forked from ISTI-ansible-roles/ansible-roles
Merge pull request 'Remove the keepalived and unbound-resolver roles. They have their own repository now.' (#215) from adellam/ansible-roles:master into master
This commit is contained in:
commit
06b2198ac0
|
|
@ -1,62 +0,0 @@
|
||||||
---
|
|
||||||
# http://www.keepalived.org/
|
|
||||||
#
|
|
||||||
keepalived_install: False
|
|
||||||
keepalived_enabled: '{{ keepalived_install }}'
|
|
||||||
keepalived_version: 1.1.20
|
|
||||||
keepalived_repo: 'ppa:keepalived/stable'
|
|
||||||
keepalived_pkg_state: latest
|
|
||||||
# Use 'keepalived={{ keepalived_version }}' if you want a specific version
|
|
||||||
keepalived_pkgs:
|
|
||||||
- keepalived
|
|
||||||
|
|
||||||
keepalived_use_unicast: False
|
|
||||||
keepalived_unicast_src_ip: '{{ ansible_default_ipv4.address }}'
|
|
||||||
keepalived_unicast_peer_ip:
|
|
||||||
- 127.0.0.1
|
|
||||||
- 127.0.0.2
|
|
||||||
keepalived_mcast_addr: 224.0.0.0/8
|
|
||||||
keepalived_floating_ip1: 127.0.0.1
|
|
||||||
keepalived_script1_name: keepalived_check_service_status
|
|
||||||
# We set haproxy as the default because most of our keepalived use is haproxy related
|
|
||||||
keepalived_service_to_check: 'haproxy'
|
|
||||||
keepalived_script1_check: '/bin/pidof {{ keepalived_service_to_check }}'
|
|
||||||
keepalived_instance1_name: 'VRRP_1'
|
|
||||||
keepalived_interface1_name: '{{ ansible_default_ipv4.interface }}'
|
|
||||||
keepalived_initial_state: 'MASTER'
|
|
||||||
keepalived_inst_priority: 100
|
|
||||||
keepalived_vrouter_id: 51
|
|
||||||
keepalived_non_local_bind: True
|
|
||||||
|
|
||||||
keepalived_enable_script_security: True
|
|
||||||
keepalived_script_username: keepalived_script
|
|
||||||
keepalived_script_user_home: '/var/lib/keepalived'
|
|
||||||
keepalived_runtime_dir: /run/keepalived
|
|
||||||
|
|
||||||
keepalived_nagios_check: False
|
|
||||||
keepalived_notify_script: /usr/local/bin/keepalived_notify
|
|
||||||
keepalived_check_script: '/usr/local/bin/{{ keepalived_script1_name }}'
|
|
||||||
|
|
||||||
# The service must install its own script if it is too complex to be managed by the provided one
|
|
||||||
keepalived_scripts:
|
|
||||||
- name: '{{ keepalived_script1_name }}'
|
|
||||||
script: '{{ keepalived_check_script }}'
|
|
||||||
# In seconds
|
|
||||||
interval: 2
|
|
||||||
# Priority increment
|
|
||||||
weight: 2
|
|
||||||
|
|
||||||
keepalived_instances:
|
|
||||||
- name: '{{ keepalived_instance1_name }}'
|
|
||||||
interface: '{{ keepalived_interface1_name }}'
|
|
||||||
state: '{{ keepalived_initial_state }}'
|
|
||||||
vrouter_id: '{{ keepalived_vrouter_id }}'
|
|
||||||
notify: '{{ keepalived_notify_script }}'
|
|
||||||
priority: '{{ keepalived_inst_priority }}'
|
|
||||||
nopreempt: True
|
|
||||||
v_addr:
|
|
||||||
- '{{ keepalived_floating_ip1 }}'
|
|
||||||
track_script:
|
|
||||||
- '{{ keepalived_script1_name }}'
|
|
||||||
track_interface:
|
|
||||||
- '{{ keepalived_interface1_name }}'
|
|
||||||
|
|
@ -1,57 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
#
|
|
||||||
# echo $1 $2 is in $3 state > /var/run/keepalive.state
|
|
||||||
#
|
|
||||||
|
|
||||||
###############################################################
|
|
||||||
# Check Keepalived State #
|
