---
- name: Configure named ns1
  hosts: ns1
  roles:
    - routing-policy-dns-via-balancer
    - named

  vars:
    policy_routing_local_routes:
      - "10.203.2.0/24 dev ens192 scope link src {{ ansible_host }} metric 100"

    policy_routing_balancers:
      - ip: "{{ hostvars['vm01-balancer'].ansible_host }}"
        mac: "{{ hostvars['vm01-balancer'].nic_ens192_mac }}"
        table_id: 53
        table_name: dns-via-vm01
        fwmark: 53
      - ip: "{{ hostvars['vm02-balancer'].ansible_host }}"
        mac: "{{ hostvars['vm02-balancer'].nic_ens192_mac }}"
        table_id: 54
        table_name: dns-via-vm02
        fwmark: 54
# Primary Configuration
    named_listen_ipv4:
      - "any"
    named_listen_ipv4_port:
      - 53
    named_listen_ipv6:
      - "::"
    named_listen_ipv6_port:
      - 53
    named_recursion: true
    named_allow_recursion:
      - "Local"
    named_allow_query:
      - "any"
    named_allow_transfer:
      - "Transfer"
    named_dns_keys:
      - name: CertbotKey
        algorithm: hmac-sha512
        secret: "hbxr+SNi3kzzygeArFp/1xgribKLDLZEfRWWh/btH6jauMrcJ0oPyOEuP11d1Oq10HUJnTKnOtb8YlnxrM4HcA=="
    named_extra_include_files:
      - "{{ named_auth_file }}"
    named_statistics_channels:
      - named_statistics_host: '127.0.0.1'
      - named_statistics_port: '8053'
      - named_statistics_allow:
          - '127.0.0.1'

    named_acls:
      - name: Transfer
        match_list:
          - 91.218.87.251
          - 10.203.0.84
          - 10.203.0.85
          - 10.203.2.11
          - 10.203.2.12
      - name: Local
        match_list:
          - 127.0.0.1
          - 127.0.0.0/8
          - 10.0.0.0/8
          - 172.16.0.0/12
          - 192.168.0.0/16
          - 100.64.0.0/10
          - 91.218.84.0/22
          - 91.236.140.0/22
          - 91.197.57.0/24
          - 213.109.201.0/24
          - 46.255.25.0/24
          - 2a13:af80::/29

    named_zones:
      # Primary server for domain gigacoms.info (specify zone type explicitly)
      - name: 'gigacoms.info'
        type: primary
        certbot_key: "CerbotKey"
        also_notify:
          - 10.203.2.12
        primaries:
          - 10.203.2.11
        name_servers:
          - ns1.gigacoms.ru.
          - ns2.gigacoms.ru.
#        delegate:
#          - zone: test.gigacoms.info.
#            dns: ns3.gigacoms.info.
#          - zone: test.gigacoms.info.
#            dns: ns4.gigacoms.ru.
        hosts:
          - name: ns1
            ip: 10.203.2.11
          - name: ns2
            ip: 91.218.87.251
          - name: gitlab
            ip: 91.218.87.197
            # ipv6: 2001:db8::1
            aliases:
              - reg.gitlab
              - pages.gitlab
              - '*.pages.gitlab'
          - name: minio
            ip: 91.218.87.224
            # ipv6: 2001:db8::2
            aliases:
              - registry
              - kas
          - name: tp.beta
            ip: 10.201.0.6
            # ipv6: 2001:db8::d:1
          - name: vc1.beta
            ip: 10.203.0.9
            # ipv6: 2001:db8::d:2
          - name: vctest.beta
            ip: 10.203.0.13
            # ipv6: 2001:db8::d:3
          - name: hs001.beta
            ip: 10.203.0.10
          - name: hs002.beta
            ip: 10.203.0.11
          - name: hs003.beta
            ip: 10.203.0.12
          - name: db1.local
            ip: 10.201.0.21
          - name: db2.local
            ip: 10.201.0.22
          - name: dbpr.local
            ip: 10.201.0.31
          - name: nfs1.local
            ip: 10.201.0.250
          - name: node1.local
            ip: 10.201.0.20
          - name: node2.local
            ip: 10.201.0.30
          - name: vm-monitoring.local
            ip: 10.201.0.2
          - name: mskix-asbr-msk-m9-1
            ip: 195.208.209.197
          - name: mskix-asbr-msk-m9-2
            ip: 195.208.209.77
          - name: node1
            ip: 91.218.87.220
          - name: node2
            ip: 91.218.87.230
          - name: ns1
            ip: 91.218.87.254
          - name: ns2
            ip: 91.218.87.251
          - name: server-service-1
            ip: 91.218.87.196
          - name: ttk-asbr-modmd-1
            ip: 217.150.46.25
          - name: tn001
            ip: 10.203.0.4
          - name: default
            ip: 91.218.87.224
          - name: zabbix-db
            ip: 10.203.0.51
          - name: zabbix
            ip: 10.203.0.50
          - name: netbox
            ip: 10.203.0.91
          - name: br001
            ip: 10.202.0.19
          - name: skat-bras-1
            ip: 10.203.0.252
          - name: ldap
            ip: 10.203.0.81
          - name: dc1.smb
            ip: 10.203.0.83
          - name: br001.smb
            ip: 10.202.0.19
          - name: pale
            ip: 10.203.0.83
          - name: '*.d'
            ip:
              - 10.203.0.211
              - 10.203.0.212
        # mail_servers:
        #  - name: mail001
        #    preference: 10
        #  - name: mail002
        #    preference: 20
        # services:
        #  - name: _ldap._tcp
        #    weight: 100
        #    port: 88
        #    target: srv010
        # text:
        #  - name: _kerberos
        #    text: KERBEROS.ACME-INC.COM
        #  - name: '@'
        #    text:
        #      - 'some text'
        #      - 'more text'

