CHANGELOG.md

@@ -26,6 +26,9 @@ The **patch** part changes incrementally at each release.
 * redis: rewrite of the role (separate instances, better systemd units…)
 * webapps/evoadmin-web Overload templates if needed
 * webapps/evoadmin-web Add an htpasswd to evoadmin if you cant use an apache IP whitelist
+* bind: enable query logging for recursive resolvers
+* bind: enable logrotate for recursive resolvers
+* bind: enable bind9 munin plugin for recursive resolvers
 
 ### Changed
 * elasticsearch: listen on local interface only by default
@@ -41,6 +44,8 @@ The **patch** part changes incrementally at each release.
 * lxc: remove useless loop in apt execution
 * lxc: update our default template to be compatible with Debian 10
 * lxc: rely on lxc_container module instead of command module
+* bind: the munin task was present, but not included
+* bind: change name of logrotate file to bind9
 
 ### Fixed
 * lxc-php: Don't remove the default pool
@@ -49,6 +54,7 @@ The **patch** part changes incrementally at each release.
 * tomcat: fix typo for default tomcat_version
 * evoadmin-web: Put the php config at the right place for Buster
 
+
 ### Security
 
 ## [9.10.1] - 2019-06-21

bind/defaults/main.yml

@@ -2,8 +2,10 @@
 bind_recursive_server: False
 bind_authoritative_server: True
 bind_chroot_set: True
-bind_chroot_path: /var/chroot-bind
+# Until chroot-bind.sh is migrated to ansible, we hardcode the chroot paths.
+#bind_chroot_path: /var/chroot-bind
 bind_systemd_service_path: /etc/systemd/system/bind9.service
 bind_statistics_file: /var/run/named.stats
 bind_log_file: /var/log/bind.log
 bind_query_file: /var/log/bind_queries.log
+bind_cache_dir: /var/cache/bind

bind/tasks/main.yml

@@ -1,3 +1,13 @@
+# Until chroot-bind.sh is migrated to ansible, we hardcode the chroot paths.
+- name: set chroot variables
+  set_fact:
+     bind_log_file: /var/log/bind.log
+     bind_query_file: /var/log/bind_queries.log
+     bind_cache_dir: /var/cache/bind
+     bind_statistics_file: /var/run/named.stats
+     bind_chroot_path: /var/chroot-bind
+  when: bind_chroot_set
+
 - name: package are installed
   apt:
     name: '{{ item }}'
@@ -49,23 +59,23 @@
   - restart bind
   when: ansible_distribution_release == "jessie"
 
-- name: touch /var/log/bind.log if non chroot
+- name: "touch {{ bind_log_file }} if non chroot"
   file:
-    path: /var/log/bind.log
+    path: "{{ bind_log_file }}"
     owner: bind
     group: adm
     mode: "0640"
     state: touch
-  when: bind_chroot_set == False
+  when: not bind_chroot_set
 
-- name: touch /var/log/bind_queries.log if non chroot
+- name: "touch {{ bind_query_file }} if non chroot"
   file:
-    path: /var/log/bind_queries.log
+    path: "{{ bind_query_file }}"
     owner: bind
     group: adm
     mode: "0640"
     state: touch
-  when: bind_authoritative_server and bind_chroot_set == False
+  when: not bind_chroot_set
 
 - name: send chroot-bind.sh in /root
   copy:
@@ -95,24 +105,14 @@
   notify: restart bind
   when: bind_chroot_set
 
-- name: logrotate for non chroot bind
+- name: logrotate for bind
   template:
-    src: logrotate_bind
-    dest: /etc/logrotate.d/bind
+    src: logrotate_bind.j2
+    dest: /etc/logrotate.d/bind9
     owner: root
     group: root
     mode: "0644"
     force: yes
   notify: restart bind
-  when: bind_chroot_set == False
 
-- name: logrotate for chroot bind
-  template:
-    src: logrotate_bind_chroot.j2
-    dest: /etc/logrotate.d/bind
-    owner: root
-    group: root
-    mode: "0644"
-    force: yes
-  notify: restart bind
-  when: bind_chroot_set
+- include: munin.yml

bind/tasks/munin.yml

@@ -8,9 +8,8 @@
   tags:
     - bind
     - munin
-  when: bind_authoritative_server
 