|
||||||
# #
|
|
||||||
# Author: Zhivko Todorov <ztodorov@neterra.net> #
|
|
||||||
# Date: 01-Dec-2015 #
|
|
||||||
# Version: 0.0.1 #
|
|
||||||
# License: GPL #
|
|
||||||
###############################################################
|
|
||||||
|
|
||||||
|
|
||||||
# set to 'true' if the host is supposed to be in MASTER state
|
|
||||||
# or set to 'false' if the host is supposed to be in BACKUP state
|
|
||||||
# nrpe cannot receive external variables UNLESS is forced in config
|
|
||||||
MASTER='true'
|
|
||||||
|
|
||||||
# checking if there are alive keepalived processes so we can trust the content of the notify 'state' file
|
|
||||||
KEEPALIVENUM=`ps uax|grep '/usr/sbin/keepalived'|grep -v grep|wc -l|tr -d "\n"`
|
|
||||||
|
|
||||||
if [ $KEEPALIVENUM -gt 0 ]; then
|
|
||||||
|
|
||||||
KEEPALIVESTATE=`cat /var/run/keepalive.state`
|
|
||||||
|
|
||||||
if [ "$MASTER" == "true" ]; then
|
|
||||||
|
|
||||||
if [[ $KEEPALIVESTATE == *"MASTER"* ]];then
|
|
||||||
echo $KEEPALIVESTATE
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ $KEEPALIVESTATE == *"BACKUP"* ]];then
|
|
||||||
echo $KEEPALIVESTATE
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
else
|
|
||||||
|
|
||||||
if [[ $KEEPALIVESTATE == *"BACKUP"* ]];then
|
|
||||||
echo $KEEPALIVESTATE
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ $KEEPALIVESTATE == *"MASTER"* ]];then
|
|
||||||
echo $KEEPALIVESTATE
|
|
||||||
exit 2
|
|
||||||
fi
|
|
||||||
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "Keepalived is in UNKNOWN state"
|
|
||||||
exit 3
|
|
||||||
|
|
||||||
|
|
@ -1,4 +0,0 @@
|
||||||
---
|
|
||||||
- name: restart keepalived
|
|
||||||
service: name=keepalived state=restarted
|
|
||||||
when: keepalived_enabled
|
|
||||||
|
|
@ -1,100 +0,0 @@
|
||||||
---
|
|
||||||
- block:
|
|
||||||
- name: Install the keepalived repository
|
|
||||||
apt_repository: repo={{ keepalived_repo }} update_cache=yes
|
|
||||||
when: ansible_distribution_major_version <= '16'
|
|
||||||
|
|
||||||
- name: Install the keepalived package
|
|
||||||
apt: name={{ keepalived_pkgs }} state={{ keepalived_pkg_state }} cache_valid_time=1800
|
|
||||||
|
|
||||||
tags: keepalived
|
|
||||||
when:
|
|
||||||
- keepalived_install | bool
|
|
||||||
- ansible_distribution_file_variety == "Debian"
|
|
||||||
|
|
||||||
- block:
|
|
||||||
- name: Install the user that the keepalived scripts will run under
|
|
||||||
user: name={{ keepalived_script_username }} home={{ keepalived_script_user_home }} createhome=no shell=/usr/sbin/nologin system=yes
|
|
||||||
|
|
||||||
- name: Create the keepalive script user directory
|
|
||||||
file: dest={{ keepalived_script_user_home }} state=directory owner={{ keepalived_script_username }} group={{ keepalived_script_username }} mode=0750
|
|
||||||
|
|
||||||
- name: Create the tmpfile entry for the keepalived runtime directory
|
|
||||||
template: src=tmpfile_keepalived.conf.j2 dest=/usr/lib/tmpfiles.d/keepalived.conf owner=root group=root mode=0644
|
|
||||||
when: ansible_service_mgr == 'systemd'
|
|
||||||
|
|
||||||
- name: Install the keepalived configuration
|
|
||||||
template: src=keepalived.conf.j2 dest=/etc/keepalived/keepalived.conf owner=root group=root mode=0600
|
|