      - name: 'gigacoms.ru'
        type: primary
        certbot_key: "CerbotKey"
        primaries:
          - 10.203.2.11
        also_notify:
          - 10.203.2.12
#        networks:
#          - '91.218.84'
#          - '91.218.85'
#          - '91.218.86'
#          - '91.218.87'
#          - '91.236.140'
#          - '91.236.141'
#          - '91.236.142'
#          - '91.236.143'
#          - '213.109.201'
#          - '10.11'
#        ipv6_networks:
#          - '2001:db8::/48'
        name_servers:
          - ns1
          - ns2
        hosts:
          - name: ns1
            ip: 91.218.87.254
          - name: ns2
            ip: 91.218.87.251
          - name: mail
            alias: domain.mail.yandex.net.
          - name: calendar
            alias: ghs.google.com.
          - name: corp
            alias: ghs.google.com.
          - name: docs
            alias: ghs.google.com.
          - name: podpiska
            alias: showcase.rentsoft.ru.
          - name: shop
            alias: lb.bitrix24.shop.
          - name: gigacoms.ru.
            ip: 91.218.87.248
            alias: www
          - name: acs
            ip: 10.1.1.70
          - name: 2ip1
            ip: 91.218.87.250
            alias: 2ip2
          - name: bill
            ip: 91.218.87.225
          - name: b2b
            ip: 91.218.87.225
          - name: crm
            ip: 91.218.87.225
          - name: hd
            ip: 91.218.87.225
          - name: hd-dev
            ip: 91.218.87.225
          - name: dev
            ip: 91.218.87.225
          - name: lora
            ip: 91.218.87.225
          - name: pg
            ip: 91.218.87.225
          - name: pulse
            ip: 91.218.87.225
          - name: report
            ip: 91.218.87.225
          - name: rkn
            ip: 91.218.87.225
          - name: us
            ip: 91.218.87.225
          - name: 24api
            ip: 91.218.87.225
          - name: vmmgr
            ip: 91.218.87.225
          - name: blmgr
            ip: 91.218.87.225
          - name: dcimgr
            ip: 91.218.87.225
          - name: logs
            ip: 91.218.87.225
          - name: grafana
            ip: 91.218.87.225
          - name: graylog
            ip: 91.218.87.225
          - name: okemerg
            ip: 91.218.87.225
          - name: portal
            ip: 91.218.87.225
          - name: fpst
            ip: 91.218.87.202
          - name: gate
            ip: 91.218.87.205
          - name: iot
            ip: 91.218.87.198
          - name: mon
            ip: 91.218.87.196
          - name: b24
            ip: 91.218.87.249
          - name: dev-b24
            ip: 91.218.87.248
          - name: service
            ip: 91.218.87.250
          - name: st1
            ip: 91.218.87.250
          - name: st2
            ip: 91.218.87.250
          - name: tvmw
            ip: 91.218.87.203
          - name: git
            ip: 91.236.140.132
          - name: node3
            ip: 10.201.0.103
          - name: vpn.office
            ip: 91.218.87.205
          - name: skat-bras-1
            ip: 10.203.0.252
          - name: skat-bras-2
            ip: 10.203.0.251
          - name: portainer
            ip: 91.218.87.220
          - name: gitlab
            ip: 91.218.87.220
          - name: semaphore
            ip: 91.218.87.220
          - name: nxmc
            ip: 91.218.87.220
          - name: zabbix
            ip: 91.218.87.220
          - name: genie
            ip: 91.218.87.220
          - name: ezdepot
            ip: 91.218.87.220
          - name: has
            ip: 91.218.87.220
          - name: probe
            ip: 91.218.87.220
          - name: miniui
            ip: 91.218.87.220
          - name: miniapi
            ip: 91.218.87.220

