ISTI-ansible-roles
/
ansible-role-unbound
4
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Import the old unbound role.

This commit is contained in:
Andrea Dell'Amico 2020-06-17 18:49:07 +02:00
parent ac4ab552c1
commit 2772160716
7 changed files with 219 additions and 68 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
README.md
View File

@ -1,31 +1,59 @@
Role Name
=========
A brief description of the role goes here.
Requirements
------------
Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
A role that installs and configures the unbound resolver
Role Variables
--------------
A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
The most important variables are listed below:
``` yaml
unbound_pkgs:
- unbound
- unbound-anchor
- unbound-host
- dnsutils
unbound_interfaces:
- '0.0.0.0'
- '::0'
unbound_allowed_clients:
- { cidr: '0.0.0.0/0', policy: 'allow' }
unbound_prefetch: 'yes'
unbound_verbosity: 1
unbound_threads: '{{ ansible_processor_count }}'
unbound_remote_control: 'yes'
unbound_remote_IP: '127.0.0.1'
unbound_rrset_cache_size: 100m
unbound_rrset_msg_cache_size: 50m
# Larger socket buffer. OS may need config.
unbound_so_rcvbuf: 4m
unbound_so_sndbuf: 4m
# Faster UDP with multithreading (only on Linux).
unbound_so_reuseport: 'yes'
# with libevent
unbound_num_queries_per_thread: 4096
unbound_max_negative_ttl: 3600
unbound_hide_identity: 'yes'
unbound_hide_version: 'yes'
unbound_qname_minimisation: 'no'
unbound_val_clean_additional: 'yes'
# The following is experimental
unbound_use_caps_for_id: 'no'
unbound_unwanted_reply_threshold: '10000000'
unbound_do_not_query_localhost: 'no'
unbound_rrset_roundrobin: 'yes'
unbound_unblock_lan_zones: 'no'
unbound_do_ipv6: 'yes'
```
Dependencies
------------
A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
Example Playbook
----------------
Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
- hosts: servers
roles:
- { role: username.rolename, x: 42 }
None
License
-------
@ -35,4 +63,4 @@ EUPL-1.2
Author Information
------------------
An optional section for the role authors to include contact information, or a website (HTML is not allowed).
Andrea Dell'Amico, <andrea.dellamico@isti.cnr.it>

52
defaults/main.yml
View File

@ -1,2 +1,52 @@
---
# defaults file for ansible-role-template
unbound_pkgs:
- unbound
- unbound-anchor
- unbound-host
- dnsutils
unbound_interfaces:
- '0.0.0.0'
- '::0'
unbound_allowed_clients:
- { cidr: '0.0.0.0/0', policy: 'allow' }
unbound_prefetch: 'yes'
unbound_verbosity: 1
unbound_threads: '{{ ansible_processor_count }}'
unbound_remote_control: 'yes'
unbound_remote_IP: '127.0.0.1'
unbound_rrset_cache_size: 100m
unbound_rrset_msg_cache_size: 50m
# Larger socket buffer. OS may need config.
unbound_so_rcvbuf: 4m
unbound_so_sndbuf: 4m
# Faster UDP with multithreading (only on Linux).
unbound_so_reuseport: 'yes'
# with libevent
unbound_num_queries_per_thread: 4096
unbound_max_negative_ttl: 3600
unbound_hide_identity: 'yes'
unbound_hide_version: 'yes'
unbound_qname_minimisation: 'no'
unbound_val_clean_additional: 'yes'
# The following is experimental
unbound_use_caps_for_id: 'no'
unbound_unwanted_reply_threshold: '10000000'
unbound_do_not_query_localhost: 'no'
unbound_rrset_roundrobin: 'yes'
unbound_unblock_lan_zones: 'no'
unbound_do_ipv6: 'yes'
unbound_private_addresses: []
unbound_private_domains: []
# Stub zones
# One of stub_host or stub_addr must be defined
# stub_prime and stub_first are both optional, default 'yes'
#unbound_stub_zones:
# - { name: '', stub_addr: '', stub_host: '', stub_prime: '', stub_first: '' }

4
handlers/main.yml
View File

@ -1,2 +1,4 @@
---
# handlers file for ansible-role-template
- name: Restart unbound
service: name=unbound state=restarted

56
meta/main.yml
View File

@ -1,61 +1,23 @@
galaxy_info:
author: your name
description: your description
author: Andrea Dell'Amico
description: Systems Architect
company: ISTI-CNR
# If the issue tracker for your role is not on github, uncomment the
# next line and provide a value
issue_tracker_url: https://redmine-s2i2s.isti.cnr.it/projects/provisioning
# Some suggested licenses:
# - BSD (default)
# - MIT
# - GPLv2
# - GPLv3
# - Apache
# - CC-BY
license: EUPL-1.2
license: EUPL 1.2+
min_ansible_version: 2.8
# If this a Container Enabled role, provide the minimum Ansible Container version.
# min_ansible_container_version:
# Optionally specify the branch Galaxy will use when accessing the GitHub
# repo for this role. During role install, if no tags are available,
# Galaxy will use this branch. During import Galaxy will access files on
# this branch. If Travis integration is configured, only notifications for this
# branch will be accepted. Otherwise, in all cases, the repo's default branch
# (usually master) will be used.
#github_branch:
#
# Provide a list of supported platforms, and for each platform a list of versions.
# If you don't wish to enumerate all versions for a particular platform, use 'all'.
# To view available platforms and versions (or releases), visit:
# https://galaxy.ansible.com/api/v1/platforms/
#
# platforms:
# - name: Fedora
# versions:
# - all
# - 25
# - name: SomePlatform
# versions:
# - all
# - 1.0
# - 7
# - 99.99
platforms:
- name: Ubuntu
versions:
- bionic
galaxy_tags: []
# List tags for your role here, one per line. A tag is a keyword that describes
# and categorizes the role. Users find roles by searching for tags. Be sure to
# remove the '[]' above, if you add tags to this list.
#
# NOTE: A tag is limited to a single word comprised of alphanumeric characters.
# Maximum 20 tags per role.
galaxy_tags:
- users
dependencies: []
# List your role dependencies here, one per line. Be sure to remove the '[]' above,
# if you add dependencies to this list.

24
tasks/main.yml
View File

@ -1,2 +1,24 @@
---
# tasks file for ansible-role-template
- block:
- name: Install the unbound resolver packages
apt: pkg={{ unbound_pkgs }} state=present cache_valid_time=1800 update_cache=yes
- name: Install the unbound config files
template: src={{ item }} dest=/etc/unbound/unbound.conf.d/{{ item }}
with_items:
- unbound-server.conf
- unbound-remote-control.conf
notify: Restart unbound
tags: [ 'unbound', 'unbound_conf' ]
- name: On bionic, stop systemd-resolvd because it interferes
service: name=systemd-resolved state=stopped enabled=no
when:
- ansible_distribution == "Ubuntu"
- ansible_service_mgr == 'systemd'
- ansible_distribution_major_version >= '18'
- name: Ensure that the unbound service is started and enabled
service: name=unbound state=restarted enabled=yes
tags: [ 'unbound' ]

6
templates/unbound-remote-control.conf Normal file
View File

@ -0,0 +1,6 @@
remote-control:
control-enable: {{ unbound_remote_control }}
{% if unbound_remote_IP is defined %}
control-interface: '{{ unbound_remote_IP }}'
{% endif %}

81
templates/unbound-server.conf Normal file
View File

@ -0,0 +1,81 @@
server:
{% for interface in unbound_interfaces %}
interface: {{ interface }}
{% endfor %}
{% if keepalived_install is defined and keepalived_install %}
ip-transparent: yes
{% endif %}
interface-automatic: yes
{% for net in unbound_allowed_clients %}
access-control: {{ net.cidr }} {{ net.policy }}
{% endfor %}
verbosity: {{ unbound_verbosity }}
# use all CPUs
num-threads: {{ unbound_threads }}
prefetch: {{ unbound_prefetch }}
# power of 2 close to num-threads
msg-cache-slabs: {{ unbound_threads }}
rrset-cache-slabs: {{ unbound_threads }}
infra-cache-slabs: {{ unbound_threads }}
key-cache-slabs: {{ unbound_threads }}
# more cache memory, rrset=msg*2
rrset-cache-size: {{ unbound_rrset_cache_size }}
msg-cache-size: {{ unbound_rrset_msg_cache_size }}
# more outgoing connections
# depends on number of cores: 1024/cores - 50
outgoing-range: {{ 1024 * unbound_threads - 50 }}
# Larger socket buffer. OS may need config.
so-rcvbuf: {{ unbound_so_rcvbuf }}
so-sndbuf: {{ unbound_so_sndbuf }}
# Negative TTL
cache-max-negative-ttl: {{ unbound_max_negative_ttl }}
# Faster UDP with multithreading (only on Linux).
so-reuseport: {{ unbound_so_reuseport }}
# with libevent
num-queries-per-thread: {{ unbound_num_queries_per_thread }}
hide-identity: {{ unbound_hide_identity }}
hide-version: {{ unbound_hide_version }}
qname-minimisation: {{ unbound_qname_minimisation }}
# The following is experimental
use-caps-for-id: {{ unbound_use_caps_for_id }}
unwanted-reply-threshold: {{ unbound_unwanted_reply_threshold }}
do-not-query-localhost: {{ unbound_do_not_query_localhost }}
rrset-roundrobin: {{ unbound_rrset_roundrobin }}
val-clean-additional: {{ unbound_val_clean_additional }}
unblock-lan-zones: {{ unbound_unblock_lan_zones }}
do-ip6: {{ unbound_do_ipv6 }}
#
{% if ansible_service_mgr == 'systemd' %}
use-systemd: yes
do-daemonize: no
{% endif %}
{% for cidr in unbound_private_addresses %}
private-address: {{ cidr }}
{% endfor %}
{% for dom in unbound_private_domains %}
private-domain: {{ dom }}
{% endfor %}
{% if unbound_stub_zones is defined %}
{% for zone in unbound_stub_zones %}
stub-zone:
name: {{ zone.name }}
{% if zone.stub_host is defined %}
stub-host: {{ zone.stub_host }}
{% endif %}
{% if zone.stub_addr is defined %}
stub-addr: {{ zone.stub_addr }}
{% endif %}
stub-prime: {{ zone.stub_prime | default('no') }}
stub-first: {{ zone.stub_first | default('yes') }}
{% endfor %}
{% endif %}