||||||
notify: restart keepalived
|
|
||||||
|
|
||||||
- name: Install the keepalived default check script
|
|
||||||
template: src=keepalived_check_service_status.sh.j2 dest=/usr/local/bin/keepalived_check_service_status owner=root group=root mode=0755
|
|
||||||
notify: restart keepalived
|
|
||||||
|
|
||||||
- name: Install the keepalived notify scripts
|
|
||||||
template: src=keepalived_notify.sh.j2 dest={{ item.notify }} owner=root group={{ keepalived_script_username }} mode=0754
|
|
||||||
with_items: '{{ keepalived_instances }}'
|
|
||||||
|
|
||||||
- name: Set the kernel net.ipv4.ip_nonlocal_bind sysctl
|
|
||||||
sysctl:
|
|
||||||
reload: yes
|
|
||||||
state: present
|
|
||||||
name: net.ipv4.ip_nonlocal_bind
|
|
||||||
sysctl_set: yes
|
|
||||||
sysctl_file: /etc/sysctl.d/90-keepalived
|
|
||||||
value: 1
|
|
||||||
when: keepalived_non_local_bind | bool
|
|
||||||
|
|
||||||
- name: Disable the kernel net.ipv4.ip_nonlocal_bind sysctl if not needed
|
|
||||||
sysctl:
|
|
||||||
reload: yes
|
|
||||||
state: absent
|
|
||||||
name: net.ipv4.ip_nonlocal_bind
|
|
||||||
sysctl_set: yes
|
|
||||||
sysctl_file: /etc/sysctl.d/90-keepalived
|
|
||||||
value: 1
|
|
||||||
when: not keepalived_non_local_bind | bool
|
|
||||||
|
|
||||||
- name: Ensure that keepalived is started and enabled
|
|
||||||
service: name=keepalived state=started enabled=yes
|
|
||||||
when: keepalived_enabled | bool
|
|
||||||
|
|
||||||
- name: Ensure that keepalived is stopped and disabled
|
|
||||||
service: name=keepalived state=stopped enabled=no
|
|
||||||
when: not keepalived_enabled | bool
|
|
||||||
|
|
||||||
tags: [ 'keepalived', 'keepalived_conf' ]
|
|
||||||
when: keepalived_install | bool
|
|
||||||
|
|
||||||
- block:
|
|
||||||
- name: Install the keepalived NRPE nagios check
|
|
||||||
copy: src=check_keepalived_state dest={{ nagios_plugins_dir }}/check_keepalived_state owner=root group=root mode=0555
|
|
||||||
with_items: '{{ keepalived_instances }}'
|
|
||||||
|
|
||||||
- name: Install the keepalived NRPE command configuration
|
|
||||||
template: src=keepalived-nrpe.cfg.j2 dest={{ nrpe_include_dir }}/keepalived-nrpe.cfg owner=root group=root mode=0444
|
|
||||||
notify: Reload NRPE server
|
|
||||||
|
|
||||||
tags: keepalived
|
|
||||||
when:
|
|
||||||
- keepalived_install | bool
|
|
||||||
- keepalived_nagios_check | bool
|
|
||||||
|
|
||||||
- block:
|
|
||||||
- name: Remove the keepalived package if we do not want it
|
|
||||||
apt: name={{ keepalived_pkgs }} state=absent
|
|
||||||
|
|
||||||
- name: Remove the keepalived notify scripts
|
|
||||||
file: dest={{ item.notify }} state=absent
|
|
||||||
with_items: '{{ keepalived_instances }}'
|
|
||||||
|
|
||||||
- name: Remove the keepalived NRPE check
|
|
||||||
file: dest={{ nagios_plugins_dir }}/check_keepalived_state state=absent
|
|
||||||
with_items: '{{ keepalived_instances }}'
|
|
||||||
|
|
||||||
- name: Remove the keepalived NRPE command configuration
|
|
||||||
file: dest={{ nrpe_include_dir }}/keepalived-nrpe.cfg state=absent
|
|
||||||
|
|
||||||
tags: keepalived
|
|
||||||
when: not keepalived_install | bool
|
|
||||||
|
|
||||||
|
|
@ -1,6 +0,0 @@
|
||||||
#
|
|
||||||
command[check_keepalived]={{ nagios_plugins_dir }}/check_keepalived_state
