From bf1b7e434d04f0eb30a26179de3c0642360ee031 Mon Sep 17 00:00:00 2001 From: Markus Hauschild Date: Tue, 24 Nov 2020 22:40:48 +0100 Subject: [PATCH] dns_resolver: new role for resolver only --- hosts | 1 + roles/dns_resolver/handlers/main.yml | 10 ++++ roles/dns_resolver/meta/main.yml | 4 ++ roles/dns_resolver/tasks/main.yml | 41 ++++++++++++++ roles/dns_resolver/templates/certs.j2 | 15 +++++ roles/dns_resolver/templates/dnsdist.conf.j2 | 16 ++++++ roles/dns_resolver/templates/recursor.conf.j2 | 55 +++++++++++++++++++ site.yml | 5 ++ 8 files changed, 147 insertions(+) create mode 100644 roles/dns_resolver/handlers/main.yml create mode 100644 roles/dns_resolver/meta/main.yml create mode 100644 roles/dns_resolver/tasks/main.yml create mode 100644 roles/dns_resolver/templates/certs.j2 create mode 100644 roles/dns_resolver/templates/dnsdist.conf.j2 create mode 100644 roles/dns_resolver/templates/recursor.conf.j2 diff --git a/hosts b/hosts index 158ad45..0a09cd0 100644 --- a/hosts +++ b/hosts @@ -3,6 +3,7 @@ gw11.regensburg.freifunk.net gw21.regensburg.freifunk.net gw31.regensburg.freifunk.net ns1.regensburg.freifunk.net +resolver.regensburg.freifunk.net stats.regensburg.freifunk.net web.regensburg.freifunk.net stats.ffrgb ansible_host=10.90.224.100 diff --git a/roles/dns_resolver/handlers/main.yml b/roles/dns_resolver/handlers/main.yml new file mode 100644 index 0000000..bba002e --- /dev/null +++ b/roles/dns_resolver/handlers/main.yml @@ -0,0 +1,10 @@ +--- + +- name: Run acertmgr + command: /usr/bin/acertmgr + +- name: Restart powerdns + service: name=pdns-recursor state=restarted + +- name: Restart dnsdist + service: name=dnsdist state=restarted diff --git a/roles/dns_resolver/meta/main.yml b/roles/dns_resolver/meta/main.yml new file mode 100644 index 0000000..a456842 --- /dev/null +++ b/roles/dns_resolver/meta/main.yml @@ -0,0 +1,4 @@ +--- + +dependencies: +- { role: acertmgr } diff --git a/roles/dns_resolver/tasks/main.yml b/roles/dns_resolver/tasks/main.yml new file mode 100644 index 0000000..86d24a1 --- /dev/null +++ b/roles/dns_resolver/tasks/main.yml @@ -0,0 +1,41 @@ +--- + +- name: Enable powerdns apt-key + apt_key: url='https://repo.powerdns.com/FD380FBB-pub.asc' + +- name: Enable powerdns repository + apt_repository: repo='deb http://repo.powerdns.com/debian buster-dnsdist-15 main' + +- name: Install powerdns + apt: + name: + - dnsdist + - pdns-recursor + +- name: Ensure certificates are available + command: + cmd: > + openssl req -x509 -nodes -newkey rsa:2048 + -keyout /etc/dnsdist/{{ ansible_fqdn }}.key + -out /etc/dnsdist/{{ ansible_fqdn }}.crt + -days 730 -subj "/CN={{ ansible_fqdn }}" + creates: /etc/dnsdist/{{ ansible_fqdn }}.crt + notify: Restart dnsdist + +- name: Configure certificate manager + template: src=certs.j2 dest=/etc/acertmgr/{{ ansible_fqdn }}_dns.conf + notify: Run acertmgr + +- name: Configure powerdns + template: src=recursor.conf.j2 dest=/etc/powerdns/recursor.conf + notify: Restart powerdns + +- name: Configure dnsdist + template: src=dnsdist.conf.j2 dest=/etc/dnsdist/dnsdist.conf + notify: Restart dnsdist + +- name: Start the dns services + service: name={{ item }} state=started enabled=yes + with_items: + - dnsdist + - pdns-recursor diff --git a/roles/dns_resolver/templates/certs.j2 b/roles/dns_resolver/templates/certs.j2 new file mode 100644 index 0000000..0929f75 --- /dev/null +++ b/roles/dns_resolver/templates/certs.j2 @@ -0,0 +1,15 @@ +--- + +{{ ansible_fqdn }}: +- path: /etc/dnsdist/{{ ansible_fqdn }}.crt + user: _dnsdist + group: _dnsdist + perm: '400' + format: crt,ca + action: '/usr/sbin/service dnsdist restart' +- path: /etc/dnsdist/{{ ansible_fqdn }}.key + user: _dnsdist + group: _dnsdist + perm: '400' + format: key + action: '/usr/sbin/service dnsdist restart' diff --git a/roles/dns_resolver/templates/dnsdist.conf.j2 b/roles/dns_resolver/templates/dnsdist.conf.j2 new file mode 100644 index 0000000..34438cb --- /dev/null +++ b/roles/dns_resolver/templates/dnsdist.conf.j2 @@ -0,0 +1,16 @@ +-- {{ ansible_managed }} + +setLocal('127.0.0.1') +addLocal('::1') +addLocal('{{ ansible_default_ipv4.address }}') +addLocal('{{ ansible_default_ipv6.address }}') + +newServer({address="127.0.0.1:5300", qps=1, name="localhost"}) + +addTLSLocal('127.0.0.1','/etc/dnsdist/{{ ansible_fqdn }}.crt', '/etc/dnsdist/{{ ansible_fqdn }}.key') +addTLSLocal('::1','/etc/dnsdist/{{ ansible_fqdn }}.crt', '/etc/dnsdist/{{ ansible_fqdn }}.key') +addTLSLocal('{{ ansible_default_ipv4.address }}','/etc/dnsdist/{{ ansible_fqdn }}.crt', '/etc/dnsdist/{{ ansible_fqdn }}.key') +addTLSLocal('{{ ansible_default_ipv6.address }}','/etc/dnsdist/{{ ansible_fqdn }}.crt', '/etc/dnsdist/{{ ansible_fqdn }}.key') + +-- disable security status polling via DNS +setSecurityPollSuffix("") diff --git a/roles/dns_resolver/templates/recursor.conf.j2 b/roles/dns_resolver/templates/recursor.conf.j2 new file mode 100644 index 0000000..2c8b2c7 --- /dev/null +++ b/roles/dns_resolver/templates/recursor.conf.j2 @@ -0,0 +1,55 @@ +# {{ ansible_managed }} + +################################# +# allow-from If set, only allow these comma separated netmasks to recurse +# +#allow-from=127.0.0.0/8 + +################################# +# config-dir Location of configuration directory (recursor.conf) +# +config-dir=/etc/powerdns + +################################# +# dnssec DNSSEC mode: off/process-no-validate (default)/process/log-fail/validate +# +# dnssec=process-no-validate +dnssec=off + +################################# +# local-address IP addresses to listen on, separated by spaces or commas. Also accepts ports. +# +local-address=127.0.0.1 + +################################# +# local-port port to listen on +# +local-port=5300 + +################################# +# query-local-address6 Send out local IPv6 queries from this address or addresses. Disabled by default, which also disables outgoing +# +{% if global_ipv6 is defined %} +query-local-address6={{ global_ipv6 | ipaddr('address') }} +{% endif %} + +################################# +# quiet Suppress logging of questions and answers +# +quiet=yes + +################################# +# security-poll-suffix Domain name from which to query security update notifications +# +# security-poll-suffix=secpoll.powerdns.com. +security-poll-suffix= + +################################# +# setgid If set, change group id to this gid for more security +# +setgid=pdns + +################################# +# setuid If set, change user id to this uid for more security +# +setuid=pdns diff --git a/site.yml b/site.yml index b295878..4d5ba98 100644 --- a/site.yml +++ b/site.yml @@ -49,6 +49,11 @@ roles: - web_svc +- name: Setup resolver + hosts: resolver.regensburg.freifunk.net + roles: + - dns_resolver + - name: Setup stats server hosts: stats.ffrgb roles: