2019-11-26 23:17:48 +01:00
|
|
|
# Until chroot-bind.sh is migrated to ansible, we hardcode the chroot paths.
|
|
|
|
- name: set chroot variables
|
|
|
|
set_fact:
|
2023-02-26 21:32:51 +01:00
|
|
|
bind_log_file: /var/log/bind.log
|
|
|
|
bind_query_file: /var/log/bind_queries.log
|
|
|
|
bind_cache_dir: /var/cache/bind
|
|
|
|
bind_statistics_file: /var/run/named.stats
|
|
|
|
bind_chroot_path: /var/chroot-bind
|
2021-05-09 23:06:42 +02:00
|
|
|
when: bind_chroot_set | bool
|
2019-11-26 23:17:48 +01:00
|
|
|
|
2023-02-21 18:30:09 +01:00
|
|
|
- name: Check AppArmor
|
|
|
|
shell: systemctl is-active apparmor || systemctl is-enabled apparmor
|
|
|
|
failed_when: False
|
|
|
|
changed_when: False
|
|
|
|
check_mode: no
|
|
|
|
register: check_apparmor
|
|
|
|
|
2021-03-09 22:58:14 +01:00
|
|
|
- name: configure apparmor
|
|
|
|
template:
|
|
|
|
src: apparmor.usr.sbin.named.j2
|
|
|
|
dest: /etc/apparmor.d/usr.sbin.named
|
|
|
|
owner: root
|
|
|
|
group: root
|
2023-02-26 21:32:51 +01:00
|
|
|
mode: "0644"
|
2021-03-09 22:58:14 +01:00
|
|
|
force: yes
|
|
|
|
notify: restart apparmor
|
2023-02-21 18:30:09 +01:00
|
|
|
when: check_apparmor.rc == 0
|
2021-03-09 22:58:14 +01:00
|
|
|
|
2017-07-22 18:40:00 +02:00
|
|
|
- name: package are installed
|
2017-02-22 17:06:09 +01:00
|
|
|
apt:
|
2019-12-31 15:25:10 +01:00
|
|
|
name:
|
|
|
|
- bind9
|
|
|
|
- dnstop
|
2017-02-22 17:06:09 +01:00
|
|
|
state: present
|
|
|
|
|
2023-02-21 18:30:09 +01:00
|
|
|
- include: authoritative.yml
|
2021-05-09 23:06:42 +02:00
|
|
|
when: bind_authoritative_server | bool
|
2017-02-22 17:06:09 +01:00
|
|
|
|
2023-02-21 18:30:09 +01:00
|
|
|
- include: recursive.yml
|
|
|
|
when: bind_recursive_server | bool
|
|
|
|
|
|
|
|
- name: Create systemd service for Debian 8 (Jessie)
|
2017-04-06 14:21:29 +02:00
|
|
|
template:
|
2023-02-21 18:30:09 +01:00
|
|
|
src: bind9.service.jessie.j2
|
2017-04-06 14:21:29 +02:00
|
|
|
dest: "{{ bind_systemd_service_path }}"
|
2017-02-22 17:06:09 +01:00
|
|
|
owner: root
|
|
|
|
group: root
|
2017-04-06 11:16:02 +02:00
|
|
|
mode: "0644"
|
2017-04-06 14:21:29 +02:00
|
|
|
force: yes
|
2017-07-22 18:40:00 +02:00
|
|
|
notify:
|
2023-02-21 18:30:09 +01:00
|
|
|
- reload systemd
|
|
|
|
- restart bind
|
2017-07-22 18:40:00 +02:00
|
|
|
when: ansible_distribution_release == "jessie"
|
2017-02-22 17:06:09 +01:00
|
|
|
|
2019-11-26 20:02:28 +01:00
|
|
|
- name: "touch {{ bind_log_file }} if non chroot"
|
2017-02-22 17:06:09 +01:00
|
|
|
file:
|
2019-11-26 20:02:28 +01:00
|
|
|
path: "{{ bind_log_file }}"