|
|
||||||
|
|
||||||
# Restart keepalived (via handler)
|
|
||||||
command[global_restart_keepalived]=/usr/bin/sudo /etc/init.d/keepalived restart
|
|
||||||
|
|
||||||
|
|
@ -1,88 +0,0 @@
|
||||||
global_defs {
|
|
||||||
{% if keepalived_enable_script_security %}
|
|
||||||
|
|
||||||
enable_script_security
|
|
||||||
{% if ansible_distribution_file_variety == "Debian" and ansible_distribution_major_version == '18' %}
|
|
||||||
script_user root
|
|
||||||
{% else %}
|
|
||||||
script_user {{ keepalived_script_username }}
|
|
||||||
{% endif %}
|
|
||||||
{% endif %}
|
|
||||||
}
|
|
||||||
|
|
||||||
{% for script in keepalived_scripts %}
|
|
||||||
vrrp_script {{ script.name }} {
|
|
||||||
script "{{ script.script }}"
|
|
||||||
interval {{ script.interval | default(1) }}
|
|
||||||
weight {{ script.weight | default(2) }}
|
|
||||||
fall {{ script.fall | default(3) }}
|
|
||||||
rise {{ script.raise | default(2) }}
|
|
||||||
timeout {{ script.timeout | default(5) }}
|
|
||||||
}
|
|
||||||
{% endfor %}
|
|
||||||
|
|
||||||
{% for instance in keepalived_instances %}
|
|
||||||
vrrp_instance {{ instance.name }} {
|
|
||||||
interface {{ instance.interface }}
|
|
||||||
{% if instance.state is defined %}
|
|
||||||
{% if instance.nopreempt is defined and instance.nopreempt %}
|
|
||||||
|
|
||||||
state BACKUP
|
|
||||||
{% else %}
|
|
||||||
state {{ instance.state }}
|
|
||||||
|
|
||||||
{% endif %}
|
|
||||||
{% endif %}
|
|
||||||
virtual_router_id {{ instance.vrouter_id }}
|
|
||||||
priority {{ instance.priority }}
|
|
||||||
{% if instance.notify is defined %}
|
|
||||||
|
|
||||||
notify {{ instance.notify }}
|
|
||||||
|
|
||||||
{% endif %}
|
|
||||||
{% if instance.nopreempt is defined and instance.nopreempt %}
|
|
||||||
|
|
||||||
nopreempt
|
|
||||||
|
|
||||||
{% endif %}
|
|
||||||
{% if instance.authentication is defined %}
|
|
||||||
|
|
||||||
authentication {
|
|
||||||
auth_type {{ instance.authentication }}
|
|
||||||
auth_pass {{ instance.authpass }}
|
|
||||||
}
|
|
||||||
|
|
||||||
{% endif %}
|
|
||||||
virtual_ipaddress {
|
|
||||||
{% for addr in instance.v_addr %}
|
|
||||||
{{ addr }}
|
|
||||||
{% endfor %}
|
|
||||||
}
|
|
||||||
track_script {
|
|
||||||
{% for trk in instance.track_script %}
|
|
||||||
{{ trk }}
|
|
||||||
{% endfor %}
|
|
||||||
}
|
|
||||||
{% if instance.track_interface is defined %}
|
|
||||||
|
|
||||||
track_interface {
|
|
||||||
{% for if in instance.track_interface %}
|
|
||||||
{{ if }}
|
|
||||||
{% endfor %}
|
|
||||||
}
|
|
||||||
|
|
||||||
{% endif %}
|
|
||||||
{% if keepalived_use_unicast %}
|
|
||||||
|
|
||||||
unicast_src_ip {{ instance.keepalived_unicast_src_ip }}
|
|
||||||
unicast_peer {
|
|
||||||
|
|
||||||
{% for ipaddr in instance.keepalived_unicast_peer_ip %}
|
|
||||||
{{ ipaddr }}
|
|
||||||
{% endfor %}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
{% endif %}
|
|
||||||
}
|
|
||||||
{% endfor %}
|
|
||||||
|
|
@ -1,19 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
{% if ansible_distribution_file_variety == "Debian" and ansible_distribution_major_version == '18' %}
|
|
||||||
am_i_master=$( grep MASTER {{ keepalived_runtime_dir }}/keepalive.state )
|
|
||||||
keepalive_master=$?
