.arpa' - type: secondary - primaries: - - 10.203.2.11 - - - name: '0.203.10.in-addr.arpa' - type: secondary - primaries: - - 10.203.2.11