c54e8f5d67
- stop using journald, write to /var/log/unbound/ - set up frequent log rotation for the huge log files we are producing
63 lines
1.4 KiB
YAML
63 lines
1.4 KiB
YAML
---
|
|
|
|
# This is used to let unbound bind to the right IP addresses.
|
|
- name: set dns_host_suffix (main)
|
|
set_fact:
|
|
dns_host_suffix: "{{ dns_host_suffix_main }}"
|
|
when: "'rdns_main' in group_names"
|
|
|
|
- name: set dns_host_suffix (backup)
|
|
set_fact:
|
|
dns_host_suffix: "{{ dns_host_suffix_backup }}"
|
|
when: "'rdns_backup' in group_names"
|
|
|
|
|
|
- name: install unbound
|
|
apt:
|
|
update_cache: true
|
|
name: unbound
|
|
state: present
|
|
register: unbound_install
|
|
|
|
- name: add unbound-control configuration
|
|
template:
|
|
src: unbound-control.conf.j2
|
|
dest: /etc/unbound/unbound.conf.d/unbound-control.conf
|
|
mode: 0644
|
|
notify: restart unbound
|
|
|
|
- name: setup main unbound config file
|
|
template:
|
|
src: unbound.conf.j2
|
|
dest: /etc/unbound/unbound.conf
|
|
mode: 0644
|
|
notify: restart unbound
|
|
|
|
- name: ensure unbound log directory exists
|
|
file:
|
|
path: /var/log/unbound
|
|
state: directory
|
|
mode: '0755'
|
|
owner: unbound
|
|
group: unbound
|
|
|
|
- name: ask apparmor to allow unbound to write to log file
|
|
template:
|
|
src: unbound-apparmor-config
|
|
dest: /etc/apparmor.d/local/usr.sbin.unbound
|
|
mode: '0644'
|
|
notify: read unbound apparmor config
|
|
|
|
- name: setup unbound log rotation
|
|
template:
|
|
src: unbound-logrotate.j2
|
|
dest: /etc/logrotate.d/unbound
|
|
mode: 0644
|
|
|
|
- name: setup recursive DNS server config
|
|
template:
|
|
src: recursive.conf.j2
|
|
dest: /etc/unbound/unbound.conf.d/recursive.conf
|
|
mode: 0644
|
|
notify: restart unbound
|