-- name: Enable munin plugins
+- name: Enable munin plugins for authoritative server
   file:
     src: "/usr/share/munin/plugins/{{ item }}"
     dest: "/etc/munin/plugins/{{ item }}"
@@ -19,7 +18,25 @@
     - bind9
     - bind9_rndc
   notify: restart munin-node
-  when: bind_authoritative_server and munin_node_plugins_config.stat.exists
+  when:
+    - bind_authoritative_server
+    - munin_node_plugins_config.stat.exists
+  tags:
+    - bind
+    - munin
+
+- name: Enable munin plugins for recursive server
+  file:
+    src: "/usr/share/munin/plugins/{{ item }}"
+    dest: "/etc/munin/plugins/{{ item }}"
+    state: link
+  with_items:
+    - bind9
+    - bind9_rndc
+  notify: restart munin-node
+  when:
+    - bind_recursive_server
+    - munin_node_plugins_config.stat.exists
   tags:
     - bind
     - munin
@@ -33,7 +50,7 @@
     mode: "0644"
     force: yes
   notify: restart munin-node
-  when: bind_authoritative_server and munin_node_plugins_config.stat.exists
+  when: munin_node_plugins_config.stat.exists
   tags:
     - bind
     - munin

bind/templates/logrotate_bind.j2

@@ -1,4 +1,8 @@
-/var/log/bind.log {
+{% if bind_chroot_set %}
+{{ bind_chroot_path }}{{bind_log_file}} {
+{% else %}
+{{bind_log_file}} {
+{% endif %}
     weekly
     missingok
     rotate 52

bind/templates/logrotate_bind_chroot.j2

@@ -1,10 +0,0 @@
-{{ bind_chroot_path }}/var/log/bind.log {
-    weekly
-    missingok
-    rotate 52
-    create 640 bind bind
-    sharedscripts
-    postrotate
-        rndc reload > /dev/null
-    endscript
-}

bind/templates/munin-env_bind9.j2

@@ -1,6 +1,9 @@
 [bind*]
 user root
-env.logfile {{ bind_query_file }}
-env.querystats {{ bind_chroot_path }}{{ bind_statistics_file }}
+
+env.logfile {% if bind_chroot_set %}{{ bind_chroot_path }}{% endif %}{{ bind_query_file }}
+{% if bind_authoritative_server %}
+env.querystats {% if bind_chroot_set %}{{ bind_chroot_path }}{% endif %}{{ bind_statistics_file }}
+{% endif %}
 env.MUNIN_PLUGSTATE /var/lib/munin
 timeout 120

bind/templates/named.conf.options_authoritative.j2

@@ -4,11 +4,11 @@ acl "foo" {
 };
 
 options {
-      directory "/var/cache/bind";
+      directory "{{ bind_cache_dir }}";
       version "Bingo";
       auth-nxdomain no;
       masterfile-format text;
-      statistics-file "/var/run/named.stats";
+      statistics-file "{{ bind_statistics_file }}";
 
       listen-on-v6 { any; };
       listen-on { any; };
@@ -23,11 +23,11 @@ logging {
     category queries { query_logging; };
 
     channel default_file {
-        file "/var/log/bind.log";
+        file "{{ bind_log_file }}";
         severity info;
     };
     channel query_logging {
-        file "/var/log/bind_queries.log" versions 2 size 128M;
+        file "{{ bind_query_file }}" versions 2 size 128M;
         print-category yes;
         print-severity yes;
         print-time yes;

bind/templates/named.conf.options_recursive.j2

@@ -1,5 +1,5 @@
 options {
-    directory "/var/cache/bind";
+    directory "{{ bind_cache_dir }}";
     version "Bingo";
     auth-nxdomain no;
     listen-on-v6 { ::1; };
@@ -8,9 +8,17 @@ options {
 };
 
 logging {
-        category default { default_file; };
-        channel default_file {
-                file "/var/log/bind.log";
-                severity info;
-        };
+    category default { default_file; };
+    category queries { query_logging; };
+
+    channel default_file {
+        file "{{ bind_log_file }}";
+        severity info;
+    };
+    channel query_logging {
+        file "{{ bind_query_file }}" versions 2 size 128M;
+        print-category yes;
+        print-severity yes;
+        print-time yes;
+    };
 };