|
|
||||||
|
|
||||||
if [ $keepalive_master -eq 0 ] ; then
|
|
||||||
{% for instance in keepalived_instances %}
|
|
||||||
{% for addr in instance.v_addr %}
|
|
||||||
float_ip=$( ip addr show | grep {{ addr }} )
|
|
||||||
retval=$?
|
|
||||||
[ $retval -eq 1 ] && /bin/systemctl restart keepalived
|
|
||||||
{% endfor %}
|
|
||||||
{% endfor %}
|
|
||||||
fi
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{{ keepalived_script1_check }}
|
|
||||||
|
|
||||||
exit $?
|
|
||||||
|
|
@ -1,19 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
#
|
|
||||||
# echo $1 $2 is in $3 state > /var/lib/keepalived/keepalive.state
|
|
||||||
#
|
|
||||||
umask 022
|
|
||||||
export PATH="/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/bin:$PATH"
|
|
||||||
TYPE=$1
|
|
||||||
NAME=$2
|
|
||||||
STATE=$3
|
|
||||||
RETVAL=0
|
|
||||||
|
|
||||||
{% if keepalived_notify_extra_params is defined %}
|
|
||||||
{{ keepalived_notify_extra_params }}
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
echo "$TYPE $NAME is in $STATE state" > {{ keepalived_runtime_dir }}/keepalive.state
|
|
||||||
|
|
||||||
exit $RETVAL
|
|
||||||
|
|
||||||
|
|
@ -1 +0,0 @@
|
||||||
d {{ keepalived_runtime_dir }} 0775 {{ keepalived_script_username }} {{ keepalived_script_username }}
|
|
||||||
|
|
@ -1,52 +0,0 @@
|
||||||
---
|
|
||||||
unbound_pkgs:
|
|
||||||
- unbound
|
|
||||||
- unbound-anchor
|
|
||||||
- unbound-host
|
|
||||||
- dnsutils
|
|
||||||
|
|
||||||
unbound_interfaces:
|
|
||||||
- '0.0.0.0'
|
|
||||||
- '::0'
|
|
||||||
|
|
||||||
unbound_allowed_clients:
|
|
||||||
- { cidr: '0.0.0.0/0', policy: 'allow' }
|
|
||||||
|
|
||||||
unbound_prefetch: 'yes'
|
|
||||||
unbound_verbosity: 1
|
|
||||||
unbound_threads: '{{ ansible_processor_count }}'
|
|
||||||
|
|
||||||
unbound_remote_control: 'yes'
|
|
||||||
unbound_remote_IP: '127.0.0.1'
|
|
||||||
|
|
||||||
unbound_rrset_cache_size: 100m
|
|
||||||
unbound_rrset_msg_cache_size: 50m
|
|
||||||
# Larger socket buffer. OS may need config.
|
|
||||||
unbound_so_rcvbuf: 4m
|
|
||||||
unbound_so_sndbuf: 4m
|
|
||||||
# Faster UDP with multithreading (only on Linux).
|
|
||||||
unbound_so_reuseport: 'yes'
|
|
||||||
# with libevent
|
|
||||||
unbound_num_queries_per_thread: 4096
|
|
||||||
|
|
||||||
unbound_max_negative_ttl: 3600
|
|
||||||
|
|
||||||
unbound_hide_identity: 'yes'
|
|
||||||
unbound_hide_version: 'yes'
|
|
||||||
unbound_qname_minimisation: 'no'
|
|
||||||
unbound_val_clean_additional: 'yes'
|
|
||||||
# The following is experimental
|
|
||||||
unbound_use_caps_for_id: 'no'
|
|
||||||
unbound_unwanted_reply_threshold: '10000000'
|
|
||||||
unbound_do_not_query_localhost: 'no'
|
|
||||||
unbound_rrset_roundrobin: 'yes'
|
|
||||||
unbound_unblock_lan_zones: 'no'
|
|
||||||
unbound_do_ipv6: 'yes'
|
|
||||||
|
|
||||||
unbound_private_addresses: []
|
|
||||||
unbound_private_domains: []
|
|
||||||
# Stub zones
|
|
||||||
# One of stub_host or stub_addr must be defined
|
|
||||||
# stub_prime and stub_first are both optional, default 'yes'
|
|
||||||
#unbound_stub_zones:
|
|
||||||
# - { name: '', stub_addr: '', stub_host: '', stub_prime: '', stub_first: '' }
|
|
||||||
|
|
@ -1,4 +0,0 @@
|
||||||
---
|
|
||||||
- name: Restart unbound
|
|
||||||
service: name=unbound state=restarted
|
|
||||||
|
|
||||||
|
|
@ -1,24 +0,0 @@
|
||||||
---
|
|
||||||
- block:
|
|
||||||
- name: Install the unbound resolver packages
|
|
||||||
apt: pkg={{ unbound_pkgs }} state=present cache_valid_time=1800 update_cache=yes
|
|
||||||
|
|
||||||
- name: Install the unbound config files
|
|
||||||
template: src={{ item }} dest=/etc/unbound/unbound.conf.d/{{ item }}
|
|
||||||
with_items:
|
|
||||||
- unbound-server.conf
|
|
||||||
- unbound-remote-control.conf
|
|
||||||
notify: Restart unbound
|
|
||||||
tags: [ 'unbound', 'unbound_conf' ]
|
|
||||||
|
|
||||||
- name: On bionic, stop systemd-resolvd because it interferes
|
|
||||||
service: name=systemd-resolved state=stopped enabled=no
|
|
||||||
when:
|
|
||||||
- ansible_distribution == "Ubuntu"
|
|
||||||
- ansible_service_mgr == 'systemd'
|
|
||||||
- ansible_distribution_major_version >= '18'
|
|
||||||
|
|
||||||
- name: Ensure that the unbound service is started and enabled
|
|
||||||
service: name=unbound state=restarted enabled=yes
|
|
||||||
|
|
||||||
tags: [ 'unbound' ]
|
|
||||||
|
|
@ -1,6 +0,0 @@
|
||||||
remote-control:
|
|
||||||
control-enable: {{ unbound_remote_control }}
|
|
||||||
{% if unbound_remote_IP is defined %}
|
|
||||||
control-interface: '{{ unbound_remote_IP }}'
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
|
|
@ -1,81 +0,0 @@
|
||||||
server:
|
|
||||||
{% for interface in unbound_interfaces %}
|
|
||||||
interface: {{ interface }}
|
|
||||||
{% endfor %}
|
|
||||||
{% if keepalived_install is defined and keepalived_install %}
|
|
||||||
ip-transparent: yes
|
|
||||||
{% endif %}
|
|
||||||
interface-automatic: yes
|
|
||||||
{% for net in unbound_allowed_clients %}
|
|
||||||
access-control: {{ net.cidr }} {{ net.policy }}
|
|
||||||
{% endfor %}
|
|
||||||
verbosity: {{ unbound_verbosity }}
|
|
||||||
# use all CPUs
|
|
||||||
num-threads: {{ unbound_threads }}
|
|
||||||
prefetch: {{ unbound_prefetch }}
|
|
||||||
|
|
||||||
# power of 2 close to num-threads
|
|
||||||
msg-cache-slabs: {{ unbound_threads }}
|
|
||||||
rrset-cache-slabs: {{ unbound_threads }}
|
|
||||||
infra-cache-slabs: {{ unbound_threads }}
|
|
||||||
key-cache-slabs: {{ unbound_threads }}
|
|
||||||
|
|
||||||
# more cache memory, rrset=msg*2
|
|
||||||
rrset-cache-size: {{ unbound_rrset_cache_size }}
|
|
||||||
msg-cache-size: {{ unbound_rrset_msg_cache_size }}
|
|
||||||
|
|
||||||
# more outgoing connections
|
|
||||||
# depends on number of cores: 1024/cores - 50
|
|
||||||
outgoing-range: {{ 1024 * unbound_threads - 50 }}
|
|
||||||
|
|
||||||
# Larger socket buffer. OS may need config.
|
|
||||||
so-rcvbuf: {{ unbound_so_rcvbuf }}
|
|
||||||
so-sndbuf: {{ unbound_so_sndbuf }}
|
|
||||||
|
|
||||||
# Negative TTL
|
|
||||||
cache-max-negative-ttl: {{ unbound_max_negative_ttl }}
|
|
||||||
|
|
||||||
# Faster UDP with multithreading (only on Linux).
|
|
||||||
so-reuseport: {{ unbound_so_reuseport }}
|
|
||||||
# with libevent
|
|
||||||
num-queries-per-thread: {{ unbound_num_queries_per_thread }}
|
|
||||||
hide-identity: {{ unbound_hide_identity }}
|
|
||||||
hide-version: {{ unbound_hide_version }}
|
|
||||||
qname-minimisation: {{ unbound_qname_minimisation }}
|
|
||||||
# The following is experimental
|
|
||||||
use-caps-for-id: {{ unbound_use_caps_for_id }}
|
|
||||||
unwanted-reply-threshold: {{ unbound_unwanted_reply_threshold }}
|
|
||||||
do-not-query-localhost: {{ unbound_do_not_query_localhost }}
|
|
||||||
rrset-roundrobin: {{ unbound_rrset_roundrobin }}
|
|
||||||
val-clean-additional: {{ unbound_val_clean_additional }}
|
|
||||||
unblock-lan-zones: {{ unbound_unblock_lan_zones }}
|
|
||||||
do-ip6: {{ unbound_do_ipv6 }}
|
|
||||||
#
|
|
||||||
{% if ansible_service_mgr == 'systemd' %}
|
|
||||||
use-systemd: yes
|
|
||||||
do-daemonize: no
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% for cidr in unbound_private_addresses %}
|
|
||||||
private-address: {{ cidr }}
|
|
||||||
{% endfor %}
|
|
||||||
{% for dom in unbound_private_domains %}
|
|
||||||
private-domain: {{ dom }}
|
|
||||||
{% endfor %}
|
|
||||||
|
|
||||||
{% if unbound_stub_zones is defined %}
|
|
||||||
{% for zone in unbound_stub_zones %}
|
|
||||||
stub-zone:
|
|
||||||
name: {{ zone.name }}
|
|
||||||
{% if zone.stub_host is defined %}
|
|
||||||
stub-host: {{ zone.stub_host }}
|
|
||||||
{% endif %}
|
|
||||||
{% if zone.stub_addr is defined %}
|
|
||||||
stub-addr: {{ zone.stub_addr }}
|
|
||||||
{% endif %}
|
|
||||||
stub-prime: {{ zone.stub_prime | default('no') }}
|
|
||||||
stub-first: {{ zone.stub_first | default('yes') }}
|
|
||||||
|
|
||||||
{% endfor %}
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
Loading…
Reference in New Issue