parent
5878ef2e31
commit
eb5feb1fb8
@ -1,2 +1,4 @@ |
||||
hosts |
||||
keys/ |
||||
.vscode/ |
||||
group_vars/infra.yml |
||||
@ -0,0 +1,19 @@ |
||||
#!/sbin/openrc-run |
||||
|
||||
depend() { |
||||
use logger dns |
||||
need net |
||||
after firewall |
||||
} |
||||
|
||||
start() { |
||||
ebegin "Starting dropbear" |
||||
/usr/sbin/dropbear ${DROPBEAR_OPTS} |
||||
eend $? |
||||
} |
||||
|
||||
stop() { |
||||
ebegin "Stopping dropbear" |
||||
start-stop-daemon --stop --pidfile /var/run/dropbear.pid |
||||
eend $? |
||||
} |
||||
@ -0,0 +1,27 @@ |
||||
- name: add default record |
||||
include_tasks: |
||||
file: add_record.yml |
||||
apply: |
||||
delegate_to: "{{ services.internal_ns }}" |
||||
vars: |
||||
record: {} |
||||
when: (records | d([]) | length) == 0 |
||||
|
||||
|
||||
- name: process other items |
||||
include_tasks: |
||||
file: add_record.yml |
||||
apply: |
||||
delegate_to: "{{ services.internal_ns }}" |
||||
loop: "{{ records | d([]) }}" |
||||
loop_control: |
||||
loop_var: record |
||||
|
||||
|
||||
- name: restart coredns |
||||
service: |
||||
name: coredns |
||||
state: restarted |
||||
delegate_to: "{{ services.internal_ns }}" |
||||
when: (ns_instant | d(false) == false) and |
||||
((ns_records_changed | d(false) == true) or (ns_serial_changed | d(false) == true)) |
||||
@ -1,21 +0,0 @@ |
||||
- name: add default record |
||||
include_tasks: add_record.yml |
||||
vars: |
||||
record: {} |
||||
when: (ns_records | d([]) | length) == 0 |
||||
|
||||
|
||||
- name: process other items |
||||
include_tasks: add_record.yml |
||||
loop: "{{ ns_records | d([]) }}" |
||||
loop_control: |
||||
loop_var: record |
||||
|
||||
|
||||
- name: restart coredns |
||||
service: |
||||
name: coredns |
||||
state: restarted |
||||
when: (ns_instant | d(false) == false) and |
||||
((ns_records_changed | d(false) == true) or |
||||
(ns_serial_changed | d(false) == true)) |
||||
@ -0,0 +1,13 @@ |
||||
- name: set role information |
||||
set_fact: |
||||
role_dependency: |
||||
- {stage: 3, role: 'coredns'} |
||||
- {stage: 5, role: 'coredns', tasks_from: 'tls.yml'} |
||||
|
||||
role_dependency_index: 0 |
||||
|
||||
role_hardware: |
||||
cores: 4 |
||||
memory: 128 |
||||
swap: 64 |
||||
disk: 0.3 |
||||
@ -1,93 +0,0 @@ |
||||
- name: install coredns and dependencies |
||||
include_tasks: tasks/install_packages.yml |
||||
vars: |
||||
package: |
||||
- coredns |
||||
- alpine: coredns-openrc |
||||
|
||||
|
||||
- name: create user and group |
||||
include_tasks: tasks/create_user.yml |
||||
vars: |
||||
user: |
||||
name: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
|
||||
|
||||
- name: create config directory |
||||
file: |
||||
path: "{{ coredns_conf_dir }}" |
||||
state: directory |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
notify: restart coredns |
||||
|
||||
|
||||
- name: template corefile |
||||
template: |
||||
src: corefile.j2 |
||||
dest: "{{ coredns_conf_file }}" |
||||
force: yes |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
mode: 0400 |
||||
notify: restart coredns |
||||
|
||||
|
||||
- name: template empty tls file if missing |
||||
copy: |
||||
content: '' |
||||
dest: "{{ coredns_tls_file }}" |
||||
force: no |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
mode: 0400 |
||||
notify: restart coredns |
||||
|
||||
|
||||
- name: template root zone if missing |
||||
template: |
||||
src: zone.j2 |
||||
dest: "{{ coredns_conf_dir ~ '/' ~ (ns_tld | d(int_tld)) ~ '.zone' }}" |
||||
force: no |
||||
mode: 0400 |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
notify: restart coredns |
||||
|
||||
|
||||
- name: edit service config |
||||
lineinfile: |
||||
path: /etc/conf.d/coredns |
||||
regexp: "^COREDNS_CONFIG=" |
||||
line: "COREDNS_CONFIG={{ coredns_conf_file | quote }}" |
||||
notify: restart coredns |
||||
|
||||
|
||||
- name: template init script |
||||
template: |
||||
src: init.j2 |
||||
dest: /etc/init.d/coredns |
||||
force: yes |
||||
mode: 0755 |
||||
notify: restart coredns |
