Ansible-Roles/roles/named/templates/etc_named.conf.j2

//
// named.conf
//
{{ ansible_managed | comment('c') }}
//
{% for acl in named_acls %}
acl "{{ acl.name }}" {
{% for match in acl.match_list %}
  {{ match }};
{% endfor %}
};

{% endfor %}
options {
{% for port in named_listen_ipv4_port %}
  listen-on port {{ port }} { {{ named_listen_ipv4|join('; ') }}; };
{% endfor %}
{% for port in named_listen_ipv6_port %}
  listen-on-v6 port {{ port }} { {{ named_listen_ipv6|join('; ') }}; };
{% endfor %}
  directory   "{{ named_dir }}";
  dump-file   "{{ named_dir }}/data/cache_dump.db";
  statistics-file "{{ named_dir }}/data/named_stats.txt";
  memstatistics-file "{{ named_dir }}/data/named_mem_stats.txt";
  allow-query     { {{ named_allow_query|join('; ') }}; };
{% if named_acls|length != 0 %}
  allow-transfer { {{ named_allow_transfer|join('; ') }}; };
{% endif %}
{% if named_check_names is defined %}
  check-names  {{ named_check_names }};
{% endif %}

  recursion {% if named_recursion %}yes{% else %}no{% endif %};
  {% if named_recursion %}allow-recursion { {{ named_allow_recursion|join('; ') }}; };
  {% endif %}
{% if named_forwarders|length > 0 %}forwarders { {{ named_forwarders|join('; ') }}; };{% endif %}
  {% if named_forward_only %}forward only;{% endif %}

  rrset-order { order {{ named_rrset_order }}; };

{% if named_dnssec_enable %}  dnssec-enable {{ named_dnssec_enable }};{% endif %}

  dnssec-validation {{ named_dnssec_validation }};

  /* Path to ISC DLV key */
  bindkeys-file "{{ named_bindkeys_file }}";

  managed-keys-directory "{{ named_dir }}/dynamic";

  pid-file "{{ named_pid_file }}";
  session-keyfile "{{ named_session_keyfile }}";
{% if named_query_log is defined %}

  querylog yes;
{% endif %}
{% if named_dns64 %}
  dns64 64:ff9b::/96 {
    clients { {{ named_dns64_clients|join('; ') }};  };
  };
{% endif %}
};

{% if named_statistics_channels %}
statistics-channels {
  inet {{ named_statistics_host }} port {{ named_statistics_port }} allow { {{ named_statistics_allow|join('; ') }}; };
};
{% endif %}

logging {
  channel default_debug {
    file "{{ named_log }}";
    severity dynamic;
    print-time yes;
  };
{% if named_query_log is defined %}
  channel querylog {
{% if named_query_log.file is defined %}
    file "{{ named_query_log.file }}" versions {{ named_query_log.versions }} size {{ named_query_log.size }};
{% else %}
    file "{{ named_query_log }}" versions 600 size 20m;
{% endif %}
    severity dynamic;
    print-time yes;
  };
  category queries { querylog; };
{% endif %}
{% if named_other_logs is defined %}

{% for log in named_other_logs %}
  channel {{ log.name }} {
    file "{{ log.file }}" versions {{ log.versions }} size {{ log.size }};
    severity dynamic;
    print-time yes;
  };
  category "{{ log.name }}" { "{{ log.name }}"; };
{% endfor %}
{% endif %}
};

{% for file in named_default_zone_files %}
include "{{ file }}";
{% endfor %}
{% for file in named_extra_include_files %}
include "{{ file }}";
{% endfor %}
{% if named_zones is defined %}
{% for named_zone in named_zones %}
{# Start: set zone type  #}
{% set _all_addresses = ansible_all_ipv4_addresses | union(ansible_all_ipv6_addresses) %}
{% if named_zone.type is defined and named_zone.type == 'primary' %}
{% set _type = 'primary' %}
{% elif named_zone.type is defined and named_zone.type == 'secondary' %}
{% set _type = 'secondary' %}
{% elif named_zone.type is defined and named_zone.type == 'forward' %}
{% set _type = 'forward' %}
{% elif named_zone.type is not defined and named_zone.primaries is defined and (_all_addresses|intersect(named_zone.primaries)|length > 0) %}
{% set _type = 'primary' %}
{% elif named_zone.type is not defined and named_zone.primaries is defined and not (_all_addresses|intersect(named_zone.primaries)|length > 0) %}
{% set _type = 'secondary' %}
{% elif named_zone.type is not defined and named_zone.forwarders is defined %}
{% set _type = 'forward' %}
{% endif %}
{# End: set zone type #}

