62 lines
1.6 KiB
YAML
62 lines
1.6 KiB
YAML
---
|
|
- name: "Basic knot slave setup"
|
|
hosts: slave_nameservers
|
|
become: true
|
|
vars:
|
|
master_ip_acl: "86.94.191.237, 2a02:a442:ba11::53"
|
|
version: "off"
|
|
knot_user: knot
|
|
knot_group: knot
|
|
catalog_domain: "catalog.internal."
|
|
identity: "{{ nsid }}.m4n5.nl"
|
|
|
|
handlers:
|
|
- name: "Reload knot service"
|
|
ansible.builtin.service:
|
|
name: "knot.service"
|
|
state: reloaded
|
|
|
|
tasks:
|
|
- name: "Add CZ.NIC Labs Packaging GPG key"
|
|
ansible.builtin.get_url:
|
|
url: "https://pkg.labs.nic.cz/gpg"
|
|
dest: "/usr/share/keyrings/cznic-labs-pkg.gpg"
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
|
|
- name: "Setup knot-dns repository"
|
|
ansible.builtin.apt_repository:
|
|
repo: "deb [signed-by=/usr/share/keyrings/cznic-labs-pkg.gpg] https://pkg.labs.nic.cz/knot-dns {{ ansible_distribution_release }} main"
|
|
filename: "cznic-labs-knot-dns.list"
|
|
|
|
- name: "Install knot"
|
|
ansible.builtin.apt:
|
|
state: present
|
|
update_cache: true
|
|
name:
|
|
- "knot"
|
|
|
|
- name: "Create knot.conf"
|
|
ansible.builtin.template:
|
|
src: templates/knot.conf.j2
|
|
dest: /etc/knot/knot.conf
|
|
owner: root
|
|
group: knot
|
|
mode: "0644"
|
|
notify: "Reload knot service"
|
|
|
|
- name: "Add DNS allow rule in ufw"
|
|
community.general.ufw:
|
|
rule: allow
|
|
to_port: "53"
|
|
protocol: udp
|
|
when: ufw_status == "enabled"
|
|
|
|
- name: "Add AXFR/IXFR allow rule in ufw"
|
|
community.general.ufw:
|
|
rule: allow
|
|
to_port: "53"
|
|
protocol: tcp
|
|
when: ufw_status == "enabled"
|