570 lines
16 KiB
YAML
570 lines
16 KiB
YAML
---
|
|
- name: Configure named ns1
|
|
hosts: ns1
|
|
roles:
|
|
- routing-policy-dns-via-balancer
|
|
- named
|
|
|
|
vars:
|
|
policy_routing_local_routes:
|
|
- "10.203.2.0/24 dev ens192 scope link src {{ ansible_host }} metric 100"
|
|
|
|
policy_routing_balancers:
|
|
- ip: "{{ hostvars['vm01-balancer'].ansible_host }}"
|
|
mac: "{{ hostvars['vm01-balancer'].nic_ens192_mac }}"
|
|
table_id: 53
|
|
table_name: dns-via-vm01
|
|
fwmark: 53
|
|
- ip: "{{ hostvars['vm02-balancer'].ansible_host }}"
|
|
mac: "{{ hostvars['vm02-balancer'].nic_ens192_mac }}"
|
|
table_id: 54
|
|
table_name: dns-via-vm02
|
|
fwmark: 54
|
|
# Primary Configuration
|
|
named_listen_ipv4:
|
|
- "any"
|
|
named_listen_ipv4_port:
|
|
- 53
|
|
named_listen_ipv6:
|
|
- "::"
|
|
named_listen_ipv6_port:
|
|
- 53
|
|
named_recursion: true
|
|
named_allow_recursion:
|
|
- "Local"
|
|
named_allow_query:
|
|
- "any"
|
|
named_allow_transfer:
|
|
- "Transfer"
|
|
named_dns_keys:
|
|
- name: CertbotKey
|
|
algorithm: hmac-sha512
|
|
secret: "hbxr+SNi3kzzygeArFp/1xgribKLDLZEfRWWh/btH6jauMrcJ0oPyOEuP11d1Oq10HUJnTKnOtb8YlnxrM4HcA=="
|
|
named_extra_include_files:
|
|
- "{{ named_auth_file }}"
|
|
named_statistics_channels:
|
|
- named_statistics_host: '127.0.0.1'
|
|
- named_statistics_port: '8053'
|
|
- named_statistics_allow:
|
|
- '127.0.0.1'
|
|
|
|
named_acls:
|
|
- name: Transfer
|
|
match_list:
|
|
- 91.218.87.251
|
|
- 10.203.0.84
|
|
- 10.203.0.85
|
|
- 10.203.2.11
|
|
- 10.203.2.12
|
|
- name: Local
|
|
match_list:
|
|
- 127.0.0.1
|
|
- 127.0.0.0/8
|
|
- 10.0.0.0/8
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|
|
- 100.64.0.0/10
|
|
- 91.218.84.0/22
|
|
- 91.236.140.0/22
|
|
- 91.197.57.0/24
|
|
- 213.109.201.0/24
|
|
- 46.255.25.0/24
|
|
- 2a13:af80::/29
|
|
|
|
named_zones:
|
|
# Primary server for domain gigacoms.info (specify zone type explicitly)
|
|
- name: 'gigacoms.info'
|
|
type: primary
|
|
certbot_key: "CerbotKey"
|
|
also_notify:
|
|
- 10.203.2.12
|
|
primaries:
|
|
- 10.203.2.11
|
|
name_servers:
|
|
- ns1.gigacoms.ru.
|
|
- ns2.gigacoms.ru.
|
|
# delegate:
|
|
# - zone: test.gigacoms.info.
|
|
# dns: ns3.gigacoms.info.
|
|
# - zone: test.gigacoms.info.
|
|
# dns: ns4.gigacoms.ru.
|
|
hosts:
|
|
- name: ns1
|
|
ip: 10.203.2.11
|
|
- name: ns2
|
|
ip: 91.218.87.251
|
|
- name: gitlab
|
|
ip: 91.218.87.197
|
|
# ipv6: 2001:db8::1
|
|
aliases:
|
|
- reg.gitlab
|
|
- pages.gitlab
|
|
- '*.pages.gitlab'
|
|
- name: minio
|
|
ip: 91.218.87.224
|
|
# ipv6: 2001:db8::2
|
|
aliases:
|
|
- registry
|
|
- kas
|
|
- name: tp.beta
|
|
ip: 10.201.0.6
|
|
# ipv6: 2001:db8::d:1
|
|
- name: vc1.beta
|
|
ip: 10.203.0.9
|
|
# ipv6: 2001:db8::d:2
|
|
- name: vctest.beta
|
|
ip: 10.203.0.13
|
|
# ipv6: 2001:db8::d:3
|
|
- name: hs001.beta
|
|
ip: 10.203.0.10
|
|
- name: hs002.beta
|
|
ip: 10.203.0.11
|
|
- name: hs003.beta
|
|
ip: 10.203.0.12
|
|
- name: db1.local
|
|
ip: 10.201.0.21
|
|
- name: db2.local
|
|
ip: 10.201.0.22
|
|
- name: dbpr.local
|
|
ip: 10.201.0.31
|
|
- name: nfs1.local
|
|
ip: 10.201.0.250
|
|
- name: node1.local
|
|
ip: 10.201.0.20
|
|
- name: node2.local
|
|
ip: 10.201.0.30
|
|
- name: vm-monitoring.local
|
|
ip: 10.201.0.2
|
|
- name: mskix-asbr-msk-m9-1
|
|
ip: 195.208.209.197
|
|
- name: mskix-asbr-msk-m9-2
|
|
ip: 195.208.209.77
|
|
- name: node1
|
|
ip: 91.218.87.220
|
|
- name: node2
|
|
ip: 91.218.87.230
|
|
- name: ns1
|
|
ip: 91.218.87.254
|
|
- name: ns2
|
|
ip: 91.218.87.251
|
|
- name: server-service-1
|
|
ip: 91.218.87.196
|
|
- name: ttk-asbr-modmd-1
|
|
ip: 217.150.46.25
|
|
- name: tn001
|
|
ip: 10.203.0.4
|
|
- name: default
|
|
ip: 91.218.87.224
|
|
- name: zabbix-db
|
|
ip: 10.203.0.51
|
|
- name: zabbix
|
|
ip: 10.203.0.50
|
|
- name: netbox
|
|
ip: 10.203.0.91
|
|
- name: br001
|
|
ip: 10.202.0.19
|
|
- name: skat-bras-1
|
|
ip: 10.203.0.252
|
|
- name: ldap
|
|
ip: 10.203.0.81
|
|
- name: dc1.smb
|
|
ip: 10.203.0.83
|
|
- name: br001.smb
|
|
ip: 10.202.0.19
|
|
- name: pale
|
|
ip: 10.203.0.83
|
|
- name: '*.d'
|
|
ip:
|
|
- 10.203.0.211
|
|
- 10.203.0.212
|
|
# mail_servers:
|
|
# - name: mail001
|
|
# preference: 10
|
|
# - name: mail002
|
|
# preference: 20
|
|
# services:
|
|
# - name: _ldap._tcp
|
|
# weight: 100
|
|
# port: 88
|
|
# target: srv010
|
|
# text:
|
|
# - name: _kerberos
|
|
# text: KERBEROS.ACME-INC.COM
|
|
# - name: '@'
|
|
# text:
|
|
# - 'some text'
|
|
# - 'more text'
|
|
|
|
- name: 'gigacoms.ru'
|
|
type: primary
|
|
certbot_key: "CerbotKey"
|
|
primaries:
|
|
- 10.203.2.11
|
|
also_notify:
|
|
- 10.203.2.12
|
|
# networks:
|
|
# - '91.218.84'
|
|
# - '91.218.85'
|
|
# - '91.218.86'
|
|
# - '91.218.87'
|
|
# - '91.236.140'
|
|
# - '91.236.141'
|
|
# - '91.236.142'
|
|
# - '91.236.143'
|
|
# - '213.109.201'
|
|
# - '10.11'
|
|
# ipv6_networks:
|
|
# - '2001:db8::/48'
|
|
name_servers:
|
|
- ns1
|
|
- ns2
|
|
hosts:
|
|
- name: ns1
|
|
ip: 91.218.87.254
|
|
- name: ns2
|
|
ip: 91.218.87.251
|
|
- name: mail
|
|
alias: domain.mail.yandex.net.
|
|
- name: calendar
|
|
alias: ghs.google.com.
|
|
- name: corp
|
|
alias: ghs.google.com.
|
|
- name: docs
|
|
alias: ghs.google.com.
|
|
- name: podpiska
|
|
alias: showcase.rentsoft.ru.
|
|
- name: shop
|
|
alias: lb.bitrix24.shop.
|
|
- name: gigacoms.ru.
