Feat: Add role `named` to setup `BIND 9`

diff --git a/playbooks/debian/roles/named/README.txt b/playbooks/debian/roles/named/README.txt
new file mode 100644 (file)
index 0000000..8d35045
--- /dev/null
+++ b/playbooks/debian/roles/named/README.txt
@@ -0,0 +1 @@
+Setup named (BIND 9).

diff --git a/playbooks/debian/roles/named/files/named.conf.options b/playbooks/debian/roles/named/files/named.conf.options
new file mode 100644 (file)
index 0000000..6940926
--- /dev/null
+++ b/playbooks/debian/roles/named/files/named.conf.options
@@ -0,0 +1,31 @@
+options {
+       directory "/var/cache/bind";
+
+       // If there is a firewall between you and nameservers you want
+       // to talk to, you may need to fix the firewall to allow multiple
+       // ports to talk.  See http://www.kb.cert.org/vuls/id/800113
+
+       // If your ISP provided one or more IP addresses for stable 
+       // nameservers, you probably want to use them as forwarders.  
+       // Uncomment the following block, and insert the addresses replacing 
+       // the all-0's placeholder.
+
+       // forwarders {
+       //      0.0.0.0;
+       // };
+
+       //========================================================================
+       // If BIND logs error messages about the root key being expired,
+       // you will need to update your keys.  See https://www.isc.org/bind-keys
+       //========================================================================
+       // dnssec-validation auto;
+       dnssec-enable no;
+       dnssec-validation no;
+
+       auth-nxdomain no;    # conform to RFC1035
+       // listen-on-v6 { any; };
+
+       // allow-transfer { trusted; };
+       allow-query { localhost; 192.168.0.0/16; 10.0.0.0/8; };
+       allow-recursion { localhost; 192.168.0.0/16; 10.0.0.0/8; };
+};

diff --git a/playbooks/debian/roles/named/meta/main.yml b/playbooks/debian/roles/named/meta/main.yml
new file mode 100644 (file)
index 0000000..d2e2f89
--- /dev/null
+++ b/playbooks/debian/roles/named/meta/main.yml
@@ -0,0 +1 @@
+dependencies: ['init-system', 'firewall', 'logcheck']

diff --git a/playbooks/debian/roles/named/tasks/main.yml b/playbooks/debian/roles/named/tasks/main.yml
new file mode 100644 (file)
index 0000000..ded1b35
--- /dev/null
+++ b/playbooks/debian/roles/named/tasks/main.yml
@@ -0,0 +1,37 @@
+- name: Check locales
+  shell: "grep -c '^[ \\t]\\+allow-query' /etc/bind/named.conf.options || :"
+  register: named_conf
+  changed_when: named_conf.stdout == "0"
+
+- debug:
+    msg: "BIND has already been configured"
+  when: named_conf.stdout != "0"
+
+- name: Install BIND
+  become: true
+  apt:
+    autoclean: yes
+    autoremove: yes
+    install_recommends: no
+    name: bind9
+    purge: yes
+    state: latest
+    update_cache: yes
+  when: named_conf.stdout == "0"
+
+- name: Configure BIND
+  become: true
+  copy:
+    src: named.conf.options
+    dest: /etc/bind/named.conf.options
+    owner: bind
+    group: bind
+    mode: '0600'
+  when: named_conf.stdout == "0"
+
+- name: Reload BIND
+  become: true
+  service:
+    name: bind9
+    state: reloaded
+  when: named_conf.stdout == "0"