        mail_servers:
          - name: mx.yandex.net.
            preference: 10
        # services:
        #  - name: _ldap._tcp
        #    weight: 100
        #    port: 88
        #    target: srv010
        text:
          - name: mail._domainkey
            text: "v=DKIM1; k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCngEizyzxPM785+q4dcj6MPKDsoTkP5DMzxptWso06+w+ROAxGX45ZijvGnQaA1WCKuATxr4kB0RvN6FGw8HpaNVPX7Odp8G8qkcNWCN4q4aHngQtoj5GMcwlR+Dvuv/AJ67VdL+9H/FxyJHR8ucje6MJzSYizxVpTNMyDF+lQZwIDAQAB"
          - name: us._domainkey
            text: "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDRjOsvZZKZ/j3UhgVD+YwNftnSSXdWbqAf1QGz/IfvcvySKnrWzaaH2nSBYUXr2eiCzSuaJOwC8xnHcrfdSTBN3f4r+WqUcfTMdn5gROSn6TIg5bJMv+QFmo2b2kjOAgq7t+3yplKBneUnY8UXn33gt5EJ+ROVTYrL710nq4MbPwIDAQAB"
          - name: '@'
            text:
              - "yandex-verification: 11bf6000ca841ac9"
              - "v=spf1 include:_spf.yandex.net include:spf.unisender.com ~all"

      - name: 'serverok.ru'
        type: primary
        certbot_key: "CerbotKey"
        primaries:
          - 10.203.2.11
        also_notify:
          - 10.203.2.12
        name_servers:
          - ns1.gigacoms.ru.
          - ns2.gigacoms.ru.
        hosts:
          - name: ns1
            ip: 91.218.87.254
          - name: ns2
            ip: 91.218.87.251

      - name: 'vermax.com'
        type: primary
        certbot_key: "CerbotKey"
        primaries:
          - 10.203.2.11
        name_servers:
          - ns1.gigacoms.ru.
          - ns2.gigacoms.ru.
        hosts:
          - name: ns1
            ip: 91.218.87.254
          - name: ns2
            ip: 91.218.87.251
          - name: update
            ip: 10.203.0.77

      - name: '84.218.91.in-addr.arpa'
        type: primary
        primaries:
          - 10.203.2.11
        also_notify:
          - 10.203.2.12
        name_servers:
          - ns1.gigacoms.ru.
          - ns2.gigacoms.ru.
        reverse_zone: true
        ptr_records:
          - name: '56'
            ptr: 'mail.kotpilota.ru'
          - name: '161'
            ptr: 'smtp.gruzavto.net'
          - name: '242'
            ptr: 'exchange.freshsecret.ru'

      - name: '85.218.91.in-addr.arpa'
        type: primary
        primaries:
          - 10.203.2.11
        also_notify:
          - 10.203.2.12
        name_servers:
          - ns1.gigacoms.ru.
          - ns2.gigacoms.ru.
        reverse_zone: true
        ptr_records:
          - name: '55'
            ptr: 'mx.wps.ru'
          - name: '138'
            ptr: 'mail.amazone.pro'
          - name: '229'
            ptr: 'billing.dnpveteran.ru'

      - name: '86.218.91.in-addr.arpa'
        type: primary
        primaries:
          - 10.203.2.11
        also_notify:
          - 10.203.2.12
        name_servers:
          - ns1.gigacoms.ru.
          - ns2.gigacoms.ru.
        reverse_zone: true
        ptr_records:
          - name: '149'
            ptr: 'mail.d4t.ru'
          - name: '184'
            ptr: 'mx.huaxun.ru'