||||
|
||||
|
||||
- name: flush handlers |
||||
meta: flush_handlers |
||||
|
||||
|
||||
- name: add directories to backup plan |
||||
include_role: |
||||
name: backup |
||||
vars: |
||||
function: add |
||||
backup_items: |
||||
- "{{ coredns_conf_dir }}" |
||||
|
||||
|
||||
- name: enable and start coredns |
||||
service: |
||||
name: coredns |
||||
enabled: yes |
||||
state: started |
||||
@ -1,28 +0,0 @@ |
||||
- name: deploy ecc384 cert |
||||
include_role: |
||||
name: ca |
||||
vars: |
||||
function: certs |
||||
ca_options: |
||||
mode: '0400' |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
concat_inter: true |
||||
preset: web |
||||
ocsp_must_staple: false |
||||
notify: restart coredns |
||||
ca_certs: |
||||
- type: ecc384 |
||||
key: "{{ coredns_key_file }}" |
||||
cert: "{{ coredns_cert_file }}" |
||||
|
||||
|
||||
- name: template tls snippet file |
||||
template: |
||||
src: tls.j2 |
||||
dest: "{{ coredns_tls_file }}" |
||||
force: yes |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
mode: 0400 |
||||
notify: restart coredns |
||||
@ -1,13 +1,102 @@ |
||||
- name: install coredns |
||||
include_tasks: install.yml |
||||
when: function == 'install' |
||||
- name: build default tld list |
||||
set_fact: |
||||
coredns_tld_list: "{{ [ ns_tld | d(int_tld) ] }}" |
||||
when: coredns_tld_list is not defined |
||||
|
||||
|
||||
- name: install coredns tls enhancements |
||||
include_tasks: install_tls.yml |
||||
when: function == 'install_tls' |
||||
- name: install coredns and dependencies |
||||
include_tasks: tasks/install_packages.yml |
||||
vars: |
||||
package: |
||||
- coredns |
||||
- alpine: coredns-openrc |
||||
|
||||
|
||||
- name: add records |
||||
include_tasks: add_records.yml |
||||
when: function == 'add_records' |
||||
- name: create user and group |
||||
include_tasks: tasks/create_user.yml |
||||
vars: |
||||
user: |
||||
name: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
|
||||
|
||||
- name: create config directory |
||||
file: |
||||
path: "{{ coredns_conf_dir }}" |
||||
state: directory |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
notify: restart coredns |
||||
|
||||
|
||||
- name: template corefile |
||||
template: |
||||
src: corefile.j2 |
||||
dest: "{{ coredns_conf_file }}" |
||||
force: yes |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
mode: 0400 |
||||
notify: restart coredns |
||||
|
||||
|
||||
- name: template empty tls file if missing |
||||
copy: |
||||
content: '' |
||||
dest: "{{ coredns_tls_file }}" |
||||
force: no |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
mode: 0400 |
||||
notify: restart coredns |
||||
|
||||
|
||||
- name: template all zones if missing |
||||
template: |
||||
src: zone.j2 |
||||
dest: "{{ (coredns_conf_dir, zone ~ '.zone') | path_join }}" |
||||
force: no |
||||
mode: 0400 |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
notify: restart coredns |
||||
loop: "{{ coredns_tld_list }}" |
||||
loop_control: |
||||
loop_var: zone |
||||
|
||||
|
||||
- name: edit service config |
||||
lineinfile: |
||||
path: /etc/conf.d/coredns |
||||
regexp: "^COREDNS_CONFIG=" |
||||
line: "COREDNS_CONFIG={{ coredns_conf_file | quote }}" |
||||
notify: restart coredns |
||||
|
||||
|
||||
- name: template init script |
||||
template: |
||||
src: init.j2 |
||||
dest: /etc/init.d/coredns |
||||
force: yes |
||||
mode: 0755 |
||||
notify: restart coredns |
||||
|
||||
|
||||
- name: flush handlers |
||||
meta: flush_handlers |
||||
|
||||
|
||||
- name: add directories to backup plan |
||||
include_role: |
||||
name: backup |
||||
tasks_from: add.yml |
||||
vars: |
||||
backup_items: |
||||
- "{{ coredns_conf_dir }}" |
||||
|
||||
|
||||
- name: enable and start coredns |
||||
service: |
||||
name: coredns |
||||
enabled: yes |
||||
state: started |
||||
|
||||
@ -0,0 +1,25 @@ |
||||
- block: |
||||
- name: deploy ecc384 cert |
||||
include_role: |
||||
name: certs |
||||
vars: |
||||
certs: |
||||
cert: "{{ coredns_cert_file }}" |
||||
