Merge branch 'dns' into 'aurore-dev'

Déploiement basique de serveur DNS récursif

See merge request aurore/ansible!45
This commit is contained in:
chirac 2020-04-13 19:08:32 +02:00
commit 59b9059116
8 changed files with 86 additions and 29 deletions

View file

@ -0,0 +1,4 @@
---
ldap_local_replica_uri:
- 'ldap://ldap-replica-edc.adm.auro.re'

6
hosts
View file

@ -149,15 +149,15 @@ edc_pve
gs_pve
[dhcp]
dhcp-fleming.adm.auro.re
#dhcp-fleming.adm.auro.re
dhcp-fleming-backup.adm.auro.re
#dhcp-pacaterie.adm.auro.re
#dhcp-pacaterie-backup.adm.auro.re
#dhcp-edc.adm.auro.re
#dhcp-gs.adm.auro.re
[dns]
#dns-fleming.adm.auro.re
[recursive_dns]
dns-fleming.adm.auro.re
#dns-fleming-backup.adm.auro.re
#dns-pacaterie.adm.auro.re
#dns-pacaterie-backup.adm.auro.re

View file

@ -1,20 +1,4 @@
---
## Deploy DHCP
#- hosts: dhcp
# vars:
# service_repo: https://gitlab.federez.net/re2o/dhcp.git
# service_name: dhcp
# service_version: master
# service_config:
# hostname: re2o-server.adm.auro.re
# username: service-user
# password: "{{ vault_serviceuser_passwd }}"
# dhcp:
# authoritative: true
# roles:
# - re2o-service
# - isc-dhcp-server
# Set up DHCP servers.
- hosts: dhcp
vars:
@ -29,18 +13,29 @@
- re2o-service
- isc-dhcp-server
# Deploy DNS
- hosts: dns
# Deploy unbound DNS server (recursive).
- hosts: recursive_dns
vars:
service_repo: https://gitlab.crans.org/nounous/re2o-dns.git
service_name: dns
service_version: crans
service_config:
hostname: re2o-server.adm.auro.re
username: service-user
password: "{{ vault_serviceuser_passwd }}"
- dns_host_suffix: 253
roles:
- re2o-service
- unbound
# WIP: Deploy authoritative DNS servers
# - hosts: authoritative_dns
# vars:
# service_repo: https://gitlab.crans.org/nounous/re2o-dns.git
# service_name: dns
# service_version: crans
# service_config:
# hostname: re2o-server.adm.auro.re
# username: service-user
# password: "{{ vault_serviceuser_passwd }}"
# roles:
# - re2o-service
# Deploy Unifi Controller
#- hosts: unifi-fleming.adm.auro.re,unifi-pacaterie.adm.auro.re

View file

@ -0,0 +1,25 @@
---
- name: install unbound
apt:
update_cache: true
name: unbound
state: present
- name: setup main unbound config file
template:
src: unbound.conf.j2
dest: /etc/unbound/unbound.conf
mode: 0644
- name: setup recursive DNS server config
template:
src: recursive.conf.j2
dest: /etc/unbound/unbound.conf.d/recursive.conf
mode: 0644
- name: restart unbound after editing config
systemd:
state: restarted
name: unbound

View file

@ -0,0 +1,23 @@
server:
# Timestamps use UTC ASCII instead of UNIX epoch.
log-time-ascii: yes
do-ip4: yes
# FIXME: IPv6 deployment... someday...
do-ip6: no
# IP addresses on which to listen.
interface: 10.{{ subnet_ids.ap }}.0.{{ dns_host_suffix }}
interface: 10.{{ subnet_ids.users_wired }}.0.{{ dns_host_suffix }}
interface: 10.{{ subnet_ids.users_wifi }}.0.{{ dns_host_suffix }}
# By default, anything other than localhost is refused.
# Whitelist some subnets:
access-control: 10.{{ subnet_ids.ap }}.0.0/16 allow
access-control: 10.{{ subnet_ids.users_wired }}.0.0/16 allow
access-control: 10.{{ subnet_ids.users_wifi }}.0.0/16 allow
num-threads: {{ ansible_processor_vcpus }}
private-address: 10.0.0.0/8

View file

@ -0,0 +1,10 @@
# Unbound configuration file for Debian.
#
# See the unbound.conf(5) man page.
#
# See /usr/share/doc/unbound/examples/unbound.conf for a commented
# reference config file.
#
# The following line includes additional configuration files from the
# /etc/unbound/unbound.conf.d directory.
include: "/etc/unbound/unbound.conf.d/*.conf"