      - name: '87.218.91.in-addr.arpa'
        type: primary
        primaries:
          - 10.203.2.11
        also_notify:
          - 10.203.2.12
        name_servers:
          - ns1.gigacoms.ru.
          - ns2.gigacoms.ru.
        reverse_zone: true
        ptr_records:
          - name: '205'
            ptr: 'gate.gigacoms.ru'
          - name: '247'
            ptr: 'ns1.gigacoms.info'
          - name: '251'
            ptr: 'ns2.gigacoms.ru'
          - name: '251'
            ptr: 'ns4.gigacoms.info'
          - name: '254'
            ptr: 'ns1.gigacoms.ru'
          - name: '254'
            ptr: 'ns3.gigacoms.info'

      - name: '140.236.91.in-addr.arpa'
        type: primary
        primaries:
          - 10.203.2.11
        also_notify:
          - 10.203.2.12
        name_servers:
          - ns1.gigacoms.ru.
          - ns2.gigacoms.ru.
        reverse_zone: true
        ptr_records:
          - name: '96/28.140.236.91.in-addr.arpa.'
            dns: 'ns1.cittransm.ru.'
          - name: '96/28.140.236.91.in-addr.arpa.'
            dns: 'ns2.cittransm.ru.'
          - name: '96/28.140.236.91.in-addr.arpa.'
            dns: 'ns3.cittransm.ru.'
          - name: '96'
            cname: '96.96/28.140.236.91.in-addr.arpa.'
          - name: '97'
            cname: '97.96/28.140.236.91.in-addr.arpa.'
          - name: '98'
            cname: '98.96/28.140.236.91.in-addr.arpa.'
          - name: '99'
            cname: '99.96/28.140.236.91.in-addr.arpa.'
          - name: '100'
            cname: '100.96/28.140.236.91.in-addr.arpa.'
          - name: '101'
            cname: '101.96/28.140.236.91.in-addr.arpa.'
          - name: '102'
            cname: '102.96/28.140.236.91.in-addr.arpa.'
          - name: '103'
            cname: '103.96/28.140.236.91.in-addr.arpa.'
          - name: '104'
            cname: '104.96/28.140.236.91.in-addr.arpa.'
          - name: '105'
            cname: '105.96/28.140.236.91.in-addr.arpa.'
          - name: '106'
            cname: '106.96/28.140.236.91.in-addr.arpa.'
          - name: '107'
            cname: '107.96/28.140.236.91.in-addr.arpa.'
          - name: '108'
            cname: '108.96/28.140.236.91.in-addr.arpa.'
          - name: '109'
            cname: '109.96/28.140.236.91.in-addr.arpa.'
          - name: '110'
            cname: '110.96/28.140.236.91.in-addr.arpa.'
          - name: '111'
            cname: '111.96/28.140.236.91.in-addr.arpa.'
          - name: '45'
            ptr: 'mail.rst26.ru'
          - name: '88'
            ptr: 'ohana.msk.ru'
          - name: '162'
            ptr: 'gromakov.org'
          - name: '168'
            ptr: 'mail.roomika-mebel.ru'

      - name: '141.236.91.in-addr.arpa'
        type: primary
        primaries:
          - 10.203.2.11
        also_notify:
          - 10.203.2.12
        name_servers:
          - ns1.gigacoms.ru.
          - ns2.gigacoms.ru.
        reverse_zone: true
        ptr_records:
          - name: '89'
            ptr: 'mail.geocaching.su'

      - name: '201.109.213.in-addr.arpa'
        type: primary
        primaries:
          - 10.203.2.11
        also_notify:
          - 10.203.2.12
        name_servers:
          - ns1.gigacoms.ru.
          - ns2.gigacoms.ru.
        reverse_zone: true
        ptr_records:
          - name: '166'
            ptr: 'mx.gromakov.org'
          - name: '203'
            ptr: 'mail.testvia.ru'

      - name: '0.203.10.in-addr.arpa'
        type: primary
        primaries:
          - 10.203.2.11
        also_notify:
          - 10.203.2.12
        name_servers:
          - ns1.gigacoms.ru.
          - ns2.gigacoms.ru.
        reverse_zone: true
        ptr_records:
          - name: '9'
            ptr: 'vc1.beta.gigacoms.info'
          - name: '13'
            ptr: 'vctest.beta.gigacoms.info'