key: "{{ coredns_key_file }}" |
||||
ecc: yes |
||||
post_hook: service coredns restart |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
|
||||
|
||||
- name: template tls snippet file |
||||
template: |
||||
src: tls.j2 |
||||
dest: "{{ coredns_tls_file }}" |
||||
force: yes |
||||
owner: "{{ coredns_user }}" |
||||
group: "{{ coredns_group }}" |
||||
mode: 0400 |
||||
notify: restart coredns |
||||
|
||||
when: host_tls |
||||
@ -1,9 +1,13 @@ |
||||
tls://{{ ns_tld | d(int_tld) }}:853 { |
||||
{% for zone in coredns_tld_list %} |
||||
tls://{{ zone }}:853 { |
||||
import common |
||||
file {{ (zone ~ '.zone') | quote }} |
||||
tls {{ coredns_cert_file | quote }} {{ coredns_key_file | quote }} |
||||
} |
||||
} |
||||
|
||||
https://{{ ns_tld | d(int_tld) }} { |
||||
https://{{ zone }} { |
||||
import common |
||||
file {{ (zone ~ '.zone') | quote }} |
||||
tls {{ coredns_cert_file | quote }} {{ coredns_key_file | quote }} |
||||
} |
||||
} |
||||
{% endfor %} |
||||
@ -1,32 +1,13 @@ |
||||
{%- set primary_ns = inventory_hostname -%} |
||||
|
||||
{%- if ns_server_group is defined -%} |
||||
{%- set primary_ns = hostvars[groups[ns_server_group][0]]['inventory_hostname'] -%} |
||||
{%- endif -%} |
||||
|
||||
{%- set this_name = (ns_name | d(inventory_hostname)) -%} |
||||
{%- set this_primary_name = (hostvars[primary_ns]['ns_name'] | d(hostvars[primary_ns]['inventory_hostname'])) -%} |
||||
{%- set this_tld = (hostvars[primary_ns]['ns_tld'] | d(ns_tld) | d(int_tld)) -%} |
||||
|
||||
|
||||
|
||||
$ORIGIN {{ this_tld }}. |
||||
$ORIGIN {{ zone }}. |
||||
$TTL {{ ns_ttl | d(300) }} |
||||
|
||||
@ IN SOA {{ this_name ~ '.' ~ this_tld }}. {{ (ns_admin | replace('@', '.')) if ns_admin is defined else ('admin' ~ '.' ~ this_tld) }}. ( |
||||
2021010101 |
||||
@ IN SOA {{ host_name ~ '.' ~ zone }}. {{ (ns_admin | replace('@', '.')) if ns_admin is defined else ('admin' ~ '.' ~ zone) }}. ( |
||||
2023010101 |
||||
{{ ns_refresh | d(1200) }} |
||||
{{ ns_retry | d(300) }} |
||||
{{ ns_expire | d(1209600) }} |
||||
{{ ns_neg_ttl | d(300) }} |
||||
) |
||||
|
||||
{% if ns_server_group is defined -%} |
||||
{% for host in groups[ns_server_group] -%} |
||||
@ IN NS {{ (hostvars[host]['ns_name'] | d(hostvars[host]['inventory_hostname'])) ~ '.' ~ this_tld }}. |
||||
{{ hostvars[host]['ns_name'] | d(hostvars[host]['inventory_hostname']) }} IN A {{ hostvars[host]['ansible_host'] }} |
||||
{% endfor -%} |
||||
{% else -%} |
||||
@ IN NS {{ this_primary_name ~ '.' ~ this_tld }}. |
||||
{{ this_primary_name }} IN A {{ ansible_host }} |
||||
{% endif -%} |
||||
@ IN NS {{ host_name ~ '.' ~ zone }}. |
||||
{{ host_name }} IN A {{ ansible_host }} |
||||
|
||||
@ -0,0 +1,7 @@ |
||||
- name: set role information |
||||
set_fact: |
||||
role_dependency: |
||||
- { stage: 3, role: 'ns' } |
||||
|
||||
role_dependency_index: 1 |
||||
role_dependency_no_common: yes |
||||
@ -0,0 +1,3 @@ |
||||
- name: add internal ns records |
||||
include_role: |
||||
name: ns |
||||
@ -1,16 +1,12 @@ |
||||
- name: ns installation |
||||
include_tasks: install.yml |
||||
when: function == 'install' |
||||
- name: add internal ns records with coredns |
||||
block: |
||||
- set_fact: |
||||
records_tmp: "{{ records | d([]) }}" |
||||
|
||||
- include_role: |
||||
name: coredns |
||||
tasks_from: add.yml |
||||
vars: |
||||
records: "{{ records_tmp }}" |
||||
|
||||
- block: |
||||
- name: add records |
||||
include_tasks: add_records.yml |
||||
when: services.internal_ns is defined |
||||
|
||||
|
||||
- debug: |
||||
msg: internal nameserver is not defined |
||||
when: services.internal_ns is not defined |
||||
|
||||
when: function == 'add_records' |
||||
@ -0,0 +1,9 @@ |
||||
- name: set role information |
||||
set_fact: |
||||
role_dependency: |
||||
- {stage: 1, role: 'common'} |
||||
- {stage: 1, role: 'proxmox'} |
||||
- {stage: 5, role: 'proxmox', tasks_from: 'rproxy'} |
||||
- {stage: 6, role: 'proxmox', tasks_from: 'mail'} |
||||
|
||||
role_dependency_index: 0 |
||||
Loading…
Reference in new issue