|
|
ip: 91.218.87.248
|
|
alias: www
|
|
- name: acs
|
|
ip: 10.1.1.70
|
|
- name: 2ip1
|
|
ip: 91.218.87.250
|
|
alias: 2ip2
|
|
- name: bill
|
|
ip: 91.218.87.225
|
|
- name: b2b
|
|
ip: 91.218.87.225
|
|
- name: crm
|
|
ip: 91.218.87.225
|
|
- name: hd
|
|
ip: 91.218.87.225
|
|
- name: hd-dev
|
|
ip: 91.218.87.225
|
|
- name: dev
|
|
ip: 91.218.87.225
|
|
- name: lora
|
|
ip: 91.218.87.225
|
|
- name: pg
|
|
ip: 91.218.87.225
|
|
- name: pulse
|
|
ip: 91.218.87.225
|
|
- name: report
|
|
ip: 91.218.87.225
|
|
- name: rkn
|
|
ip: 91.218.87.225
|
|
- name: us
|
|
ip: 91.218.87.225
|
|
- name: 24api
|
|
ip: 91.218.87.225
|
|
- name: vmmgr
|
|
ip: 91.218.87.225
|
|
- name: blmgr
|
|
ip: 91.218.87.225
|
|
- name: dcimgr
|
|
ip: 91.218.87.225
|
|
- name: logs
|
|
ip: 91.218.87.225
|
|
- name: grafana
|
|
ip: 91.218.87.225
|
|
- name: graylog
|
|
ip: 91.218.87.225
|
|
- name: okemerg
|
|
ip: 91.218.87.225
|
|
- name: portal
|
|
ip: 91.218.87.225
|
|
- name: fpst
|
|
ip: 91.218.87.202
|
|
- name: gate
|
|
ip: 91.218.87.205
|
|
- name: iot
|
|
ip: 91.218.87.198
|
|
- name: mon
|
|
ip: 91.218.87.196
|
|
- name: b24
|
|
ip: 91.218.87.249
|
|
- name: dev-b24
|
|
ip: 91.218.87.248
|
|
- name: service
|
|
ip: 91.218.87.250
|
|
- name: st1
|
|
ip: 91.218.87.250
|
|
- name: st2
|
|
ip: 91.218.87.250
|
|
- name: tvmw
|
|
ip: 91.218.87.203
|
|
- name: git
|
|
ip: 91.236.140.132
|
|
- name: node3
|
|
ip: 10.201.0.103
|
|
- name: vpn.office
|
|
ip: 91.218.87.205
|
|
- name: skat-bras-1
|
|
ip: 10.203.0.252
|
|
- name: skat-bras-2
|
|
ip: 10.203.0.251
|
|
- name: portainer
|
|
ip: 91.218.87.220
|
|
- name: gitlab
|
|
ip: 91.218.87.220
|
|
- name: semaphore
|
|
ip: 91.218.87.220
|
|
- name: nxmc
|
|
ip: 91.218.87.220
|
|
- name: zabbix
|
|
ip: 91.218.87.220
|
|
- name: genie
|
|
ip: 91.218.87.220
|
|
- name: ezdepot
|
|
ip: 91.218.87.220
|
|
- name: has
|
|
ip: 91.218.87.220
|
|
- name: probe
|
|
ip: 91.218.87.220
|
|
- name: miniui
|
|
ip: 91.218.87.220
|
|
- name: miniapi
|
|
ip: 91.218.87.220
|
|
|
|
mail_servers:
|
|
- name: mx.yandex.net.
|
|
preference: 10
|
|
# services:
|
|
# - name: _ldap._tcp
|
|
# weight: 100
|
|
# port: 88
|
|
# target: srv010
|
|
text:
|
|
- name: mail._domainkey
|
|
text: "v=DKIM1; k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCngEizyzxPM785+q4dcj6MPKDsoTkP5DMzxptWso06+w+ROAxGX45ZijvGnQaA1WCKuATxr4kB0RvN6FGw8HpaNVPX7Odp8G8qkcNWCN4q4aHngQtoj5GMcwlR+Dvuv/AJ67VdL+9H/FxyJHR8ucje6MJzSYizxVpTNMyDF+lQZwIDAQAB"
|
|
- name: us._domainkey
|
|
text: "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDRjOsvZZKZ/j3UhgVD+YwNftnSSXdWbqAf1QGz/IfvcvySKnrWzaaH2nSBYUXr2eiCzSuaJOwC8xnHcrfdSTBN3f4r+WqUcfTMdn5gROSn6TIg5bJMv+QFmo2b2kjOAgq7t+3yplKBneUnY8UXn33gt5EJ+ROVTYrL710nq4MbPwIDAQAB"
|
|
- name: '@'
|
|
text:
|
|
- "yandex-verification: 11bf6000ca841ac9"
|
|
- "v=spf1 include:_spf.yandex.net include:spf.unisender.com ~all"
|
|
|
|
- name: 'serverok.ru'
|
|
type: primary
|
|
certbot_key: "CerbotKey"
|
|
primaries:
|
|
- 10.203.2.11
|
|
also_notify:
|
|
- 10.203.2.12
|
|
name_servers:
|
|
- ns1.gigacoms.ru.
|
|
- ns2.gigacoms.ru.
|
|
hosts:
|
|
- name: ns1
|
|
ip: 91.218.87.254
|
|
- name: ns2
|
|
ip: 91.218.87.251
|
|
|
|
- name: 'vermax.com'
|
|
type: primary
|
|
certbot_key: "CerbotKey"
|
|
primaries:
|
|
- 10.203.2.11
|
|
name_servers:
|
|
- ns1.gigacoms.ru.
|
|
- ns2.gigacoms.ru.
|
|
hosts:
|
|
- name: ns1
|
|
ip: 91.218.87.254
|
|
- name: ns2
|
|
ip: 91.218.87.251
|
|
- name: update
|
|
ip: 10.203.0.77
|
|
|
|
- name: '84.218.91.in-addr.arpa'
|
|
type: primary
|
|
primaries:
|
|
- 10.203.2.11
|
|
also_notify:
|
|
- 10.203.2.12
|
|
name_servers:
|
|
- ns1.gigacoms.ru.
|
|
- ns2.gigacoms.ru.
|
|
reverse_zone: true
|
|
ptr_records:
|
|
- name: '56'
|
|
ptr: 'mail.kotpilota.ru'
|
|
- name: '161'
|
|
ptr: 'smtp.gruzavto.net'
|
|
- name: '242'
|
|
ptr: 'exchange.freshsecret.ru'
|
|
|
|
- name: '85.218.91.in-addr.arpa'
|
|
type: primary
|
|
primaries:
|
|
- 10.203.2.11
|
|
also_notify:
|
|
- 10.203.2.12
|
|
name_servers:
|
|
- ns1.gigacoms.ru.
|
|
- ns2.gigacoms.ru.
|
|
reverse_zone: true
|
|
ptr_records:
|
|
- name: '55'
|
|
ptr: 'mx.wps.ru'
|
|
- name: '138'
|
|
ptr: 'mail.amazone.pro'
|
|
- name: '229'
|
|
ptr: 'billing.dnpveteran.ru'
|
|
|
|
- name: '86.218.91.in-addr.arpa'
|
|
type: primary
|
|
primaries:
|
|
- 10.203.2.11
|
|
also_notify:
|
|
- 10.203.2.12
|
|
name_servers:
|
|
- ns1.gigacoms.ru.
|
|
- ns2.gigacoms.ru.
|
|
reverse_zone: true
|
|
ptr_records:
|
|
- name: '149'
|
|
ptr: 'mail.d4t.ru'
|
|
- name: '184'
|
|
ptr: 'mx.huaxun.ru'
|
|
|
|
- name: '87.218.91.in-addr.arpa'
|
|
type: primary
|
|
primaries:
|
|
- 10.203.2.11
|
|
also_notify:
|
|
- 10.203.2.12
|
|
name_servers:
|
|
- ns1.gigacoms.ru.
|
|
- ns2.gigacoms.ru.
|
|
reverse_zone: true
|
|
ptr_records:
|
|
- name: '205'
|
|
ptr: 'gate.gigacoms.ru'
|
|
- name: '247'
|
|
ptr: 'ns1.gigacoms.info'
|
|
- name: '251'
|
|
ptr: 'ns2.gigacoms.ru'
|
|
- name: '251'
|
|
ptr: 'ns4.gigacoms.info'
|
|
- name: '254'
|
|
ptr: 'ns1.gigacoms.ru'
|
|
- name: '254'
|
|
ptr: 'ns3.gigacoms.info'
|
|
|
|
- name: '140.236.91.in-addr.arpa'
|
|
type: primary
|
|
primaries:
|
|
- 10.203.2.11
|
|
also_notify:
|
|
- 10.203.2.12
|
|
name_servers:
|
|
- ns1.gigacoms.ru.
|
|
- ns2.gigacoms.ru.
|
|
reverse_zone: true
|
|
ptr_records:
|
|
- name: '96/28.140.236.91.in-addr.arpa.'
|
|
dns: 'ns1.cittransm.ru.'
|
|
- name: '96/28.140.236.91.in-addr.arpa.'
|
|
dns: 'ns2.cittransm.ru.'
|
|
- name: '96/28.140.236.91.in-addr.arpa.'
|
|
dns: 'ns3.cittransm.ru.'
|
|
- name: '96'
|
|
cname: '96.96/28.140.236.91.in-addr.arpa.'
|
|
- name: '97'
|
|
cname: '97.96/28.140.236.91.in-addr.arpa.'
|
|
- name: '98'
|
|
cname: '98.96/28.140.236.91.in-addr.arpa.'
|
|
- name: '99'
|
|
cname: '99.96/28.140.236.91.in-addr.arpa.'
|
|
- name: '100'
|
|
cname: '100.96/28.140.236.91.in-addr.arpa.'
|
|
- name: '101'
|
|
cname: '101.96/28.140.236.91.in-addr.arpa.'
|
|
- name: '102'
|
|
cname: '102.96/28.140.236.91.in-addr.arpa.'
|
|
- name: '103'
|
|
cname: '103.96/28.140.236.91.in-addr.arpa.'
|
|
- name: '104'
|
|
cname: '104.96/28.140.236.91.in-addr.arpa.'
|
|
- name: '105'
|
|
cname: '105.96/28.140.236.91.in-addr.arpa.'
|
|
- name: '106'
|
|
cname: '106.96/28.140.236.91.in-addr.arpa.'
|
|
- name: '107'
|
|
cname: '107.96/28.140.236.91.in-addr.arpa.'
|
|
- name: '108'
|
|
cname: '108.96/28.140.236.91.in-addr.arpa.'
|
|
- name: '109'
|
|
cname: '109.96/28.140.236.91.in-addr.arpa.'
|
|
- name: '110'
|
|
cname: '110.96/28.140.236.91.in-addr.arpa.'
|
|
- name: '111'
|
|
cname: '111.96/28.140.236.91.in-addr.arpa.'
|
|
- name: '45'
|
|
ptr: 'mail.rst26.ru'
|
|
- name: '88'
|
|
ptr: 'ohana.msk.ru'
|
|
- name: '162'
|
|
ptr: 'gromakov.org'
|
|
- name: '168'
|
|
ptr: 'mail.roomika-mebel.ru'
|
|
|
|
- name: '141.236.91.in-addr.arpa'
|
|
type: primary
|
|
primaries:
|
|
- 10.203.2.11
|
|
also_notify:
|
|
- 10.203.2.12
|
|
name_servers:
|
|
- ns1.gigacoms.ru.
|
|
- ns2.gigacoms.ru.
|
|
reverse_zone: true
|
|
ptr_records:
|
|
- name: '89'
|
|
ptr: 'mail.geocaching.su'
|
|
|
|
- name: '201.109.213.in-addr.arpa'
|
|
type: primary
|
|
primaries:
|
|
- 10.203.2.11
|
|
also_notify:
|
|
- 10.203.2.12
|
|
name_servers:
|
|
- ns1.gigacoms.ru.
|
|
- ns2.gigacoms.ru.
|
|
reverse_zone: true
|
|
ptr_records:
|
|
- name: '166'
|
|
ptr: 'mx.gromakov.org'
|
|
- name: '203'
|
|
ptr: 'mail.testvia.ru'
|
|
|
|
- name: '0.203.10.in-addr.arpa'
|
|
type: primary
|
|
primaries:
|
|
- 10.203.2.11
|
|
also_notify:
|
|
- 10.203.2.12
|
|
name_servers:
|
|
- ns1.gigacoms.ru.
|
|
- ns2.gigacoms.ru.
|
|
reverse_zone: true
|
|
ptr_records:
|
|
- name: '9'
|
|
ptr: 'vc1.beta.gigacoms.info'
|
|
- name: '13'
|
|
ptr: 'vctest.beta.gigacoms.info'
|