125 lines
3.3 KiB
YAML
125 lines
3.3 KiB
YAML
---
|
|
# Initialise distribution-specific variables
|
|
- name: Source specific variables
|
|
ansible.builtin.include_vars: "{{ item }}"
|
|
with_first_found:
|
|
- "{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml"
|
|
- "{{ ansible_distribution }}.yml"
|
|
- "{{ ansible_os_family }}-{{ ansible_distribution_major_version }}.yml"
|
|
- "{{ ansible_os_family }}.yml"
|
|
- "{{ ansible_distribution_file_variety }}-{{ ansible_distribution_major_version }}.yml"
|
|
- "{{ ansible_distribution_file_variety }}.yml"
|
|
tags: bind
|
|
|
|
- name: Check `primaries` or `forwarders` was set for each zone
|
|
ansible.builtin.assert:
|
|
that:
|
|
- item.primaries is defined or item.forwarders is defined
|
|
quiet: true
|
|
loop: "{{ named_zones }}"
|
|
loop_control:
|
|
label: "{{ item.name }}"
|
|
tags: bind
|
|
|
|
# Fix molecule and ci failures
|
|
- name: Update package cache for Debian based distros
|
|
ansible.builtin.apt:
|
|
update_cache: true
|
|
become: true
|
|
changed_when: false
|
|
when: ansible_os_family == 'Debian'
|
|
tags: bind
|
|
|
|
- name: Assert that all XFR keys exist in the key list
|
|
ansible.builtin.assert:
|
|
that: named_dns_keys | selectattr("name","equalto",named_key_mapping[item]) | list | count > 0
|
|
loop: "{{ named_key_mapping.keys() | list }}"
|
|
when: named_key_mapping | list | count > 0
|
|
|
|
- name: Install BIND
|
|
ansible.builtin.package:
|
|
pkg: "{{ item }}"
|
|
state: present
|
|
become: true
|
|
with_items:
|
|
- "{{ named_packages }}"
|
|
tags: bind
|
|
|
|
- name: Ensure runtime directories referenced in config exist
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: "{{ named_owner }}"
|
|
group: "{{ named_group }}"
|
|
mode: "0770"
|
|
become: true
|
|
with_items:
|
|
- "{{ named_dir }}/dynamic"
|
|
- "{{ named_dir }}/data"
|
|
- "{{ named_zone_dir }}"
|
|
tags: bind
|
|
|
|
- name: Ensure Directory for Cached Secondary Zones exists
|
|
ansible.builtin.file:
|
|
path: "{{ named_secondary_dir }}"
|
|
state: directory
|
|
owner: "{{ named_owner }}"
|
|
group: "{{ named_group }}"
|
|
mode: "0770"
|
|
setype: named_cache_t
|
|
become: true
|
|
tags: bind
|
|
|
|
- name: Create serial, based on UTC UNIX time
|
|
ansible.builtin.command: date -u +%s
|
|
register: named_timestamp
|
|
changed_when: false
|
|
run_once: true
|
|
check_mode: false
|
|
tags: bind
|
|
|
|
# file to set keys for XFR authentication
|
|
- name: Create extra config for authenticated XFR request
|
|
ansible.builtin.template:
|
|
src: auth_transfer.j2
|
|
dest: "{{ named_conf_dir }}/{{ named_auth_filename }}"
|
|
mode: "0640"
|
|
owner: root
|
|
group: "{{ named_group }}"
|
|
become: true
|
|
when: named_dns_keys is defined and named_dns_keys|length > 0
|
|
notify: Reload bind
|
|
tags: bind
|
|
|
|
- name: Configure zones
|
|
ansible.builtin.include_tasks: zones.yml
|
|
tags: bind
|
|
|
|
- name: Main BIND config file
|
|
ansible.builtin.template:
|
|
src: etc_named.conf.j2
|
|
dest: "{{ named_config }}"
|
|
owner: "{{ named_owner }}"
|
|
group: "{{ named_group }}"
|
|
mode: "0640"
|
|
setype: named_conf_t
|
|
validate: named-checkconf %s
|
|
become: true
|
|
notify: Reload bind
|
|
tags: bind
|
|
|
|
- name: Start BIND service
|
|
ansible.builtin.service:
|
|
name: "{{ named_service }}"
|
|
state: started
|
|
enabled: true
|
|
become: true
|
|
tags: bind
|
|
|
|
- name: Permit DNS traffic in firewalld
|
|
ansible.posix.firewalld:
|
|
service: dns
|
|
permanent: true
|
|
state: enabled
|
|
immediate: true
|