|
2017-02-22 17:06:09 +01:00
|
|
|
owner: bind
|
2017-07-22 18:40:00 +02:00
|
|
|
group: adm
|
|
|
|
mode: "0640"
|
2017-04-06 14:33:46 +02:00
|
|
|
state: touch
|
2021-05-09 23:06:42 +02:00
|
|
|
when: not (bind_chroot_set | bool)
|
2017-04-06 14:33:46 +02:00
|
|
|
|
2019-11-26 20:02:28 +01:00
|
|
|
- name: "touch {{ bind_query_file }} if non chroot"
|
2017-02-22 17:06:09 +01:00
|
|
|
file:
|
2019-11-26 20:02:28 +01:00
|
|
|
path: "{{ bind_query_file }}"
|
2017-02-22 17:06:09 +01:00
|
|
|
owner: bind
|
2017-07-22 18:40:00 +02:00
|
|
|
group: adm
|
2017-04-06 14:33:46 +02:00
|
|
|
mode: "0640"
|
2017-07-22 18:40:00 +02:00
|
|
|
state: touch
|
2021-05-09 23:06:42 +02:00
|
|
|
when: not (bind_chroot_set | bool)
|
2017-02-22 17:06:09 +01:00
|
|
|
|
2017-07-22 18:40:00 +02:00
|
|
|
- name: send chroot-bind.sh in /root
|
|
|
|
copy:
|
|
|
|
src: chroot-bind.sh
|
|
|
|
dest: /root/chroot-bind.sh
|
|
|
|
mode: "0700"
|
2017-02-22 17:06:09 +01:00
|
|
|
owner: root
|
2017-07-22 18:40:00 +02:00
|
|
|
force: yes
|
|
|
|
backup: yes
|
2021-05-09 23:06:42 +02:00
|
|
|
when: bind_chroot_set | bool
|
2017-02-22 17:06:09 +01:00
|
|
|
|
2017-07-22 18:40:00 +02:00
|
|
|
- name: exec chroot-bind.sh
|
|
|
|
command: "/root/chroot-bind.sh"
|
|
|
|
register: chrootbind_run
|
|
|
|
changed_when: False
|
2021-05-09 23:06:42 +02:00
|
|
|
when: bind_chroot_set | bool
|
2017-02-22 17:06:09 +01:00
|
|
|
|
2017-07-22 18:40:00 +02:00
|
|
|
- debug:
|
|
|
|
var: chrootbind_run.stdout_lines
|
2021-05-13 15:23:05 +02:00
|
|
|
when:
|
2021-05-09 23:06:42 +02:00
|
|
|
- bind_chroot_set | bool
|
|
|
|
- chrootbind_run.stdout | length > 0
|
2017-02-22 17:06:09 +01:00
|
|
|
|
2017-07-22 18:40:00 +02:00
|
|
|
- name: Modify OPTIONS in /etc/default/bind9 for chroot
|
|
|
|
replace:
|
|
|
|
dest: /etc/default/bind9
|
|
|
|
regexp: '^OPTIONS=.*'
|
|
|
|
replace: 'OPTIONS="-u bind -t {{ bind_chroot_path }}"'
|
2017-04-06 14:22:17 +02:00
|
|
|
notify: restart bind
|
2021-05-09 23:06:42 +02:00
|
|
|
when: bind_chroot_set | bool
|
2017-02-22 17:06:09 +01:00
|
|
|
|
2019-11-26 20:02:28 +01:00
|
|
|
- name: logrotate for bind
|
2017-07-22 18:40:00 +02:00
|
|
|
template:
|
2020-01-14 15:15:58 +01:00
|
|
|
src: logrotate_bind.j2
|
2019-11-26 17:48:21 +01:00
|
|
|
dest: /etc/logrotate.d/bind9
|
2017-07-22 18:40:00 +02:00
|
|
|
owner: root
|
|
|
|
group: root
|
|
|
|
mode: "0644"
|
|
|
|
force: yes
|
2017-04-06 14:22:17 +02:00
|
|
|
notify: restart bind
|
2017-02-22 17:06:09 +01:00
|
|
|
|
2019-11-26 17:48:21 +01:00
|
|
|
- include: munin.yml
|