{% if named_zone.reverse_zone is defined and named_zone.reverse_zone %}
{# Самостоятельная обратная зона — имя уже содержит .in-addr.arpa, регистрируем напрямую #}
zone "{{ named_zone.name }}" IN {
{% if _type == 'primary' %}
  type master;
  file "{{ named_zone_dir }}/{{ named_zone.name }}";
  notify yes;
{% if named_zone.also_notify is defined %}
  also-notify  { {{ named_zone.also_notify|join('; ') }}; };
{% endif %}
{% if named_zone.allow_update is defined %}
  allow-update { {{ named_zone.allow_update|join('; ') }}; };
{% else %}
  allow-update { none; };
{% endif %}
{% elif _type == 'secondary' %}
  type slave;
  masters { {{ named_zone.primaries|join('; ') }}; };
  file "{{ named_secondary_dir }}/{{ named_zone.name }}";
{% endif %}
};

{% else %}
{# Обычная прямая зона #}
{% if named_zone.create_forward_zones is not defined or named_zone.create_forward_zones %}
zone "{{ named_zone.name }}" IN {
{% if _type == 'primary' %}
  type master;
  file "{{ named_zone_dir }}/{{ named_zone.name }}";
  notify yes;
{% if named_zone.also_notify is defined %}
  also-notify  { {{ named_zone.also_notify|join('; ') }}; };
{% endif %}
{% if named_zone.certbot_key is defined %}
  update-policy { grant {{ named_zone.certbot_key }} zonesub TXT; };
{% endif %}
{% if named_zone.allow_update is defined %}
  allow-update { {{ named_zone.allow_update|join('; ') }}; };
{% else %}
 {% if named_zone.certbot_key is not defined %}
  allow-update { none; };
 {% endif %}
{% endif %}
{% elif _type == 'secondary' %}
  type slave;
  masters { {{ named_zone.primaries|join('; ') }}; };
  file "{{ named_secondary_dir }}/{{ named_zone.name }}";
{% elif _type == 'forward' %}
  type forward;
  forward only;
  forwarders { {{ named_zone.forwarders|join('; ') }}; };
{% endif %}
};
{% endif %}
{% endif %}
{% if named_zone.networks is defined %}
{% if named_zone.create_reverse_zones is not defined or named_zone.create_reverse_zones %}
{% for network in named_zone.networks %}

zone "{{ ('.'.join(network.replace(network+'.','').split('.')[::-1])) }}.in-addr.arpa" IN {
{% if _type == 'primary' %}
  type master;
  file "{{ named_zone_dir }}/{{ ('.'.join(network.replace(network+'.','').split('.')[::-1])) }}.in-addr.arpa";
  notify yes;
{% if named_zone.also_notify is defined %}
  also-notify  { {{ named_zone.also_notify|join('; ') }}; };
{% endif %}
{% if named_zone.allow_update is defined %}
  allow-update { {{ named_zone.allow_update|join('; ') }}; };
{% else %}
  allow-update { none; };
{% endif %}
{% elif _type == 'secondary' %}
  type slave;
  masters { {{ named_zone.primaries|join('; ') }}; };
  file "{{ named_secondary_dir }}/{{ ('.'.join(network.replace(network+'.','').split('.')[::-1])) }}.in-addr.arpa";
{% elif _type == 'forward' %}
  type forward;
  forward only;
  forwarders { {{ named_zone.forwarders|join('; ') }}; };
{% endif %}
};
{% endfor %}
{% endif %}
{% endif %}
{% if named_zone.ipv6_networks is defined %}
{% if named_zone.create_reverse_zones is not defined or named_zone.create_reverse_zones %}
{% for network in named_zone.ipv6_networks %}

zone "{{ (network | ipaddr('revdns'))[-(9+(network|regex_replace('^.*/','')|int)//2):] }}" IN {
{% if _type == 'primary' %}
  type master;
  file "{{ named_zone_dir }}/{{ (network | ipaddr('revdns'))[-(9+(network|regex_replace('^.*/','')|int)//2):-1] }}";
  notify yes;
{% if named_zone.also_notify is defined %}
  also-notify  { {{ named_zone.also_notify|join('; ') }}; };
{% endif %}
{% if named_zone.allow_update is defined %}
  allow-update { {{ named_zone.allow_update|join('; ') }}; };
{% else %}
  allow-update { none; };
{% endif %}
{% elif _type == 'secondary' %}
  type slave;
  masters { {{ named_zone.primaries|join('; ') }}; };
  file "{{ named_secondary_dir }}/{{ (network | ipaddr('revdns'))[-(9+(network|regex_replace('^.*/','')|int)//2):-1] }}";
{% elif _type == 'forward' %}
  type forward;
  forward only;
  forwarders { {{ named_zone.forwarders|join('; ') }}; };
{% endif %}
};
{% endfor %}
{% endif %}
{% endif %}
{% endfor %}
{% endif %}