66ceb321a6
This adds the concept of an unmanaged domain; for unmanaged domains we will write out the zone file only if it doesn't already exist. acme.opendev.org is added as an unmanaged domain. It will be managed by other ansible roles which add TXT records for ACME authentication. The initial template comes from the dependent change, and this ensures the bind configuration is always valid. For flexibility and testing purposes, we allow passing an extra refspec and version to the git checkout. This is one way to pull in changes for speculative CI runs (I looked into having the hosts under test checkout from Zuul; but by the time we're 3-ansible call's deep on the DNS hosts-under-test it's a real pain. For the amount of times we update this, it's easier to just allow a speculative change that can take a gerrit URL; for an example see [1]) [1] https://review.openstack.org/#/c/641155/10/playbooks/group_vars/dns.yaml Testing is enhanced to check for zone files and correct configuration stanzas. Depends-On: https://review.openstack.org/641154 Depends-On: https://review.openstack.org/641168 Change-Id: I9ef5cfc850c3458c63aff46cfaa0d49a5d194e87
86 lines
2.3 KiB
YAML
86 lines
2.3 KiB
YAML
- name: Install packages
|
|
package:
|
|
name:
|
|
- bind9
|
|
- git
|
|
- rsync
|
|
state: present
|
|
- name: Ensure base zone directory exists
|
|
file:
|
|
path: /var/lib/bind/zones
|
|
state: directory
|
|
- name: Clone zone repos
|
|
git:
|
|
repo: "{{ item.url }}"
|
|
refspec: "{{ item.refspec | default(omit) }}"
|
|
version: "{{ item.version | default(omit) }}"
|
|
dest: "/opt/source/{{ item.name }}"
|
|
loop: "{{ dns_repos }}"
|
|
- name: Set base rsync options
|
|
set_fact:
|
|
_rsync_options:
|
|
- "--chmod=u+rwX,g+rX,o+rX"
|
|
- "--chown=bind:bind"
|
|
- name: Synchronize zone repos to zone directories
|
|
delegate_to: "{{ inventory_hostname }}"
|
|
synchronize:
|
|
src: "/opt/source/{{ item.source }}"
|
|
dest: "/var/lib/bind/zones/{{ item.name }}"
|
|
rsync_opts: '{{ _rsync_options + ["--ignore-existing"] if item.unmanaged|default(False) else _rsync_options }}'
|
|
loop: "{{ dns_zones }}"
|
|
notify: Reload named
|
|
- name: Install tsig key
|
|
no_log: true
|
|
template:
|
|
src: templates/bind.key.j2
|
|
dest: "/etc/bind/tsig.key"
|
|
owner: root
|
|
group: bind
|
|
mode: 0440
|
|
vars:
|
|
key: "{{ tsig_key }}"
|
|
name: tsig
|
|
- name: Ensure base dnssec key directory exists
|
|
file:
|
|
path: /etc/bind/keys
|
|
state: directory
|
|
# The key directories must exist for every zone, regardless of whether
|
|
# there are any keys in them.
|
|
- name: Ensure zone dnssec key directories exist
|
|
loop: "{{ dns_zones }}"
|
|
file:
|
|
path: "/etc/bind/keys/{{ item.name }}"
|
|
state: directory
|
|
owner: root
|
|
group: bind
|
|
mode: 0750
|
|
- name: Install dnssec public keys
|
|
loop: "{{ dnssec_keys | dict2items }}"
|
|
copy:
|
|
dest: "/etc/bind/keys/{{ item.value.zone }}/K{{ item.value.zone }}.+008+{{ item.key }}.key"
|
|
content: "{{ item.value.public }}"
|
|
owner: root
|
|
group: bind
|
|
mode: 0440
|
|
- name: Install dnssec private keys
|
|
no_log: true
|
|
loop: "{{ dnssec_keys | dict2items }}"
|
|
copy:
|
|
dest: "/etc/bind/keys/{{ item.value.zone }}/K{{ item.value.zone }}.+008+{{ item.key }}.private"
|
|
content: "{{ item.value.private }}"
|
|
owner: root
|
|
group: bind
|
|
mode: 0440
|
|
- name: Install bind config
|
|
template:
|
|
src: templates/named.conf.j2
|
|
dest: /etc/bind/named.conf
|
|
owner: root
|
|
group: bind
|
|
mode: 0444
|
|
notify: Reload named
|
|
- name: Enable named
|
|
service:
|
|
name: bind9
|
|
enabled: true
|